cloudflare-email 0.1.0 → 0.3.0

data/SECURITY.md

@@ -0,0 +1,51 @@
+# Security
+
+The hardening described here is included in 0.2.0. Version 0.1.0 does not include
+these fixes. Upgrade Rails and the bundled Worker together using the
+[upgrade guide](docs/upgrading-0.2.md).
+
+Rails integration is tested on patched Rails 7.2, 8.0, and 8.1; application
+owners must update their own Rails, database adapter, and other dependencies.
+The gem does not add Rails or SQLite as runtime dependencies.
+
+Report sensitive findings privately to the maintainer at cole@dscribeai.com.
+Include affected versions and impact; omit real credentials and private mail.
+Do not place secrets or private message data in public issues.
+
+## Deployment responsibilities
+
+- Keep API and management tokens least-privileged and separate. Store tokens and
+  a strong ingress secret in a secret manager or Rails encrypted credentials.
+  Rotate compromised secrets on Rails and the Worker together. HTTPS endpoint
+  overrides are trusted operator configuration; never derive them from mail.
+- Set request-size limits, timeouts and rate limits at the proxy/server. Rails
+  and the Worker bound MIME reads to 25 MiB by default (`MAX_EMAIL_BYTES`), but
+  cannot prevent upstream buffering or slow clients. Limits apply to raw MIME,
+  not just decoded attachments.
+- Treat mail and attachments as untrusted content. The gem authenticates Worker
+  transport and SMTP envelope metadata, not a human sender's identity. Rendering,
+  sanitization, malware scanning and application authorization belong to the app.
+- Protect raw MIME, attachments, outbox snapshots and event receipts with access
+  control, storage encryption, backups and retention policies. Avoid logging raw
+  responses/errors: provider details and application logs can contain private mail.
+- Restrict queue producers and consumers. Event account/domain checks are
+  validation, not cryptographic signatures. Monitor unacknowledged malformed
+  messages, processing failures and unmatched receipts.
+- Database administrators and direct SQL writes are trusted. ActiveRecord
+  read-only evidence fields do not provide tamper-proof storage. Keep tenant
+  authorization around outbox operations and receipt access in the application.
+- The optional mailbox session scopes tenant and mailbox access, but does not
+  authenticate users. Keep domain registration/activation administrative, verify
+  ownership externally, and use your access resolver to choose tenant keys.
+  Ingress selects a registered tenant only after full signature verification.
+  Raw ActiveRecord access remains privileged, especially in shared-database mode.
+  Private tenant storage, consistent migrations and trusted job payloads are
+  required. Drain old framework jobs before enabling database tenancy; jobs
+  without the new tenant metadata are rejected rather than guessing a tenant.
+- Development tunnels expose the ingress to the internet. Use the bundled task,
+  dedicated development mail routes and test data; stop tunnels when finished.
+  The Host guard restricts routing but is not a sandbox for the development app
+  or a replacement for safe error pages and request logging.
+
+See [the September 11 security review](docs/verification/2026-09-11-security.md)
+for findings, verification, and remaining limits.

data/app/controllers/cloudflare/email/ingress_controller.rb

@@ -1,41 +1,52 @@
-require "cloudflare/email/verification"
+require "cloudflare/email/ingress"
 
 module Cloudflare
   module Email
     # ActionMailbox ingress for Cloudflare Email Worker forwards.
     #
-    # The shipped Worker template signs each forwarded message with HMAC-SHA256
-    # over "{timestamp}.{raw_body}" and sends:
-    #   X-CF-Email-Timestamp: <unix seconds>
-    #   X-CF-Email-Signature: <hex digest>
+    # The default Worker uses v2 authenticated SMTP envelopes; custom Workers
+    # can opt into v3 to authenticate additional provider metadata. Both use
+    # the shared, bounded Ingress verifier before any tenant lookup or storage.
     #
     # Set the shared secret in Rails credentials under cloudflare.ingress_secret
     # (or in the CLOUDFLARE_INGRESS_SECRET env var) and as the Worker secret
     # INGRESS_SECRET via `wrangler secret put INGRESS_SECRET`.
     class IngressController < ActionMailbox::BaseController
+      DEFAULT_MAX_EMAIL_BYTES = 25 * 1024 * 1024
       param_encoding :create, "raw_email", Encoding::ASCII_8BIT
 
