activeadmin-orac 1.0.0.pre4

data/features/support/selectors.rb

@@ -0,0 +1,45 @@
+module HtmlSelectorsHelpers
+  # Maps a name to a selector. Used primarily by the
+  #
+  #   When /^(.+) within (.+)$/ do |step, scope|
+  #
+  # step definitions in web_steps.rb
+  #
+  def selector_for(locator)
+    case locator
+
+    when "the page"
+      "html > body"
+
+    # Add more mappings here.
+    # Here is an example that pulls values out of the Regexp:
+    #
+    #  when /^the (notice|error|info) flash$/
+    #    ".flash.#{$1}"
+
+    # You can also return an array to use a different selector
+    # type, like:
+    #
+    #  when /the header/
+    #    [:xpath, "//header"]
+
+    when "index grid"
+      [:css, "table.index_grid"]
+
+    when /^the "([^"]*)" sidebar$/
+      [:css, "##{$1.tr(" ", '').underscore}_sidebar_section"]
+
+    # This allows you to provide a quoted selector as the scope
+    # for "within" steps as was previously the default for the
+    # web steps:
+    when /^"(.+)"$/
+      $1
+
+    else
+      raise "Can't find mapping from \"#{locator}\" to a selector.\n" +
+        "Now, go and add a mapping in #{__FILE__}"
+    end
+  end
+end
+
+World(HtmlSelectorsHelpers)

data/features/symbol_leak.feature

@@ -0,0 +1,35 @@
+Feature: User input shouldn't be symbolized
+
+  Background:
+    Given a configuration of:
+    """
+      ActiveAdmin.register Post
+    """
+    Given I am logged in
+    And 1 post exists
+
+  Scenario: The dashboard doesn't leak
+    Given I am on the dashboard with params "?really_long_malicious_key0"
+    Then "really_long_malicious_key0" shouldn't be a symbol
+
+  Scenario: The index page doesn't leak
+    Given I am on the index page for posts with params "?really_long_malicious_key1"
+    Then "really_long_malicious_key1" shouldn't be a symbol
+
+  @allow-rescue
+  Scenario: The filter query hash doesn't leak
+    Given I am on the index page for posts with params "?q[really_long_malicious_key2]"
+    Then "really_long_malicious_key2" shouldn't be a symbol
+
+  Scenario: The show page doesn't leak
+    Given I go to the first post show page with params "?really_long_malicious_key3"
+    Then "really_long_malicious_key3" shouldn't be a symbol
+
+  Scenario: The edit page doesn't leak
+    Given I go to the first post edit page with params "?really_long_malicious_key4"
+    Then "really_long_malicious_key4" shouldn't be a symbol
+
+  @allow-rescue
+  Scenario: Batch Actions don't leak
+    Given I POST to "admin/posts/batch_action" with params "?batch_action=really_long_malicious_key5"
+    Then "really_long_malicious_key5" shouldn't be a symbol

data/features/users/logging_in.feature

@@ -0,0 +1,36 @@
+Feature: User Logging In
+
+  Logging in to the system as an admin user
+
+  Background:
+    Given a configuration of:
+    """
+      ActiveAdmin.register Post
+    """
+    And I am logged out
+    And an admin user "admin@example.com" exists
+    When I go to the dashboard
+
+  Scenario: Logging in Successfully
+    When I fill in "Email" with "admin@example.com"
+    And I fill in "Password" with "password"
+    And I press "Login"
+    Then I should be on the the dashboard
+    And I should see the element "a[href='/admin/logout'       ]:contains('Logout')"
+    And I should see the element "a[href='/admin/admin_users/1']:contains('admin@example.com')"
+
+  Scenario: Attempting to log in with an incorrect email address
+    Given override locale "devise.failure.not_found_in_database" with "Invalid email or password."
+    When I fill in "Email" with "not-an-admin@example.com"
+    And I fill in "Password" with "not-my-password"
+    And I press "Login"
+    Then I should see "Login"
+    And I should see "Invalid email or password."
+
+  Scenario: Attempting to log in with an incorrect password
+    Given override locale "devise.failure.invalid" with "Invalid email or password."
+    When I fill in "Email" with "admin@example.com"
+    And I fill in "Password" with "not-my-password"
+    And I press "Login"
+    Then I should see "Login"
+    And I should see "Invalid email or password."

