bullet_train 1.0.1 → 1.0.5

data/app/models/concerns/memberships/base.rb

@@ -0,0 +1,137 @@
+module Memberships::Base
+  extend ActiveSupport::Concern
+
+  included do
+    # See `docs/permissions.md` for details.
+    include Roles::Support
+
+    belongs_to :user, optional: true
+    belongs_to :team
+    belongs_to :invitation, optional: true, dependent: :destroy
+    belongs_to :added_by, class_name: "Membership", optional: true
+    belongs_to :platform_agent_of, class_name: "Platform::Application", optional: true
+
+    has_many :scaffolding_completely_concrete_tangible_things_assignments, class_name: "Scaffolding::CompletelyConcrete::TangibleThings::Assignment", dependent: :destroy
+    has_many :scaffolding_completely_concrete_tangible_things, through: :scaffolding_completely_concrete_tangible_things_assignments, source: :tangible_thing
+    has_many :reassignments_scaffolding_completely_concrete_tangible_things_reassignments, class_name: "Memberships::Reassignments::ScaffoldingCompletelyConcreteTangibleThingsReassignment", dependent: :destroy, foreign_key: :membership_id
+
+    has_many :scaffolding_absolutely_abstract_creative_concepts_collaborators, class_name: "Scaffolding::AbsolutelyAbstract::CreativeConcepts::Collaborator", dependent: :destroy
+
+    after_destroy do
+      # if we're destroying a user's membership to the team they have set as
+      # current, then we need to remove that so they don't get an error.
+      if user&.current_team == team
+        user.current_team = nil
+        user.save
+      end
+    end
+
+    scope :current_and_invited, -> { includes(:invitation).where("user_id IS NOT NULL OR invitations.id IS NOT NULL").references(:invitation) }
+    scope :current, -> { where("user_id IS NOT NULL") }
+    scope :tombstones, -> { includes(:invitation).where("user_id IS NULL AND invitations.id IS NULL").references(:invitation) }
+  end
+
+  def name
+    full_name
+  end
+
+  def label_string
+    full_name
+  end
+
+  # we overload this method so that when setting the list of role ids
+  # associated with a membership, admins can never remove the last admin
+  # of a team.
+  def role_ids=(ids)
+    # if this membership was an admin, and the new list of role ids don't include admin.
+    if admin? && !ids.include?(Role.admin.id)
+      unless team.admins.count > 1
+        raise RemovingLastTeamAdminException.new("You can't remove the last team admin.")
+      end
+    end
+
+    super(ids)
+  end
+
+  def unclaimed?
+    user.nil? && !invitation.nil?
+  end
+
+  def tombstone?
+    user.nil? && invitation.nil?
+  end
+
+  def last_admin?
+    return false unless admin?
+    return false unless user.present?
+    team.memberships.current.select(&:admin?) == [self]
+  end
+
+  def nullify_user
+    if last_admin?
+      raise RemovingLastTeamAdminException.new("You can't remove the last team admin.")
+    end
+
+    if (user_was = user)
+      unless user_first_name.present?
+        self.user_first_name = user.first_name
+      end
+
+      unless user_last_name.present?
+        self.user_last_name = user.last_name
+      end
+
+      unless user_profile_photo_id.present?
+        self.user_profile_photo_id = user.profile_photo_id
+      end
+
+      unless user_email.present?
+        self.user_email = user.email
+      end
+
+      self.user = nil
+      save
+
+      user_was.invalidate_ability_cache
+
+      user_was.update(
+        current_team: user_was.teams.first,
+        former_user: user_was.teams.empty?
+      )
+    end
+
+    # we do this here just in case by some weird chance an active membership had an invitation attached.
+    invitation&.destroy
+  end
+
+  def email
+    user&.email || user_email.presence || invitation&.email
+  end
+
+  def full_name
+    user&.full_name || [first_name.presence, last_name.presence].join(" ").presence || email
+  end
+
+  def first_name
+    user&.first_name || user_first_name
+  end
+
+  def last_name
+    user&.last_name || user_last_name
+  end
+
+  def last_initial
+    return nil unless last_name.present?
+    "#{last_name}."
+  end
+
+  def first_name_last_initial
+    [first_name, last_initial].map(&:present?).join(" ")
+  end
+
+  # TODO utilize this.
+  # members shouldn't receive notifications unless they are either an active user or an outstanding invitation.
+  def should_receive_notifications?
+    invitation.present? || user.present?
+  end
+end

