clavis 0.7.1 → 0.7.2

data/Rakefile

@@ -326,14 +326,62 @@ end
 
 begin
   require "brakeman"
-  desc "Run Brakeman"
-  task brakeman: :environment do
-    Brakeman.run(app_path: ".")
+  desc "Run Brakeman on the test Rails application"
+  task brakeman: :bootstrap_rails_app do
+    # Rails app path is guaranteed to exist because of the bootstrap_rails_app dependency
+    rails_app_path = File.join(File.dirname(__FILE__), "rails-app")
+
+    puts "Running Brakeman on rails-app to check Clavis integration"
+
+    # Use the ignore file to manage confirmed false positives only
+    # Keep this list as small as possible and document any entries
+    result = Brakeman.run(
+      app_path: rails_app_path,
+      ignore_file: ".brakeman.ignore"
+    )
+
+    if result.warnings.any?
+      puts "Brakeman found #{result.warnings.count} potential security issues."
+
+      # Still filter and highlight Clavis-specific warnings for visibility
+      clavis_warnings = result.warnings.select do |warning|
+        warning.file&.include?("clavis") ||
+          warning.message&.include?("clavis") ||
+          warning.code&.include?("clavis")
+      end
+
+      if clavis_warnings.any?
+        puts "#{clavis_warnings.count} warnings specifically related to Clavis code:"
+        clavis_warnings.each_with_index do |warning, index|
+          puts "#{index + 1}. [#{warning.confidence}] #{warning.warning_type} in #{warning.file}:#{warning.line}"
+          puts "   #{warning.message}"
+          puts ""
+        end
+      end
+
+      # Show all warnings in summary form
+      puts "\nAll warnings:"
+      result.warnings.each_with_index do |warning, index|
+        puts "#{index + 1}. [#{warning.confidence}] #{warning.warning_type} in #{warning.file}:#{warning.line}"
+        puts "   #{warning.message}"
+        puts ""
+      end
+
+      # Exit with failure unless warnings are explicitly allowed
+      exit 1 unless ENV["ALLOW_BRAKEMAN_WARNINGS"]
+    else
+      puts "Brakeman scan completed with no warnings."
+    end
   end
 rescue LoadError
   desc "Run Brakeman"
   task brakeman: :environment do
-    abort "Brakeman is not available. Run 'bundle install' first."
+    puts "Brakeman is not available. Please add it to your Gemfile or install it with:"
+    puts "  gem install brakeman"
+    puts ""
+    puts "Note: This task will fail if any security issues are found in the rails-app."
+    puts "To allow warnings and continue anyway, set ALLOW_BRAKEMAN_WARNINGS=1"
+    exit 1
   end
 end
 

data/lib/clavis/version.rb

@@ -2,5 +2,5 @@
 
 module Clavis
   # The current version of Clavis.
-  VERSION = "0.7.1"
+  VERSION = "0.7.2"
 end

data/lib/generators/clavis/install_generator.rb

@@ -103,32 +103,49 @@ module Clavis
       end
 
       def show_post_install_message
-        say "\nClavis has been installed successfully!"
-
-        # Next steps
-        say "\nNext steps:"
-
+        say "\nClavis has been installed successfully! 🔑"
+
+        # What was done section
+        say "\n=== What Was Done ==="
+        say "✅ Generated migration for OAuth identities"
+        say "✅ Added OAuth fields to your User model"
+        say "✅ Created ClavisUserMethods concern for your User model"
+        say "✅ Mounted Clavis engine at '/auth' in routes.rb"
+        say "✅ Generated configuration initializer"
+
+        # Required steps section
+        say "\n=== Required Steps ==="
         steps = []
 
-        if @provide_css_instructions
-          steps << "Include the Clavis styles in your layout:\n   <%= stylesheet_link_tag 'clavis_styles' %>"
-        end
-
-        steps << "Configure your providers in config/initializers/clavis.rb"
-        steps << "Run migrations: rails db:migrate"
-        steps << "⚠️ Customize the user creation code in app/models/concerns/clavis_user_methods.rb"
-        steps << "Add OAuth buttons to your views:\n   <%= clavis_oauth_button :google %>"
+        steps << "Run migrations:\n   $ rails db:migrate"
+        steps << "Configure your providers in config/initializers/clavis.rb:\n   • Add your client_id and client_secret\n   • Set correct redirect_uri values" # rubocop:disable Layout/LineLength
+        steps << "⚠️ IMPORTANT: Customize user creation in app/models/concerns/clavis_user_methods.rb\n   • The default only sets the email field, which is likely insufficient\n   • Add all required fields for your User model" # rubocop:disable Layout/LineLength
 
         # Output numbered steps
         steps.each_with_index do |step, index|
           say "#{index + 1}. #{step}"
         end
 
-        say "\nClavis has configured your User model with OAuth support via the ClavisUserMethods concern."
-        say "IMPORTANT: The default implementation only sets the email field when creating users."
-        say "You MUST customize this to include all required fields for your User model."
+        # Password validation section
+        say "\n=== For Password-Protected Users ==="
+        say "If your User model uses has_secure_password:"
+        say "• Uncomment the password validation section in app/models/concerns/clavis_user_methods.rb"
+        say "• Choose one of the approaches described there"
+
+        # View integration section
+        say "\n=== Using In Your Views ==="
+        say "Add OAuth buttons to your login page:"
+        say "<%= clavis_oauth_button :google %>"
+        say "<%= clavis_oauth_button :github %>"
+
+        # CSS styling section
+        if @provide_css_instructions
+          say "\n=== For CSS Styling ==="
+          say "Include Clavis styles in your layout:"
+          say "<%= stylesheet_link_tag 'clavis_styles' %>"
+        end
 
-        say "\nFor more information, see the documentation at https://github.com/clayton/clavis"
+        say "\nFor more information, see: https://github.com/clayton/clavis"
       end
 
       private

data/lib/generators/clavis/user_method/user_method_generator.rb

@@ -197,22 +197,11 @@ module Clavis
       end
 
       def show_instructions
-        say "\nThe ClavisUserMethods concern has been created and included in your User model."
-        say "This gives your User model the ability to find or create users from OAuth data."
-
-        say "\n⚠️  IMPORTANT: You must customize the user creation code to match your User model!"
-        say "The default implementation only sets the email field, which may not be sufficient."
-
-        say "\n⚠️  IMPORTANT: If your User model uses has_secure_password, you need to handle password validation!"
-        say "Look for the password validation section in app/models/concerns/clavis_user_methods.rb and"
-        say "uncomment one of the approaches described there."
-
-        say "\nTo customize:"
-        say "  1. Edit app/models/concerns/clavis_user_methods.rb"
-        say "  2. Add required fields to the user creation in find_or_create_from_clavis"
-        say "  3. Handle password validation if your model uses has_secure_password"
-
-        say "\nFor more information, see the documentation at https://github.com/clayton/clavis"
+        # The main instructions will be handled by install_generator.rb
+        # This is just a simple confirmation of what was done
+        say "\nClavis user methods have been added to your User model."
+        say "✅ Created app/models/concerns/clavis_user_methods.rb"
+        say "✅ Added 'include ClavisUserMethods' to your User model"
       end
     end
   end