data/features/users/logging_out.feature

@@ -0,0 +1,13 @@
+Feature: User Logging out
+
+  Logging out of the system as an admin user
+
+  Scenario: Logging out successfully
+    Given a configuration of:
+    """
+      ActiveAdmin.register Post
+    """
+    And I am logged in
+    When I go to the dashboard
+    And I follow "Logout"
+    Then I should see "Login"

data/features/users/resetting_password.feature

@@ -0,0 +1,34 @@
+Feature: User Resetting Password
+
+  Resetting my password as an admin user
+
+  Background:
+    Given a configuration of:
+    """
+      ActiveAdmin.register Post
+    """
+    And I am logged out
+    And an admin user "admin@example.com" exists
+
+  Scenario: Resetting password successfully
+    When I go to the dashboard
+    And I follow "Forgot your password?"
+    When I fill in "Email" with "admin@example.com"
+    And I press "Reset My Password"
+    Then I should see "You will receive an email with instructions on how to reset your password in a few minutes."
+
+  Scenario: Changing password after resetting
+    When "admin@example.com" requests a password reset with token "foobarbaz"
+    When I go to the admin password reset form with token "foobarbaz"
+    And I fill in the password field with "password"
+    And I fill in "Password confirmation" with "password"
+    And I press "Change my password"
+    Then I should see "success"
+
+  Scenario: Changing password after resetting with errors
+    When "admin@example.com" requests a password reset with token "foobarbaz" but it expires
+    When I go to the admin password reset form with token "foobarbaz"
+    And I fill in the password field with "password"
+    And I fill in "Password confirmation" with "wrong"
+    And I press "Change my password"
+    Then I should see "expired"

