bible270 0.6.3 → 0.10.0

data/Rakefile

@@ -1,10 +1,11 @@
 # frozen_string_literal: true
-require "bundler/gem_tasks" # provides build / install / release
-require "rake/testtask"
+
+require 'bundler/gem_tasks' # provides build / install / release
+require 'rake/testtask'
 
 Rake::TestTask.new(:test) do |t|
-  t.libs << "test" << "lib"
-  t.pattern = "test/**/*_test.rb"
+  t.libs << 'test' << 'lib'
+  t.pattern = 'test/**/*_test.rb'
   t.warning = false
 end
 

data/app/controllers/bible270/admin_controller.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+module Bible270
+  # Small administrative panel: remove readers, adjust their completions, and
+  # move them to a given day of the plan.
+  #
+  # Access is controlled by Bible270.config.admin_emails / admin_resolver. With
+  # neither set the panel is unreachable, and every action 404s rather than 403s
+  # so its existence isn't advertised.
+  class AdminController < ApplicationController
+    before_action :require_admin!
+    before_action :load_reader, only: %i[show destroy update_start complete_through toggle_day]
+    before_action :load_comment, only: %i[hide_comment unhide_comment destroy_comment]
+
+    def index
+      @readers = Reader.all.to_a.sort_by(&:sort_name)
+      counts = Checkoff.group(:reader_id, :day).count
+      @days_completed = Hash.new(0)
+      counts.each { |(rid, day), n| @days_completed[rid] += 1 if n >= Plan.required_track_count(day) }
+    end
+
+    def show
+      @days_completed = @reader.days_completed
+      @comments = @reader.comments.order(created_at: :desc).limit(50)
+    end
+
+    # ---- reflections ------------------------------------------------------
+
+    # Everything is visible by default; this lists it all so anything unsuitable
+    # can be taken down.
+    def comments
+      scope = Comment.includes(:reader).order(created_at: :desc)
+      @filter = params[:filter].to_s
+      scope = scope.hidden if @filter == 'hidden'
+      scope = scope.approved if @filter == 'visible'
+      @comments = scope.limit(200)
+      @hidden_count = Comment.hidden.count
+    end
+
+    def hide_comment
+      @comment.hide!
+      redirect_back_to_comments "Hidden #{@comment.reader.display_name}'s reflection on day #{@comment.day}."
+    end
+
+    def unhide_comment
+      @comment.unhide!
+      redirect_back_to_comments "Restored #{@comment.reader.display_name}'s reflection on day #{@comment.day}."
+    end
+
+    def destroy_comment
+      day = @comment.day
+      @comment.destroy
+      redirect_back_to_comments "Deleted the reflection on day #{day}."
+    end
+
+    def destroy
+      name = @reader.display_name
+      @reader.destroy
+      redirect_to admin_path, notice: "Removed #{name} and all their check-offs and reflections."
+    end
+
+    # Put the reader on a given day as of today, or set an explicit start date.
+    def update_start
+      if params[:start_date].present?
+        if @reader.update_start_date!(params[:start_date])
+          redirect_to admin_reader_path(@reader), notice: 'Start date updated.'
+        else
+          redirect_to admin_reader_path(@reader), alert: "That doesn't look like a date."
+        end
+      elsif params[:day].present? && @reader.restart_on!(day: params[:day])
+        redirect_to admin_reader_path(@reader),
+                    notice: "#{@reader.display_name} is now on day #{params[:day]}."
+      else
+        redirect_to admin_reader_path(@reader), alert: 'Give a start date or a day between 1 and 270.'
+      end
+    end
+
+    def complete_through
+      day = params[:day].to_i
+      if @reader.mark_through!(day)
+        redirect_to admin_reader_path(@reader),
+                    notice: day.zero? ? 'All check-offs cleared.' : "Marked days 1-#{day} complete."
+      else
+        redirect_to admin_reader_path(@reader), alert: 'Give a day between 0 and 270.'
+      end
+    end
+
+    def toggle_day
+      day = params[:day].to_i
+      if @reader.toggle_day!(day)
+        redirect_to admin_reader_path(@reader, anchor: "day-#{day}")
+      else
+        redirect_to admin_reader_path(@reader), alert: 'That day is outside the plan.'
+      end
+    end
+
+  private
+
+    def require_admin!
+      return if Bible270.config.admin_configured? && Bible270.config.admin?(current_reader)
+
+      raise ActionController::RoutingError, 'Not Found'
+    end
+
+    def load_comment
+      @comment = Comment.find_by(id: params[:id])
+      redirect_to(admin_comments_path, alert: 'Reflection not found.') if @comment.nil?
+    end
+
+    def redirect_back_to_comments(notice)
+      redirect_to(params[:return_to].presence || admin_comments_path, notice: notice)
+    end
+
+    def load_reader
+      @reader = Reader.find_by(id: params[:id])
+      redirect_to(admin_path, alert: 'Reader not found.') if @reader.nil?
+    end
+  end
+end