       def create
         ActiveSupport::Notifications.instrument(
           "cloudflare_email.ingress",
-          bytes: raw_body.bytesize,
+          bytes: 0,
         ) do |payload|
-          case Cloudflare::Email::Verification.verify(
-                secret:    secret,
-                body:      raw_body,
-                timestamp: request.headers["X-CF-Email-Timestamp"],
-                signature: request.headers["X-CF-Email-Signature"],
-              )
+          request.body.rewind if request.body.respond_to?(:rewind)
+          result = Cloudflare::Email::Ingress.verify(secret: secret,
+            headers: request.headers, body: request.body,
+            content_length: request.content_length, max_email_bytes: max_email_bytes)
+          payload[:bytes] = result.bytes.to_i
+          payload[:result] = result.status
+          case result.status
           when :stale
-            payload[:result] = :stale
             head :request_timeout
           when :bad_signature
-            payload[:result] = :bad_signature
             head :unauthorized
+          when :too_large
+            head :payload_too_large
           when :ok
-            inbound = ActionMailbox::InboundEmail.create_and_extract_message_id!(raw_body)
-            payload[:result]     = :ok
-            payload[:message_id] = inbound.message_id
+            inbound = if defined?(Cloudflare::Email::Mailboxes) && Cloudflare::Email::Mailboxes.enabled?
+              recipient = result.message.envelope.fetch("to")
+              begin
+                Cloudflare::Email::Mailboxes.receive(recipient: recipient) { result.message.persist_action_mailbox! }
+              rescue Cloudflare::Email::Mailboxes::Unavailable
+                payload[:result] = :unavailable_mailbox
+                next head(:unprocessable_entity)
+              end
+            else
+              result.message.persist_action_mailbox!
+            end
+            payload[:result]     = inbound ? :ok : :duplicate
+            payload[:message_id] = inbound&.message_id
             head :ok
           end
         end
@@ -49,10 +60,11 @@ module Cloudflare
         :cloudflare
       end
 
-      def raw_body
-        @raw_body ||= begin
-          request.body.rewind if request.body.respond_to?(:rewind)
-          request.body.read
+      def max_email_bytes
+        @max_email_bytes ||= begin
+          value = Integer(ENV.fetch("MAX_EMAIL_BYTES", DEFAULT_MAX_EMAIL_BYTES.to_s), 10)
+          raise ArgumentError, "MAX_EMAIL_BYTES must be positive" unless value.positive?
+          value
         end
       end
 