data/lib/active_admin.rb

@@ -0,0 +1,130 @@
+require 'active_support/core_ext'
+require 'set'
+
+require 'ransack'
+require 'ransack_ext'
+require 'bourbon'
+require 'kaminari'
+require 'formtastic'
+require 'formtastic_i18n'
+require 'sass-rails'
+require 'inherited_resources'
+require 'jquery-rails'
+require 'jquery-ui-rails'
+require 'coffee-rails'
+require 'arbre'
+
+require 'active_admin/helpers/i18n'
+
+module ActiveAdmin
+
+  autoload :VERSION,                  'active_admin/version'
+  autoload :Application,              'active_admin/application'
+  autoload :AssetRegistration,        'active_admin/asset_registration'
+  autoload :Authorization,            'active_admin/authorization_adapter'
+  autoload :AuthorizationAdapter,     'active_admin/authorization_adapter'
+  autoload :Callbacks,                'active_admin/callbacks'
+  autoload :Component,                'active_admin/component'
+  autoload :BaseController,           'active_admin/base_controller'
+  autoload :CanCanAdapter,            'active_admin/cancan_adapter'
+  autoload :ControllerAction,         'active_admin/controller_action'
+  autoload :CSVBuilder,               'active_admin/csv_builder'
+  autoload :Dependency,               'active_admin/dependency'
+  autoload :Deprecation,              'active_admin/deprecation'
+  autoload :Devise,                   'active_admin/devise'
+  autoload :DSL,                      'active_admin/dsl'
+  autoload :Event,                    'active_admin/event'
+  autoload :FormBuilder,              'active_admin/form_builder'
+  autoload :Inputs,                   'active_admin/inputs'
+  autoload :Menu,                     'active_admin/menu'
+  autoload :MenuCollection,           'active_admin/menu_collection'
+  autoload :MenuItem,                 'active_admin/menu_item'
+  autoload :Namespace,                'active_admin/namespace'
+  autoload :OrderClause,              'active_admin/order_clause'
+  autoload :Page,                     'active_admin/page'
+  autoload :PagePresenter,            'active_admin/page_presenter'
+  autoload :PageController,           'active_admin/page_controller'
+  autoload :PageDSL,                  'active_admin/page_dsl'
+  autoload :PunditAdapter,            'active_admin/pundit_adapter'
+  autoload :Resource,                 'active_admin/resource'
+  autoload :ResourceController,       'active_admin/resource_controller'
+  autoload :ResourceDSL,              'active_admin/resource_dsl'
+  autoload :Scope,                    'active_admin/scope'
+  autoload :ScopeChain,               'active_admin/helpers/scope_chain'
+  autoload :SidebarSection,           'active_admin/sidebar_section'
+  autoload :TableBuilder,             'active_admin/table_builder'
+  autoload :ViewFactory,              'active_admin/view_factory'
+  autoload :ViewHelpers,              'active_admin/view_helpers'
+  autoload :Views,                    'active_admin/views'
+
+  class << self
+
+    attr_accessor :application
+
+    def application
+      @application ||= ::ActiveAdmin::Application.new
+    end
+
+    # Gets called within the initializer
+    def setup
+      application.setup!
+      yield(application)
+      application.prepare!
+    end
+
+    delegate :register,      to: :application
+    delegate :register_page, to: :application
+    delegate :unload!,       to: :application
+    delegate :load!,         to: :application
+    delegate :routes,        to: :application
+
+    # A callback is triggered each time (before) Active Admin loads the configuration files.
+    # In development mode, this will happen whenever the user changes files. In production
+    # it only happens on boot.
+    #
+    # The block takes the current instance of [ActiveAdmin::Application]
+    #
+    # Example:
+    #
+    #     ActiveAdmin.before_load do |app|
+    #       # Do some stuff before AA loads
+    #     end
+    #
+    # @param [Block] block A block to call each time (before) AA loads resources
+    def before_load(&block)
+      ActiveSupport::Notifications.subscribe ActiveAdmin::Application::BeforeLoadEvent, &ActiveAdmin::Event.wrap_block_for_active_support_notifications(block)
+    end
+
+    # A callback is triggered each time (after) Active Admin loads the configuration files. This
+    # is an opportunity to hook into Resources after they've been loaded.
+    #
+    # The block takes the current instance of [ActiveAdmin::Application]
+    #
+    # Example:
+    #
+    #     ActiveAdmin.after_load do |app|
+    #       app.namespaces.each do |name, namespace|
+    #         puts "Namespace: #{name} loaded!"
+    #       end
+    #     end
+    #
+    # @param [Block] block A block to call each time (after) AA loads resources
+    def after_load(&block)
+      ActiveSupport::Notifications.subscribe ActiveAdmin::Application::AfterLoadEvent, &ActiveAdmin::Event.wrap_block_for_active_support_notifications(block)
+    end
+
+  end
+
+end
+
+# Require things that don't support autoload
+require 'active_admin/engine'
+require 'active_admin/error'
+
+# Require internal plugins
+require 'active_admin/batch_actions'
+require 'active_admin/filters'
+
+# Require ORM-specific plugins
+require 'active_admin/orm/active_record' if defined? ActiveRecord
+require 'active_admin/orm/mongoid'       if defined? Mongoid