data/app/controllers/bible270/application_controller.rb

@@ -1,11 +1,28 @@
 # frozen_string_literal: true
+
 module Bible270
   class ApplicationController < Bible270.config.parent_controller.constantize
+    # Rails only auto-includes an isolated engine's helpers when the controller's
+    # superclass is *exactly* ActionController::Base:
+    #
+    #   # ActionController::Railties::Helpers#inherited
+    #   klass.helpers_path = namespace.railtie_helpers_paths
+    #   klass.helper :all if klass.superclass == ActionController::Base && ...
+    #
+    # config.parent_controller normally points at the host's ApplicationController,
+    # so that check fails and the b270_* helpers are never mixed in — every view
+    # calling one then raises NoMethodError. helpers_path is still set to this
+    # engine's app/helpers, so asking for them explicitly is all that's needed.
+    helper :all
+    # ...and name it outright, in case helpers_path resolves to the host app's
+    # helpers rather than this engine's.
+    helper Bible270::PlanHelper
+
     layout :bible270_layout
 
     helper_method :current_reader, :signed_in?, :b270_config
 
-    private
+  private
 
     def bible270_layout
       Bible270.config.layout
@@ -39,7 +56,7 @@ module Bible270
         format.turbo_stream { head :unauthorized }
         format.html do
           redirect_to sign_in_path(origin: request.fullpath),
-                      alert: "Please sign in to take part."
+                      alert: 'Please sign in to take part.'
         end
       end
       false

data/app/controllers/bible270/checkoffs_controller.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Bible270
   class CheckoffsController < ApplicationController
     def toggle
@@ -7,9 +8,7 @@ module Bible270
       @day   = params[:day].to_i
       @track = params[:track].to_s
 
-      unless Plan.valid_day?(@day) && Plan.present_tracks(@day).include?(@track)
-        head :bad_request and return
-      end
+      head :bad_request and return unless Plan.valid_day?(@day) && Plan.present_tracks(@day).include?(@track)
 
       existing = current_reader.checkoffs.find_by(day: @day, track: @track)
       if existing

data/app/controllers/bible270/comments_controller.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Bible270
   class CommentsController < ApplicationController
     def create
@@ -17,7 +18,10 @@ module Bible270
         end
       else
         respond_to do |format|
-          format.turbo_stream { render turbo_stream: turbo_stream.replace("new_comment_form", partial: "bible270/comments/form", locals: { day: @day, comment: @comment }) }
+          format.turbo_stream do
+            render turbo_stream: turbo_stream.replace('new_comment_form', partial: 'bible270/comments/form',
+                                                                          locals: { day: @day, comment: @comment })
+          end
           format.html { redirect_to day_path(@day), alert: @comment.errors.full_messages.to_sentence }
         end
       end
@@ -37,7 +41,7 @@ module Bible270
       end
     end
 
-    private
+  private
 
     def comment_params
       params.require(:comment).permit(:body, :track)

data/app/controllers/bible270/days_controller.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Bible270
   class DaysController < ApplicationController
     def index
@@ -19,9 +20,7 @@ module Bible270
 
     def show
       @day = params[:day].to_i
-      unless Plan.valid_day?(@day)
-        redirect_to(root_path, alert: "That day is outside the plan.") and return
-      end
+      redirect_to(root_path, alert: 'That day is outside the plan.') and return unless Plan.valid_day?(@day)
 