data/app/controllers/cloudflare/email/management/mailboxes_controller.rb

@@ -0,0 +1,173 @@
+module Cloudflare
+  module Email
+    module Management
+      class MailboxesController < ActionController::Base
+        layout "layouts/cloudflare/email/management"
+        protect_from_forgery with: :exception
+        self.forgery_protection_origin_check = true
+        around_action :with_host_context
+        helper_method :allowed?, :host_back_path
+
+        class Denied < StandardError; end
+        class InvalidInput < StandardError; end
+
+        rescue_from Denied do
+          head :forbidden
+        end
+        rescue_from "ActiveRecord::RecordNotFound" do
+          head :not_found
+        end
+        rescue_from InvalidInput, "ActiveRecord::RecordInvalid", Cloudflare::Email::Error do
+          redirect_to(@mailbox ? mailbox_path(@mailbox) : root_path,
+            alert: "The changes could not be saved. Check the address, registered domain and required fields.",
+            status: :see_other)
+        end
+        rescue_from Cloudflare::Email::ConfigurationError do
+          head :service_unavailable
+        end
+
+        def index
+          authorize!(:index)
+          @mailboxes = page(scoped_mailboxes)
+          @domains = permitted_domains if allowed?(:create)
+        end
+
+        def show
+          load_mailbox!(:show)
+          @addresses = @session.addresses(@mailbox.id).order(:id).to_a
+          @domains = allowed?(:add_address, @mailbox) ? permitted_domains : []
+          @messages = allowed?(:show_message, @mailbox) ? page(@session.messages(@mailbox.id)) : []
+        end
+
+        def create
+          authorize!(:create)
+          input = params.require(:mailbox)
+          raise InvalidInput unless input.is_a?(ActionController::Parameters)
+          values = input.permit(:name, :address)
+          name = values[:name].to_s.strip
+          raise InvalidInput unless (1..255).cover?(name.length)
+          address = permitted_address!(values[:address])
+          Mailboxes::Mailbox.transaction do
+            @mailbox = @adapter.create_mailbox(@session, name: name, address: address)
+            # A hook cannot turn an arbitrary return value into a readable mailbox.
+            @mailbox = scoped_mailboxes.find(@mailbox.id)
+          end
+          redirect_to mailbox_path(@mailbox), notice: "Mailbox created. Review address setup below.", status: :see_other
+        end
+
+        def add_address
+          load_mailbox!(:add_address)
+          @adapter.add_address(@session, @mailbox, address: permitted_address!(params[:address]))
+          redirect_to mailbox_path(@mailbox), notice: "Address added. Review its setup status.", status: :see_other
+        end
+
+        def suspend
+          load_mailbox!(:suspend)
+          @session.suspend(@mailbox.id)
+          redirect_to mailbox_path(@mailbox), notice: "Mailbox suspended. Messages are retained.", status: :see_other
+        end
+
+        def resume
+          load_mailbox!(:resume)
+          @session.resume(@mailbox.id)
+          redirect_to mailbox_path(@mailbox), notice: "Mailbox resumed. Pending addresses still need setup.", status: :see_other
+        end
+
+        def message
+          load_mailbox!(:show_message)
+          @entry = @session.messages(@mailbox.id).find(params[:message_id])
+          raw = @session.inbound_email(@mailbox.id, @entry.id).mail
+          @subject = raw.subject.to_s
+          @from = Array(raw.from).join(", ")
+          part = raw.text_part || (raw.mime_type == "text/plain" ? raw : nil)
+          @body = part ? part.decoded.to_s.encode("UTF-8", invalid: :replace, undef: :replace).first(100_000) :
+            "This message has no plain-text body. HTML rendering is disabled in this management interface."
+          @attachments = raw.attachments.map { |attachment| attachment.filename.to_s }
+          render :message
+        end
+
+        def mark_read
+          load_mailbox!(:mark_read)
+          @session.mark_read(@mailbox.id, params[:message_id], read: boolean_param(:read))
+          redirect_to mailbox_path(@mailbox), status: :see_other
+        end
+
+        def archive
+          load_mailbox!(:archive)
+          @session.archive(@mailbox.id, params[:message_id], archived: boolean_param(:archived))
+          redirect_to mailbox_path(@mailbox), status: :see_other
+        end
+
+        private
+
+        def with_host_context
+          response.headers["Cache-Control"] = "no-store"
+          response.headers["Referrer-Policy"] = "same-origin"
+          response.headers["X-Content-Type-Options"] = "nosniff"
+          response.headers["Content-Security-Policy"] = "default-src 'none'; style-src 'self'; img-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"
+          factory = Management.configuration.adapter
+          unless factory.respond_to?(:call) && defined?(Mailboxes) && Mailboxes.enabled?
+            return head :service_unavailable
+          end
+          @adapter = factory.call(self)
+          authenticated = @adapter.authenticate!
+          return if performed?
+          return head :unauthorized unless authenticated == true
+          Mailboxes.for_tenant(@adapter.tenant_key) do |session|
+            @session = session
+            yield
+          end
+        end
+
+        def allowed?(action, mailbox = nil)
+          @adapter.allowed?(action, mailbox) == true
+        end
+
+        def authorize!(action, mailbox = nil)
+          raise Denied unless allowed?(action, mailbox)
+        end
+
+        def scoped_mailboxes
+          # Always retain the gem's tenant condition even if a host scope omits it.
+          @session.mailboxes.where(id: @adapter.mailboxes(@session).reselect(:id))
+        end
+
+        def load_mailbox!(action)
+          @mailbox = scoped_mailboxes.find(params[:id])
+          authorize!(action, @mailbox)
+        end
+
+        def permitted_domains
+          granted = Array(@adapter.domains(@session)).map(&:to_s)
+          Mailboxes::ReceivingDomain.active.where(tenant_key: @session.tenant_key, domain: granted).order(:domain).pluck(:domain)
+        end
+
+        def permitted_address!(value)
+          address = Mailboxes.canonical_address(value)
+          raise InvalidInput unless permitted_domains.include?(address.split("@", 2).last)
+          address
+        end
+
+        def page(relation)
+          cursor = params[:after].to_s
+          raise InvalidInput unless cursor.empty? || cursor.match?(/\A[0-9]{1,18}\z/)
+          rows = relation.where("id > ?", cursor.to_i).order(:id).limit(51).to_a
+          @next_cursor = rows.length > 50 ? rows[49].id : nil
+          rows.first(50)
+        end
+
+        def boolean_param(key)
+          value = params[key]
+          raise InvalidInput unless %w[true false].include?(value)
+          value == "true"
+        end
+
+        def host_back_path
+          callback = Management.configuration.back_path
+          value = callback.call(self) if callback.respond_to?(:call)
+          value if value.is_a?(String) && value.start_with?("/") && !value.start_with?("//") && !value.match?(/[\\\r\n]/)
+        end
+      end
+    end
+  end
+end