data/lib/active_admin/abstract_view_factory.rb

@@ -0,0 +1,85 @@
+module ActiveAdmin
+  class AbstractViewFactory
+    @@default_views = {}
+
+    def self.register(view_hash)
+      view_hash.each do |view_key, view_class|
+        @@default_views[view_key] = view_class
+      end
+    end
+
+    def initialize
+      @views = {}
+    end
+
+    # Register a new view key with the view factory
+    #
+    # eg:
+    #
+    #   factory = AbstractViewFactory.new
+    #   factory.register my_view: SomeViewClass
+    #
+    # You can setup many at the same time:
+    #
+    #   factory.register  my_view: SomeClass,
+    #                     another_view: OtherViewClass
+    #
+    def register(view_hash)
+      view_hash.each do |view_key, view_class|
+        @views[view_key] = view_class
+      end
+    end
+
+    def default_for(key)
+      @@default_views[key.to_sym]
+    end
+
+    def has_key?(key)
+      @views.has_key?(key.to_sym) || @@default_views.has_key?(key.to_sym)
+    end
+
+    def [](key)
+      get_view_for_key(key)
+    end
+
+    def []=(key, value)
+      set_view_for_key(key, value)
+    end
+
+    def respond_to_missing?(method, include_private)
+      key = key_from_method_name(method)
+      if has_key?(key)
+        true
+      else
+        super
+      end
+    end
+
+    private
+
+    def method_missing(method, *args)
+      key = key_from_method_name(method)
+      if has_key?(key)
+        if method.to_s.include?('=')
+          set_view_for_key key, args.first
+        else
+          get_view_for_key key
+        end
+      else
+        super
+      end
+    end
+
+    def key_from_method_name(method)
+      method.to_s.tr('=', '').to_sym
+    end
+
+    def get_view_for_key(key)
+      @views[key.to_sym] || @@default_views[key.to_sym]
+    end
+
+    def set_view_for_key(key, view)
+      @views[key.to_sym] = view
+    end
+  end
+end