data/app/models/concerns/teams/base.rb

@@ -0,0 +1,51 @@
+module Teams::Base
+  extend ActiveSupport::Concern
+
+  included do
+    # super scaffolding
+    unless scaffolding_things_disabled?
+      has_many :scaffolding_absolutely_abstract_creative_concepts, class_name: "Scaffolding::AbsolutelyAbstract::CreativeConcept", dependent: :destroy, enable_updates: true
+    end
+
+    # memberships and invitations
+    has_many :memberships, dependent: :destroy
+    has_many :users, through: :memberships
+    has_many :invitations
+
+    # oauth for grape api
+    has_many :platform_applications, class_name: "Platform::Application", dependent: :destroy, foreign_key: :team_id
+
+    # integrations
+    has_many :integrations_stripe_installations, class_name: "Integrations::StripeInstallation", dependent: :destroy if stripe_enabled?
+
+    # validations
+    validates :name, presence: true
+    validates :time_zone, inclusion: {in: ActiveSupport::TimeZone.all.map(&:name)}, allow_nil: true
+  end
+
+  def admins
+    memberships.current_and_invited.admins
+  end
+
+  def admin_users
+    admins.map(&:user).compact
+  end
+
+  def primary_contact
+    admin_users.min { |user| user.created_at }
+  end
+
+  def formatted_email_address
+    primary_contact.email
+  end
+
+  def invalidate_caches
+    users.map(&:invalidate_ability_cache)
+  end
+
+  def team
+    # some generic features appeal to the `team` method for security or scoping purposes, but sometimes those same
+    # generic functions need to function for a team model as well, so we do this.
+    self
+  end
+end