       @readings   = Plan.readings_for(@day)
       @comments   = Comment.for_day(@day).includes(:reader)
@@ -30,9 +29,9 @@ module Bible270
 
       req = Plan.required_track_count(@day)
       completer_ids = Checkoff.where(day: @day)
-                              .group(:reader_id)
-                              .having("COUNT(*) >= ?", req)
-                              .pluck(:reader_id)
+        .group(:reader_id)
+        .having('COUNT(*) >= ?', req)
+        .pluck(:reader_id)
       @completers = Reader.where(id: completer_ids).order(:display_name)
 
       @prev_day = @day > 1 ? @day - 1 : nil

data/app/controllers/bible270/readers_controller.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Bible270
   class ReadersController < ApplicationController
     def index
@@ -11,7 +12,7 @@ module Bible270
 
     def show
       @reader = Reader.find_by(id: params[:id])
-      redirect_to(community_path, alert: "Reader not found.") and return unless @reader
+      redirect_to(community_path, alert: 'Reader not found.') and return unless @reader
 
       @days_completed = @reader.days_completed
       @recent_comments = @reader.comments.recent.limit(20)
@@ -21,7 +22,7 @@ module Bible270
       return unless require_reader!
 
       unless Bible270.config.allow_reader_start_date
-        redirect_to(root_path, alert: "The start date is set for the whole community.") and return
+        redirect_to(root_path, alert: 'The start date is set for the whole community.') and return
       end
 
       if current_reader.update_start_date!(params[:start_date])
@@ -37,9 +38,9 @@ module Bible270
 
       if Bible270.config.allow_reader_start_date
         current_reader.clear_start_date!
-        redirect_to root_path, notice: "Start date cleared — the plan is now undated for you."
+        redirect_to root_path, notice: 'Start date cleared — the plan is now undated for you.'
       else
-        redirect_to root_path, alert: "The start date is set for the whole community."
+        redirect_to root_path, alert: 'The start date is set for the whole community.'
       end
     end
   end

data/app/controllers/bible270/sessions_controller.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Bible270
   # Built-in OmniAuth sign-in.
   #
@@ -17,17 +18,13 @@ module Bible270
     end
 
     def create
-      auth = request.env["omniauth.auth"]
-      unless auth
-        redirect_to(sign_in_path, alert: "Sign in didn't complete. Please try again.") and return
-      end
+      auth = request.env['omniauth.auth']
+      redirect_to(sign_in_path, alert: "Sign in didn't complete. Please try again.") and return unless auth
 
       reader = Reader.from_omniauth(auth)
-      unless reader&.persisted?
-        redirect_to(sign_in_path, alert: "We couldn't set up your reader profile.") and return
-      end
+      redirect_to(sign_in_path, alert: "We couldn't set up your reader profile.") and return unless reader&.persisted?
 
-      destination = safe_origin(request.env["omniauth.origin"]) || after_sign_in_path
+      destination = safe_origin(request.env['omniauth.origin']) || after_sign_in_path
 
       # Rotate the session id to avoid session fixation, then sign in.
       reset_session
@@ -40,11 +37,11 @@ module Bible270
     def destroy
       reset_session
       @current_reader = nil
-      redirect_to(after_sign_out_path, notice: "Signed out.")
+      redirect_to(after_sign_out_path, notice: 'Signed out.')
     end
 
     def failure
-      message = params[:message].presence || "unknown error"
+      message = params[:message].presence || 'unknown error'
       redirect_to sign_in_path, alert: "Sign in failed (#{message.to_s.tr('_', ' ')})."
     end
 
@@ -63,14 +60,22 @@ module Bible270
                     alert: "That doesn't look like an email address — please check and try again.") and return
       end
 
-      name = Bible270.config.email_sign_in_ask_name ? params[:display_name].to_s.strip : nil
-      _record, raw = SignInToken.issue!(address, display_name: name)
+      first_name = params[:first_name].to_s.strip
+      last_name  = params[:last_name].to_s.strip
+
+      if Bible270.config.email_sign_in_require_name && (first_name.empty? || last_name.empty?)
+        redirect_to(sign_in_path(origin: origin, email: address),
+                    alert: 'Please give both your first and last name.') and return
+      end
+
+      _record, raw = SignInToken.issue!(address, first_name: first_name, last_name: last_name)
 
       if raw
-        url = email_sign_in_url(token: raw, origin: origin)
-        minutes = (Bible270.config.email_sign_in_ttl / 60.0).round
-        mail = SignInMailer.magic_link(email: address, url: url, expires_in_minutes: minutes)
-        Bible270.config.email_sign_in_deliver_later ? mail.deliver_later : mail.deliver_now
+        deliver_sign_in_link(address, email_sign_in_url(token: raw, origin: origin))
+      else
+        # Silent to the reader by design; say so in the log or this is undebuggable.
+        Rails.logger.warn("[bible270] no sign-in link issued for #{address} " \
+                          '(rate limited — see config.email_sign_in_max_per_window)')
       end
 