data/lib/active_admin/application.rb

@@ -0,0 +1,324 @@
+require 'active_admin/router'
+require 'active_admin/reloader'
+require 'active_admin/helpers/settings'
+
+module ActiveAdmin
+  class Application
+    include Settings
+    include Settings::Inheritance
+
+    settings_inherited_by Namespace
+
+    # The default namespace to put controllers and routes inside. Set this
+    # in config/initializers/active_admin.rb using:
+    #
+    #   config.default_namespace = :super_admin
+    #
+    setting :default_namespace, :admin
+
+    attr_reader :namespaces
+    def initialize
+      @namespaces = Namespace::Store.new
+    end
+
+    # Load paths for admin configurations. Add folders to this load path
+    # to load up other resources for administration. External gems can
+    # include their paths in this load path to provide active_admin UIs
+    setting :load_paths, [File.expand_path('app/admin', Rails.root)]
+
+    # The default number of resources to display on index pages
+    inheritable_setting :default_per_page, 30
+
+    # The max number of resources to display on index pages and batch exports
+    inheritable_setting :max_per_page, 10_000
+
+    # The title which gets displayed in the main layout
+    inheritable_setting :site_title, ""
+
+    # Set the site title link href (defaults to AA dashboard)
+    inheritable_setting :site_title_link, ""
+
+    # Set the site title image displayed in the main layout (has precendence over :site_title)
+    inheritable_setting :site_title_image, ""
+
+    # Set a favicon
+    inheritable_setting :favicon, false
+
+    # Additional meta tags to place in head of logged in pages.
+    inheritable_setting :meta_tags, {}
+
+    # Additional meta tags to place in head of logged out pages.
+    inheritable_setting :meta_tags_for_logged_out_pages, { robots: "noindex, nofollow" }
+
+    # The view factory to use to generate all the view classes. Take
+    # a look at ActiveAdmin::ViewFactory
+    inheritable_setting :view_factory, ActiveAdmin::ViewFactory.new
+
+    # The method to call in controllers to get the current user
+    inheritable_setting :current_user_method, false
+
+    # The method to call in the controllers to ensure that there
+    # is a currently authenticated admin user
+    inheritable_setting :authentication_method, false
+
+    # The path to log user's out with. If set to a symbol, we assume
+    # that it's a method to call which returns the path
+    inheritable_setting :logout_link_path, :destroy_admin_user_session_path
+
+    # The method to use when generating the link for user logout
+    inheritable_setting :logout_link_method, :get
+
+    # Whether the batch actions are enabled or not
+    inheritable_setting :batch_actions, false
+
+    # Whether filters are enabled
+    inheritable_setting :filters, true
+
+    # The namespace root.
+    inheritable_setting :root_to, 'dashboard#index'
+
+    # Options that a passed to root_to.
+    inheritable_setting :root_to_options, {}
+
+    # Display breadcrumbs
+    inheritable_setting :breadcrumb, true
+
+    # Default CSV options
+    inheritable_setting :csv_options, { col_sep: ',', byte_order_mark: "\xEF\xBB\xBF" }
+
+    # Default Download Links options
+    inheritable_setting :download_links, true
+
+    # The authorization adapter to use
+    inheritable_setting :authorization_adapter, ActiveAdmin::AuthorizationAdapter
+
+    # A proc to be used when a user is not authorized to view the current resource
+    inheritable_setting :on_unauthorized_access, :rescue_active_admin_access_denied
+
+    # A regex to detect unsupported browser, set to false to disable
+    inheritable_setting :unsupported_browser_matcher, /MSIE [1-8]\.0/
+
+    # Whether to display 'Current Filters' on search screen
+    inheritable_setting :current_filters, true
+
+    # Request parameters that are permitted by default
+    inheritable_setting :permitted_params, [
+      :utf8, :_method, :authenticity_token, :commit, :id
+    ]
+
+    # Set flash message keys that shouldn't show in ActiveAdmin
+    inheritable_setting :flash_keys_to_except, ['timedout']
+
+    # Set default localize format for Date/Time values
+    setting :localize_format, :long
+
+    # Include association filters by default
+    inheritable_setting :include_default_association_filters, true
+
+    # Active Admin makes educated guesses when displaying objects, this is
+    # the list of methods it tries calling in order
+    setting :display_name_methods, [ :display_name,
+                                      :full_name,
+                                      :name,
+                                      :username,
+                                      :login,
+                                      :title,
+                                      :email,
+                                      :to_s ]
+
+    # To make debugging easier, by default don't stream in development
+    setting :disable_streaming_in, ['development']
+
+    # == Deprecated Settings
+
+    def allow_comments=(*)
+      raise "`config.allow_comments` is no longer provided in ActiveAdmin 1.x. Use `config.comments` instead."
+    end
+
+    include AssetRegistration
+
+    # Event that gets triggered on load of Active Admin
+    BeforeLoadEvent = 'active_admin.application.before_load'.freeze
+    AfterLoadEvent  = 'active_admin.application.after_load'.freeze
+
+    # Runs before the app's AA initializer
+    def setup!
+      register_default_assets
+    end
+
+    # Runs after the app's AA initializer
+    def prepare!
+      remove_active_admin_load_paths_from_rails_autoload_and_eager_load
+      attach_reloader
+    end
+
+    # Registers a brand new configuration for the given resource.
+    def register(resource, options = {}, &block)
+      ns = options.fetch(:namespace){ default_namespace }