data/app/controllers/cloudflare/email/management/styles_controller.rb

@@ -0,0 +1,13 @@
+module Cloudflare
+  module Email
+    module Management
+      class StylesController < ActionController::Base
+        def show
+          response.headers["X-Content-Type-Options"] = "nosniff"
+          send_data File.binread(File.expand_path("../../../../../lib/cloudflare/email/management/management.css", __dir__)),
+            type: "text/css; charset=utf-8", disposition: "inline"
+        end
+      end
+    end
+  end
+end

data/app/views/cloudflare/email/management/mailboxes/index.html.erb

@@ -0,0 +1,65 @@
+<div class="page-heading">
+  <div>
+    <p class="eyebrow">Email workspace</p>
+    <h1>Mailboxes</h1>
+    <p class="muted">Manage accepted addresses and the messages delivered to them.</p>
+  </div>
+</div>
+
+<div class="workspace-grid">
+  <section class="panel" aria-labelledby="mailboxes-heading">
+    <div class="panel-heading"><h2 id="mailboxes-heading">Your mailboxes</h2></div>
+    <% if @mailboxes.empty? %>
+      <div class="empty-state">
+        <h3>No mailboxes to show</h3>
+        <p>Create a mailbox to give incoming email a home.</p>
+      </div>
+    <% else %>
+      <ul class="record-list">
+        <% @mailboxes.each do |mailbox| %>
+          <li class="record-row">
+            <div class="record-content">
+              <% if allowed?(:show, mailbox) %>
+                <%= link_to mailbox.name, mailbox_path(mailbox.id), class: "record-title" %>
+              <% else %>
+                <span class="record-title"><%= mailbox.name %></span>
+              <% end %>
+              <p class="muted small">Mailbox #<%= mailbox.id %></p>
+            </div>
+            <span class="badge"><%= mailbox.state.capitalize %></span>
+          </li>
+        <% end %>
+      </ul>
+    <% end %>
+    <% if @next_cursor.present? %>
+      <nav class="pagination" aria-label="Mailbox pages">
+        <%= link_to "Next mailboxes →", root_path(after: @next_cursor), class: "button button-secondary" %>
+      </nav>
+    <% end %>
+  </section>
+
+  <% if allowed?(:create) %>
+    <section class="panel" aria-labelledby="create-heading">
+      <div class="panel-heading"><h2 id="create-heading">Create a mailbox</h2></div>
+      <div class="panel-body">
+        <% if @domains.empty? %>
+          <p class="muted">An administrator needs to register an active receiving domain before you can create a mailbox.</p>
+        <% else %>
+          <%= form_with url: mailboxes_path, scope: :mailbox, local: true, class: "stack" do |form| %>
+            <div class="field">
+              <%= form.label :name, "Mailbox name" %>
+              <%= form.text_field :name, required: true, maxlength: 255, placeholder: "Customer support" %>
+            </div>
+            <div class="field">
+              <%= form.label :address, "Email address" %>
+              <%= form.email_field :address, required: true, maxlength: 254, placeholder: "support@#{@domains.first}", aria: { describedby: "create-domains" } %>
+              <p id="create-domains" class="field-help">Available domains: <%= @domains.join(", ") %></p>
+            </div>
+            <p class="field-help">New addresses start pending. Your administrator must confirm their routing before they can receive mail.</p>
+            <%= form.submit "Create mailbox", class: "button" %>
+          <% end %>
+        <% end %>
+      </div>
+    </section>
+  <% end %>
+</div>