       # Deliberately identical whether or not a link was actually sent, so this
@@ -84,13 +89,12 @@ module Bible270
       token = SignInToken.claim!(params[:token])
       if token.nil?
         redirect_to(sign_in_path,
-                    alert: "That link has expired or was already used. Please request a new one.") and return
+                    alert: 'That link has expired or was already used. Please request a new one.') and return
       end
 
-      reader = Reader.from_email(token.email, display_name: token.display_name)
-      unless reader&.persisted?
-        redirect_to(sign_in_path, alert: "We couldn't set up your reader profile.") and return
-      end
+      reader = Reader.from_email(token.email, first_name: token.first_name,
+                                              last_name: token.last_name, display_name: token.display_name)
+      redirect_to(sign_in_path, alert: "We couldn't set up your reader profile.") and return unless reader&.persisted?
 
       destination = safe_origin(params[:origin]) || after_sign_in_path
 
@@ -101,16 +105,46 @@ module Bible270
       redirect_to destination, notice: "Welcome, #{reader.display_name}."
     end
 
-    private
+  private
+
+    # Delivery problems must not leak through the UI (the response is deliberately
+    # identical either way), so they are logged rather than raised. Without this a
+    # misconfigured mailer either 500s the request or fails silently, depending on
+    # config.action_mailer.raise_delivery_errors.
+    def deliver_sign_in_link(address, url)
+      minutes = (Bible270.config.email_sign_in_ttl / 60.0).round
+      mail = SignInMailer.magic_link(email: address, url: url, expires_in_minutes: minutes)
+      Bible270.config.email_sign_in_deliver_later ? mail.deliver_later : mail.deliver_now
+      Rails.logger.info("[bible270] sign-in email handed to Action Mailer for #{address}")
+    rescue StandardError => e
+      Rails.logger.error("[bible270] could not deliver the sign-in email to #{address}: #{e.class}: #{e.message}")
+    ensure
+      log_sign_in_link(address, url)
+    end
+
+    # In development and test, put the link in the log so you can sign in without
+    # working mail delivery. Never in production — the link is a bearer token.
+    def log_sign_in_link(address, url)
+      return unless log_sign_in_link?
+
+      Rails.logger.info("[bible270] sign-in link for #{address}: #{url}")
+    end
+
+    def log_sign_in_link?
+      flag = Bible270.config.email_sign_in_log_link
+      return flag unless flag.nil?
+
+      Rails.env.development? || Rails.env.test?
+    end
 
     # Only ever redirect within this app, and never back into an auth route.
     def safe_origin(value)
       value = value.to_s
       return nil if value.empty?
-      return nil unless value.start_with?("/")
-      return nil if value.include?("//")   # protocol-relative URL
-      return nil if value.include?("\\")   # browsers may normalise \ to /
-      return nil if value.include?("/auth/")
+      return nil unless value.start_with?('/')
+      return nil if value.include?('//')   # protocol-relative URL
+      return nil if value.include?('\\')   # browsers may normalise \ to /
+      return nil if value.include?('/auth/')
 
       value
     end

data/app/helpers/bible270/plan_helper.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Bible270
   module PlanHelper
     def b270_track(track)
@@ -18,27 +19,29 @@ module Bible270
     end
 
     def b270_passage_url(reference)
-      return "#" if reference.blank?
+      return '#' if reference.blank?
+
       Bible270.config.passage_url_builder.call(reference, Bible270.config.bible_version)
     end
 