data/app/models/concerns/users/base.rb

@@ -0,0 +1,164 @@
+module Users::Base
+  extend ActiveSupport::Concern
+
+  included do
+    if two_factor_authentication_enabled?
+      devise :two_factor_authenticatable, :two_factor_backupable, :omniauthable,
+        :registerable, :recoverable, :rememberable, :trackable, :validatable,
+        otp_secret_encryption_key: ENV["TWO_FACTOR_ENCRYPTION_KEY"]
+    else
+      devise :omniauthable, :database_authenticatable, :registerable,
+        :recoverable, :rememberable, :trackable, :validatable
+    end
+
+    # teams
+    has_many :memberships, dependent: :destroy
+    has_many :scaffolding_absolutely_abstract_creative_concepts_collaborators, through: :memberships
+    has_many :teams, through: :memberships
+    belongs_to :current_team, class_name: "Team", optional: true
+    accepts_nested_attributes_for :current_team
+
+    # oauth providers
+    has_many :oauth_stripe_accounts, class_name: "Oauth::StripeAccount" if stripe_enabled?
+
+    # platform functionality.
+    belongs_to :platform_agent_of, class_name: "Platform::Application", optional: true
+
+    # validations
+    validate :real_emails_only
+    validates :time_zone, inclusion: {in: ActiveSupport::TimeZone.all.map(&:name)}, allow_nil: true
+
+    # callbacks
+    after_update :set_teams_time_zone
+  end
+
+  # TODO we need to update this to some sort of invalid email address or something
+  # people know to ignore. it would be a security problem to have this pointing
+  # at anybody's real email address.
+  def email_is_oauth_placeholder?
+    !!email.match(/noreply\+.*@bullettrain.co/)
+  end
+
+  def label_string
+    name
+  end
+
+  def name
+    full_name.present? ? full_name : email
+  end
+
+  def full_name
+    [first_name_was, last_name_was].select(&:present?).join(" ")
+  end
+
+  def details_provided?
+    first_name.present? && last_name.present? && current_team.name.present?
+  end
+
+  def send_welcome_email
+    UserMailer.welcome(self).deliver_later
+  end
+
+  def create_default_team
+    # This creates a `Membership`, because `User` `has_many :teams, through: :memberships`
+    # TODO The team name should take into account the user's current locale.
+    default_team = teams.create(name: "Your Team", time_zone: time_zone)
+    memberships.find_by(team: default_team).update role_ids: [Role.admin.id]
+    update(current_team: default_team)
+  end
+
+  def real_emails_only
+    if ENV["REALEMAIL_API_KEY"] && !Rails.env.test?
+      uri = URI("https://realemail.expeditedaddons.com")
+
+      # Change the input parameters here
+      uri.query = URI.encode_www_form({
+        api_key: ENV["REAL_EMAIL_KEY"],
+        email: email,
+        fix_typos: false
+      })
+
+      # Results are returned as a JSON object
+      result = JSON.parse(Net::HTTP.get_response(uri).body)
+
+      if result["syntax_error"]
+        errors.add(:email, "is not a valid email address")
+      elsif result["domain_error"] || (result.key?("mx_records_found") && !result["mx_records_found"])
+        errors.add(:email, "can't actually receive emails")
+      elsif result["is_disposable"]
+        errors.add(:email, "is a disposable email address")
+      end
+    end
+  end
+
+  def multiple_teams?
+    teams.count > 1
+  end
+
+  def one_team?
+    !multiple_teams?
+  end
+
+  def formatted_email_address
+    if details_provided?
+      "\"#{first_name} #{last_name}\" <#{email}>"
+    else
+      email
+    end
+  end
+
+  def administrating_team_ids
+    parent_ids_for(Role.admin, :memberships, :team)
+  end
+
+  def parent_ids_for(role, through, parent)
+    parent_id_column = "#{parent}_id"
+    key = "#{role.key}_#{through}_#{parent_id_column}s"
+    return ability_cache[key] if ability_cache && ability_cache[key]
+    role = nil if role.default?
+    value = send(through).with_role(role).distinct.pluck(parent_id_column)
+    current_cache = ability_cache || {}
+    current_cache[key] = value
+    update_column :ability_cache, current_cache
+    value
+  end
+
+  def invalidate_ability_cache
+    update_column(:ability_cache, {})
+  end
+
+  def otp_qr_code
+    issuer = I18n.t("application.name")
+    label = "#{issuer}:#{email}"
+    RQRCode::QRCode.new(otp_provisioning_uri(label, issuer: issuer))
+  end
+
+  def scaffolding_absolutely_abstract_creative_concepts_collaborators
+    Scaffolding::AbsolutelyAbstract::CreativeConcepts::Collaborator.joins(:membership).where(membership: {user_id: id})
+  end
+
+  def admin_scaffolding_absolutely_abstract_creative_concepts_ids
+    scaffolding_absolutely_abstract_creative_concepts_collaborators.admins.pluck(:creative_concept_id)
+  end
+
+  def editor_scaffolding_absolutely_abstract_creative_concepts_ids
+    scaffolding_absolutely_abstract_creative_concepts_collaborators.editors.pluck(:creative_concept_id)
+  end
+
+  def viewer_scaffolding_absolutely_abstract_creative_concepts_ids
+    scaffolding_absolutely_abstract_creative_concepts_collaborators.viewers.pluck(:creative_concept_id)
+  end
+
+  def developer?
+    return false unless ENV["DEVELOPER_EMAILS"]
+    # we use email_was so they can't try setting their email to the email of an admin.
+    return false unless email_was
+    ENV["DEVELOPER_EMAILS"].split(",").include?(email_was)
+  end
+
+  def set_teams_time_zone
+    teams.where(time_zone: nil).each do |team|
+      team.update(time_zone: time_zone) if team.users.count == 1
+    end
+  end
+end

data/app/models/invitation.rb

@@ -1,25 +1,5 @@
 class Invitation < ApplicationRecord
-  # 🚫 DEFAULT BULLET TRAIN INVITATION FUNCTIONALITY
-  # Typically you should avoid adding your own functionality in this section to avoid merge conflicts in the future.
-  # (If you specifically want to change Bullet Train's default behavior, that's OK and you can do that here.)
-
-  belongs_to :team
-  belongs_to :from_membership, class_name: "Membership"
-  has_one :membership, dependent: :nullify
-  has_many :roles, through: :membership
-
-  accepts_nested_attributes_for :membership
-
-  validates :email, presence: true
-
-  before_create :generate_uuid
-  after_create :set_added_by_membership
-  after_create :send_invitation_email
-
-  # ✅ YOUR APPLICATION'S INVITATION FUNCTIONALITY
-  # This is the place where you should implement your own features on top of Bullet Train's functionality. There
-  # are a bunch of Super Scaffolding hooks here by default to try and help keep generated code logically organized.
-
+  include Invitations::Core
   # 🚅 add concerns above.
 
   # 🚅 add belongs_to associations above.
@@ -39,35 +19,4 @@ class Invitation < ApplicationRecord
   # 🚅 add delegations above.
 