data/app/views/cloudflare/email/management/mailboxes/message.html.erb

@@ -0,0 +1,34 @@
+<nav class="breadcrumbs" aria-label="Breadcrumb">
+  <%= link_to "Mailboxes", root_path %> <span aria-hidden="true">/</span>
+  <%= link_to @mailbox.name, mailbox_path(@mailbox.id) %> <span aria-hidden="true">/</span>
+  <span>Message</span>
+</nav>
+<div class="page-heading">
+  <div><p class="eyebrow">Received message</p><h1><%= @subject.presence || "(No subject)" %></h1></div>
+  <div class="actions">
+    <% if allowed?(:mark_read, @mailbox) %>
+      <%= button_to(@entry.read_at ? "Mark unread" : "Mark read", mark_read_mailbox_path(@mailbox.id), method: :post, params: { message_id: @entry.id, read: @entry.read_at ? "false" : "true" }, class: "button button-secondary") %>
+    <% end %>
+    <% if allowed?(:archive, @mailbox) %>
+      <%= button_to(@entry.archived_at ? "Unarchive" : "Archive", archive_mailbox_path(@mailbox.id), method: :post, params: { message_id: @entry.id, archived: @entry.archived_at ? "false" : "true" }, class: "button button-secondary") %>
+    <% end %>
+  </div>
+</div>
+<article class="panel" aria-label="Email message">
+  <div class="panel-body">
+    <dl class="message-metadata">
+      <dt>From</dt><dd><%= @from.presence || "(Unknown sender)" %></dd>
+      <dt>To</dt><dd><%= @entry.recipient %></dd>
+      <dt>Received</dt><dd><time datetime="<%= @entry.created_at.iso8601 %>"><%= @entry.created_at.utc.strftime("%b %-d, %Y · %H:%M UTC") %></time></dd>
+      <dt>Status</dt><dd><%= @entry.read_at ? "Read" : "Unread" %><%= " · Archived" if @entry.archived_at %></dd>
+    </dl>
+  </div>
+  <div class="message-body"><pre><%= @body.presence || "No text content is available for this message." %></pre></div>
+  <% if @attachments.any? %>
+    <section class="panel-body attachments" aria-labelledby="attachments-heading">
+      <h2 id="attachments-heading">Attachments</h2>
+      <p class="field-help">File names are shown for reference. Downloads are not available in this dashboard.</p>
+      <ul><% @attachments.each do |filename| %><li><%= filename.presence || "Unnamed attachment" %></li><% end %></ul>
+    </section>
+  <% end %>
+</article>