     def b270_avatar(reader, size: 34)
       if reader.avatar_url.present?
-        image_tag reader.avatar_url, class: "b270-avatar", width: size, height: size, alt: reader.display_name
+        image_tag reader.avatar_url, class: 'b270-avatar', width: size, height: size, alt: reader.display_name
       else
-        content_tag :span, reader.initials, class: "b270-avatar b270-avatar-fallback",
-                    style: "width:#{size}px;height:#{size}px;line-height:#{size}px"
+        content_tag :span, reader.initials, class: 'b270-avatar b270-avatar-fallback',
+                                            style: "width:#{size}px;height:#{size}px;line-height:#{size}px"
       end
     end
 
     def b270_day_status_class(reader, day)
-      return "" unless reader
+      return '' unless reader
+
       if reader.day_complete?(day)
-        "complete"
+        'complete'
       elsif reader.read_tracks_for(day).any?
-        "partial"
+        'partial'
       else
-        ""
+        ''
       end
     end
   end

data/app/mailers/bible270/application_mailer.rb

@@ -1,7 +1,10 @@
 # frozen_string_literal: true
+
 module Bible270
   class ApplicationMailer < ActionMailer::Base
     default from: -> { Bible270.config.mailer_from }
-    layout nil
+    # `layout nil` means "normal lookup", which finds the host app's mailer layout and
+    # nests our complete HTML document inside theirs. Only `false` disables it.
+    layout false
   end
 end

data/app/mailers/bible270/sign_in_mailer.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Bible270
   class SignInMailer < ApplicationMailer
     # The URL is built by the controller (which has the request context), so the

data/app/models/bible270/application_record.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Bible270
   class ApplicationRecord < ActiveRecord::Base
     self.abstract_class = true

data/app/models/bible270/checkoff.rb

@@ -1,17 +1,18 @@
 # frozen_string_literal: true
+
 module Bible270
   # A single reader marking one track (ot / nt / pp) read on one day.
   class Checkoff < ApplicationRecord
-    self.table_name = "bible270_checkoffs"
+    self.table_name = 'bible270_checkoffs'
 
-    belongs_to :reader, class_name: "Bible270::Reader"
+    belongs_to :reader, class_name: 'Bible270::Reader'
 
     validates :day, inclusion: { in: 1..Plan::DAYS }
     validates :track, inclusion: { in: Plan::TRACKS.keys }
     validates :track, uniqueness: { scope: %i[reader_id day] }
     validate  :track_present_on_day
 
-    private
+  private
 
     def track_present_on_day
       return if day.nil? || track.nil?

data/app/models/bible270/comment.rb

@@ -1,16 +1,37 @@
 # frozen_string_literal: true
+
 module Bible270
   # A publicly visible reflection attached to a plan day (optionally a track).
   class Comment < ApplicationRecord
-    self.table_name = "bible270_comments"
+    self.table_name = 'bible270_comments'
 
-    belongs_to :reader, class_name: "Bible270::Reader"
+    belongs_to :reader, class_name: 'Bible270::Reader'
 
     validates :day, inclusion: { in: 1..Plan::DAYS }
     validates :body, presence: true, length: { maximum: 4000 }
-    validates :track, inclusion: { in: Plan::TRACKS.keys }, allow_nil: true
+    # A reflection can be about one track or about the whole day. The form's
+    # "The whole day" option submits an empty string, so normalise it to NULL
+    # before validating — allow_nil alone rejects "" with
+    # "Track is not included in the list".
+    before_validation :normalize_track
+
+    validates :track, inclusion: { in: Plan::TRACKS.keys }, allow_blank: true
+
+    scope :approved, -> { where(approved: true) }
+    scope :hidden,   -> { where(approved: false) }
+    scope :for_day,  ->(d) { approved.where(day: d).order(created_at: :asc) }
+    scope :recent,   -> { approved.order(created_at: :desc) }
+
+    # Every reflection is visible when written; these are the moderation actions.
+    def hide!    = update!(approved: false, moderated_at: Time.current)
+    def unhide!  = update!(approved: true,  moderated_at: Time.current)
+    def hidden?  = !approved
+    def moderated? = moderated_at.present?
+
+  private
 
-    scope :for_day, ->(d) { where(day: d).order(created_at: :asc) }
-    scope :recent,  -> { order(created_at: :desc) }
+    def normalize_track
+      self.track = Plan.normalize_track(track)
+    end
   end
 end