   # 🚅 add methods above.
-
-  # 🚫 DEFAULT BULLET TRAIN INVITATION FUNCTIONALITY
-  # We put these at the bottom of this file to keep them out of the way. You should define your own methods above here.
-
-  def set_added_by_membership
-    membership.update(added_by: from_membership)
-  end
-
-  def send_invitation_email
-    UserMailer.invited(uuid).deliver_later
-  end
-
-  def generate_uuid
-    self.uuid = SecureRandom.hex
-  end
-
-  def accept_for(user)
-    User.transaction do
-      user.memberships << membership
-      user.update(current_team: team, former_user: false)
-      destroy
-    end
-  end
-
-  def name
-    I18n.t("invitations.values.name", team_name: team.name)
-  end
-
-  def is_for?(user)
-    user.email.downcase.strip == email.downcase.strip
-  end
 end

data/app/models/invitations.rb

@@ -0,0 +1,5 @@
+module Invitations
+  def self.table_name_prefix
+    "users_"
+  end
+end

data/app/models/membership.rb

@@ -1,40 +1,5 @@
 class Membership < ApplicationRecord
-  # 🚫 DEFAULT BULLET TRAIN MEMBERSHIP FUNCTIONALITY
-  # Typically you should avoid adding your own functionality in this section to avoid merge conflicts in the future.
-  # (If you specifically want to change Bullet Train's default behavior, that's OK and you can do that here.)
-
-  # See `docs/permissions.md` for details.
-  include Roles::Support
-
-  belongs_to :user, optional: true
-  belongs_to :team
-  belongs_to :invitation, optional: true, dependent: :destroy
-  belongs_to :added_by, class_name: "Membership", optional: true
-  belongs_to :platform_agent_of, class_name: "Platform::Application", optional: true
-
-  has_many :scaffolding_completely_concrete_tangible_things_assignments, class_name: "Scaffolding::CompletelyConcrete::TangibleThings::Assignment", dependent: :destroy
-  has_many :scaffolding_completely_concrete_tangible_things, through: :scaffolding_completely_concrete_tangible_things_assignments, source: :tangible_thing
-  has_many :reassignments_scaffolding_completely_concrete_tangible_things_reassignments, class_name: "Memberships::Reassignments::ScaffoldingCompletelyConcreteTangibleThingsReassignment", dependent: :destroy, foreign_key: :membership_id
-
-  has_many :scaffolding_absolutely_abstract_creative_concepts_collaborators, class_name: "Scaffolding::AbsolutelyAbstract::CreativeConcepts::Collaborator", dependent: :destroy
-
-  after_destroy do
-    # if we're destroying a user's membership to the team they have set as
-    # current, then we need to remove that so they don't get an error.
-    if user&.current_team == team
-      user.current_team = nil
-      user.save
-    end
-  end
-
-  scope :current_and_invited, -> { includes(:invitation).where("user_id IS NOT NULL OR invitations.id IS NOT NULL").references(:invitation) }
-  scope :current, -> { where("user_id IS NOT NULL") }
-  scope :tombstones, -> { includes(:invitation).where("user_id IS NULL AND invitations.id IS NULL").references(:invitation) }
-
-  # ✅ YOUR APPLICATION'S MEMBERSHIP FUNCTIONALITY
-  # This is the place where you should implement your own features on top of Bullet Train's functionality. There
-  # are a bunch of Super Scaffolding hooks here by default to try and help keep generated code logically organized.
-
+  include Memberships::Core
   # 🚅 add concerns above.
 
   # 🚅 add belongs_to associations above.
@@ -54,111 +19,4 @@ class Membership < ApplicationRecord
   # 🚅 add delegations above.
 