+      namespace(ns).register resource, options, &block
+    end
+
+    # Creates a namespace for the given name
+    #
+    # Yields the namespace if a block is given
+    #
+    # @return [Namespace] the new or existing namespace
+    def namespace(name)
+      name ||= :root
+
+      namespace = namespaces[name] ||= begin
+        namespace = Namespace.new(self, name)
+        ActiveSupport::Notifications.publish ActiveAdmin::Namespace::RegisterEvent, namespace
+        namespace
+      end
+
+      yield(namespace) if block_given?
+
+      namespace
+    end
+
+    # Register a page
+    #
+    # @param name [String] The page name
+    # @option [Hash] Accepts option :namespace.
+    # @&block The registration block.
+    #
+    def register_page(name, options = {}, &block)
+      ns = options.fetch(:namespace){ default_namespace }
+      namespace(ns).register_page name, options, &block
+    end
+
+    # Whether all configuration files have been loaded
+    def loaded?
+      @@loaded ||= false
+    end
+
+    # Removes all defined controllers from memory. Useful in
+    # development, where they are reloaded on each request.
+    def unload!
+      namespaces.each &:unload!
+      @@loaded = false
+    end
+
+    # Loads all ruby files that are within the load_paths setting.
+    # To reload everything simply call `ActiveAdmin.unload!`
+    def load!
+      unless loaded?
+        ActiveSupport::Notifications.publish BeforeLoadEvent, self # before_load hook
+        files.each{ |file| load file }                             # load files
+        namespace(default_namespace)                               # init AA resources
+        ActiveSupport::Notifications.publish AfterLoadEvent, self  # after_load hook
+        @@loaded = true
+      end
+    end
+
+    def load(file)
+      DatabaseHitDuringLoad.capture{ super }
+    end
+
+    # Returns ALL the files to be loaded
+    def files
+      load_paths.flatten.compact.uniq.flat_map{ |path| Dir["#{path}/**/*.rb"] }
+    end
+
+    def router
+      @router ||= Router.new(self)
+    end
+
+    # One-liner called by user's config/routes.rb file
+    def routes(rails_router)
+      load!
+      router.apply(rails_router)
+    end
+
+    # Adds before, around and after filters to all controllers.
+    # Example usage:
+    #   ActiveAdmin.before_filter :authenticate_admin!
+    #
+    AbstractController::Callbacks::ClassMethods.public_instance_methods.
+      select { |m| m.match(/(filter|action)/) }.each do |name|
+      define_method name do |*args, &block|
+        controllers_for_filters.each do |controller|
+          controller.public_send name, *args, &block
+        end
+      end
+    end
+
+    def controllers_for_filters
+      controllers = [BaseController]
+      controllers.push *Devise.controllers_for_filters if Dependency.devise?
+      controllers
+    end
+
+  private
+
+    def register_default_assets
+      register_stylesheet 'active_admin.css',       media: 'screen'
+      register_stylesheet 'active_admin/print.css', media: 'print'
+
+      register_javascript 'active_admin.js'
+    end
+
+    # Since app/admin is alphabetically before app/models, we have to remove it
+    # from the host app's +autoload_paths+ to prevent missing constant errors.
+    #
+    # As well, we have to remove it from +eager_load_paths+ to prevent the
+    # files from being loaded twice in production.
+    def remove_active_admin_load_paths_from_rails_autoload_and_eager_load
+      ActiveSupport::Dependencies.autoload_paths -= load_paths
+      Rails.application.config.eager_load_paths  -= load_paths
+    end
+
+    # Hook into the Rails code reloading mechanism so that things are reloaded
+    # properly in development mode.
+    #
+    # If any of the app files (e.g. models) has changed, we need to reload all
+    # the admin files. If the admin files themselves has changed, we need to
+    # regenerate the routes as well.
+    def attach_reloader
+      Rails.application.config.after_initialize do |app|
+        unload_active_admin = -> { ActiveAdmin.application.unload! }
+
+        if app.config.reload_classes_only_on_change
+          # Rails is about to unload all the app files (e.g. models), so we
+          # should first unload the classes generated by Active Admin, otherwise
+          # they will contain references to the stale (unloaded) classes.
+          Reloader.to_prepare(prepend: true, &unload_active_admin)
+        else
+          # If the user has configured the app to always reload app files after
+          # each request, so we should unload the generated classes too.
+          Reloader.to_complete(&unload_active_admin)
+        end
+
+        admin_dirs = {}
+
+        load_paths.each do |path|
+          admin_dirs[path] = [:rb]
+        end
+
+        routes_reloader = app.config.file_watcher.new([], admin_dirs) do
+          app.reload_routes!
+        end
+
+        app.reloaders << routes_reloader
+
+        Reloader.to_prepare do
+          # Rails might have reloaded the routes for other reasons (e.g.
+          # routes.rb has changed), in which case Active Admin would have been
+          # loaded via the `ActiveAdmin.routes` call in `routes.rb`.
+          #
+          # Otherwise, we should check if any of the admin files are changed
+          # and force the routes to reload if necessary. This would again causes
+          # Active Admin to load via `ActiveAdmin.routes`.
+          #
+          # Finally, if Active Admin is still not loaded at this point, then we
+          # would need to load it manually.
+          unless ActiveAdmin.application.loaded?
+            routes_reloader.execute_if_updated
+            ActiveAdmin.application.load!
+          end
+        end
+      end
+    end
+  end
+end