data/app/views/cloudflare/email/management/mailboxes/show.html.erb

@@ -0,0 +1,86 @@
+<nav class="breadcrumbs" aria-label="Breadcrumb"><%= link_to "Mailboxes", root_path %> <span aria-hidden="true">/</span> <span><%= @mailbox.name %></span></nav>
+<div class="page-heading">
+  <div>
+    <p class="eyebrow">Mailbox</p>
+    <h1><%= @mailbox.name %></h1>
+    <p class="muted"><%= @mailbox.state == "suspended" ? "Receiving is paused for every address in this mailbox." : "Addresses receive mail when both their address and domain are active." %></p>
+  </div>
+  <div class="actions">
+    <span class="badge"><%= @mailbox.state.capitalize %></span>
+    <% if @mailbox.state == "active" && allowed?(:suspend, @mailbox) %>
+      <%= button_to "Suspend mailbox", suspend_mailbox_path(@mailbox.id), method: :post, class: "button button-secondary" %>
+    <% elsif @mailbox.state == "suspended" && allowed?(:resume, @mailbox) %>
+      <%= button_to "Resume mailbox", resume_mailbox_path(@mailbox.id), method: :post, class: "button" %>
+    <% end %>
+  </div>
+</div>
+
+<div class="workspace-grid">
+  <section class="panel" aria-labelledby="messages-heading">
+    <div class="panel-heading"><h2 id="messages-heading">Received messages</h2><p class="muted small">Includes archived messages</p></div>
+    <% if @messages.empty? %>
+      <div class="empty-state"><h3>No messages to show</h3><p>Messages appear here after delivery to an active address.</p></div>
+    <% else %>
+      <ul class="record-list">
+        <% @messages.each do |entry| %>
+          <li class="record-row">
+            <div class="record-content">
+              <% if allowed?(:show_message, @mailbox) %>
+                <%= link_to "Message to #{entry.recipient}", message_mailbox_path(@mailbox.id, message_id: entry.id), class: "record-title" %>
+              <% else %>
+                <span class="record-title">Message to <%= entry.recipient %></span>
+              <% end %>
+              <p class="muted small"><time datetime="<%= entry.created_at.iso8601 %>"><%= entry.created_at.utc.strftime("%b %-d, %Y · %H:%M UTC") %></time></p>
+            </div>
+            <div class="status-list">
+              <span class="badge"><%= entry.read_at ? "Read" : "Unread" %></span>
+              <% if entry.archived_at %><span class="badge">Archived</span><% end %>
+            </div>
+          </li>
+        <% end %>
+      </ul>
+    <% end %>
+    <% if @next_cursor.present? %>
+      <nav class="pagination" aria-label="Message pages"><%= link_to "Next messages →", mailbox_path(@mailbox.id, after: @next_cursor), class: "button button-secondary" %></nav>
+    <% end %>
+  </section>
+
+  <div class="stack">
+    <section class="panel" aria-labelledby="addresses-heading">
+      <div class="panel-heading"><h2 id="addresses-heading">Addresses</h2></div>
+      <ul class="record-list">
+        <% @addresses.each do |address| %>
+          <% receiving = @mailbox.state == "active" && address.state == "active" && address.receiving_domain&.state == "active" %>
+          <li class="record-row address-row">
+            <span class="record-title"><%= address.address %></span>
+            <% if address.has_attribute?(:catch_all) && address[:catch_all] %>
+              <span class="badge">Domain catch-all configured</span>
+            <% end %>
+            <span class="badge"><%= receiving ? "Accepting mail" : address.state == "pending" ? "Pending setup" : "Receiving paused" %></span>
+          </li>
+        <% end %>
+      </ul>
+      <div class="panel-body"><p class="field-help">Pending addresses need routing confirmation from your administrator. Resuming a mailbox preserves each address’s existing setup state.</p></div>
+    </section>
+
+    <% if allowed?(:add_address, @mailbox) %>
+      <section class="panel" aria-labelledby="alias-heading">
+        <div class="panel-heading"><h2 id="alias-heading">Add an alias</h2></div>
+        <div class="panel-body">
+          <% if @domains.empty? %>
+            <p class="muted">No active receiving domains are available. Contact your administrator.</p>
+          <% else %>
+            <%= form_with url: aliases_mailbox_path(@mailbox.id), local: true, class: "stack" do |form| %>
+              <div class="field">
+                <%= form.label :address, "Alias email address" %>
+                <%= form.email_field :address, required: true, maxlength: 254, aria: { describedby: "alias-domains" } %>
+                <p id="alias-domains" class="field-help">Available domains: <%= @domains.join(", ") %>. Messages to this alias will appear in this mailbox.</p>
+              </div>
+              <%= form.submit "Add alias", class: "button" %>
+            <% end %>
+          <% end %>
+        </div>
+      </section>
+    <% end %>
+  </div>
+</div>

data/app/views/layouts/cloudflare/email/management.html.erb

@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Mailbox management</title>
+    <%= csrf_meta_tags %>
+    <%= stylesheet_link_tag style_path %>
+  </head>
+  <body>
+    <a class="skip-link" href="#main">Skip to content</a>
+    <header class="site-header">
+      <div class="shell header-content">
+        <%= link_to "Mailbox management", root_path, class: "brand" %>
+        <span class="header-caption">Cloudflare Email</span>
+        <% if host_back_path %><%= link_to "Back to app", host_back_path %><% end %>
+      </div>
+    </header>
+    <main id="main" class="shell" tabindex="-1">
+      <% if flash[:notice].present? %>
+        <div class="notice" role="status"><%= flash[:notice] %></div>
+      <% end %>
+      <% if flash[:alert].present? %>
+        <div class="notice notice-error" role="alert"><%= flash[:alert] %></div>
+      <% end %>
+      <%= yield %>
+    </main>
+  </body>
+</html>