   # 🚅 add methods above.
-
-  # 🚫 DEFAULT BULLET TRAIN TEAM FUNCTIONALITY
-  # We put these at the bottom of this file to keep them out of the way. You should define your own methods above here.
-
-  def name
-    full_name
-  end
-
-  def label_string
-    full_name
-  end
-
-  # we overload this method so that when setting the list of role ids
-  # associated with a membership, admins can never remove the last admin
-  # of a team.
-  def role_ids=(ids)
-    # if this membership was an admin, and the new list of role ids don't include admin.
-    if admin? && !ids.include?(Role.admin.id)
-      unless team.admins.count > 1
-        raise RemovingLastTeamAdminException.new("You can't remove the last team admin.")
-      end
-    end
-
-    super(ids)
-  end
-
-  def unclaimed?
-    user.nil? && !invitation.nil?
-  end
-
-  def tombstone?
-    user.nil? && invitation.nil?
-  end
-
-  def last_admin?
-    return false unless admin?
-    return false unless user.present?
-    team.memberships.current.select(&:admin?) == [self]
-  end
-
-  def nullify_user
-    if last_admin?
-      raise RemovingLastTeamAdminException.new("You can't remove the last team admin.")
-    end
-
-    if (user_was = user)
-      unless user_first_name.present?
-        self.user_first_name = user.first_name
-      end
-
-      unless user_last_name.present?
-        self.user_last_name = user.last_name
-      end
-
-      unless user_profile_photo_id.present?
-        self.user_profile_photo_id = user.profile_photo_id
-      end
-
-      unless user_email.present?
-        self.user_email = user.email
-      end
-
-      self.user = nil
-      save
-
-      user_was.invalidate_ability_cache
-
-      user_was.update(
-        current_team: user_was.teams.first,
-        former_user: user_was.teams.empty?
-      )
-    end
-
-    # we do this here just in case by some weird chance an active membership had an invitation attached.
-    invitation&.destroy
-  end
-
-  def email
-    user&.email || user_email.presence || invitation&.email
-  end
-
-  def full_name
-    user&.full_name || [first_name.presence, last_name.presence].join(" ").presence || email
-  end
-
-  def first_name
-    user&.first_name || user_first_name
-  end
-
-  def last_name
-    user&.last_name || user_last_name
-  end
-
-  def last_initial
-    return nil unless last_name.present?
-    "#{last_name}."
-  end
-
-  def first_name_last_initial
-    [first_name, last_initial].map(&:present?).join(" ")
-  end
-
-  # TODO utilize this.
-  # members shouldn't receive notifications unless they are either an active user or an outstanding invitation.
-  def should_receive_notifications?
-    invitation.present? || user.present?
-  end
 end

data/app/models/memberships.rb

@@ -0,0 +1,5 @@
+module Memberships
+  def self.table_name_prefix
+    "memberships_"
+  end
+end

data/app/models/team.rb

@@ -1,35 +1,6 @@
 class Team < ApplicationRecord
-  # 🚫 DEFAULT BULLET TRAIN TEAM FUNCTIONALITY
-  # Typically you should avoid adding your own functionality in this section to avoid merge conflicts in the future.
-  # (If you specifically want to change Bullet Train's default behavior, that's OK and you can do that here.)
-
-  # Outgoing webhooks.
+  include Teams::Core
   include Webhooks::Outgoing::TeamSupport
-
-  # super scaffolding
-  unless scaffolding_things_disabled?
-    has_many :scaffolding_absolutely_abstract_creative_concepts, class_name: "Scaffolding::AbsolutelyAbstract::CreativeConcept", dependent: :destroy, enable_updates: true
-  end
-
-  # memberships and invitations
-  has_many :memberships, dependent: :destroy
-  has_many :users, through: :memberships
-  has_many :invitations
-
-  # oauth for grape api
-  has_many :platform_applications, class_name: "Platform::Application", dependent: :destroy, foreign_key: :team_id
-
-  # integrations
-  has_many :integrations_stripe_installations, class_name: "Integrations::StripeInstallation", dependent: :destroy if stripe_enabled?
-
-  # validations
-  validates :name, presence: true
-  validates :time_zone, inclusion: {in: ActiveSupport::TimeZone.all.map(&:name)}, allow_nil: true
-
-  # ✅ YOUR APPLICATION'S TEAM FUNCTIONALITY
-  # This is the place where you should implement your own features on top of Bullet Train's functionality. There
-  # are a bunch of Super Scaffolding hooks here by default to try and help keep generated code logically organized.
-
   # 🚅 add concerns above.
 
   # 🚅 add belongs_to associations above.
@@ -49,33 +20,4 @@ class Team < ApplicationRecord
   # 🚅 add delegations above.
 
   # 🚅 add methods above.
-
-  # 🚫 DEFAULT BULLET TRAIN TEAM FUNCTIONALITY
-  # We put these at the bottom of this file to keep them out of the way. You should define your own methods above here.
-
-  def admins
-    memberships.current_and_invited.admins
-  end
-
-  def admin_users
-    admins.map(&:user).compact
-  end
-
-  def primary_contact
-    admin_users.min { |user| user.created_at }
-  end
-
-  def formatted_email_address
-    primary_contact.email
-  end
-
-  def invalidate_caches
-    users.map(&:invalidate_ability_cache)
-  end
-
-  def team
-    # some generic features appeal to the `team` method for security or scoping purposes, but sometimes those same
-    # generic functions need to function for a team model as well, so we do this.
-    self
-  end
 end

data/app/models/teams.rb

@@ -0,0 +1,5 @@
+module Teams
+  def self.table_name_prefix
+    "teams_"
+  end
+end