console_think_twice 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: dccea38c9288544ae02eea01191a0ed7187ed9187f85e90fdfd37387ca656aa6
+  data.tar.gz: 8bfd0ed5ca4daa26412dba1a43bbf9f2cb3090d49fc83aa9a99454771d20598b
+SHA512:
+  metadata.gz: 869e288cb34127645618c7d0326ae421c1836f44c95f12295dbd057be52e178868397200559b544c4cca06fe02ba4dbf3ede34b90690d400585982d9cf172127
+  data.tar.gz: effa7750ad3ba639698a3e37a8ecd4c789a2f3ce2abbe74bfc093150d91cbe6d23bafb37424938a3239720198d14a79611509b20b8d94428ed73fb35389dbd7e

data/CHANGELOG.md

@@ -0,0 +1,21 @@
+# Changelog
+
+## [Unreleased]
+
+## [0.1.0]
+
+Initial release.
+
+- Confirmation prompts for `destroy`, `destroy!` and `delete` on a record, and for
+  `destroy_all` and `delete_all` on a relation or `has_many` collection.
+- `force: true` on any guarded call skips the prompt.
+- A railtie arms the guard from the Rails `console` hook, leaving web requests, jobs and
+  `rails runner` untouched.
+- Nested prompts are suppressed for the duration of a confirmed call, so a
+  `dependent: :destroy` cascade asks once rather than once per record.
+- A declined call raises `ConsoleThinkTwice::Aborted`, stopping a loop on the first refusal.
+- Non-interactive input refuses rather than assuming yes.
+- Configurable via `ConsoleThinkTwice.configure`, or turned off with `CONSOLE_THINK_TWICE=0`.
+
+[Unreleased]: https://github.com/agomezcampero/console-think-twice/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/agomezcampero/console-think-twice/releases/tag/v0.1.0

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Agustin Gomez
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,102 @@
+# console_think_twice
+
+[![CI](https://github.com/agomezcampero/console-think-twice/actions/workflows/ci.yml/badge.svg)](https://github.com/agomezcampero/console-think-twice/actions/workflows/ci.yml)
+
+Confirm before you destroy. `console_think_twice` intercepts destructive Active Record
+calls made from a console and asks first, so a stray `User.destroy_all` in production
+costs you a keystroke instead of a database.
+
+```
+>> User.first.destroy!
+
+This will permanently destroy User #1 in production.
+Cascades to: sessions, comments
+Confirm? (y/N) n
+ConsoleThinkTwice::Aborted: Aborted. Nothing was destroyed.
+
+>> User.destroy_all
+
+This will permanently destroy 200 Users in production.
+Cascades to: sessions, comments
+Confirm? (y/N) y
+=> [#<User id: 1, ...>, ...]
+
+>> User.first.destroy!(force: true)
+=> #<User id: 2, ...>
+```
+
+## Installation
+
+```ruby
+gem "console_think_twice"
+```
+
+Not on RubyGems yet — until it is, point at the repository:
+
+```ruby
+gem "console_think_twice", github: "agomezcampero/console-think-twice"
+```
+
+In a Rails app that is all — a railtie installs the guard from the `console` hook, which
+runs for `rails console` only. Web requests, background jobs and `rails runner` are
+untouched, and the gem never patches anything until a console actually boots.
+
+Outside Rails, call `ConsoleThinkTwice.install!` once your models are loaded.
+
+## What is guarded
+
+| Call | Prompt |
+| --- | --- |
+| `record.destroy`, `record.destroy!` | `This will permanently destroy User #1.` |
+| `record.delete` | `This will permanently delete, skipping callbacks, User #1.` |
+| `Model.destroy_all`, `relation.destroy_all`, `company.users.destroy_all` | `This will permanently destroy 200 Users.` |
+| `Model.delete_all`, `relation.delete_all` | `This will permanently delete, skipping callbacks, 200 Users.` |
+
+`Model.destroy(id)`, `destroy_by` and `delete_by` route through those methods, so they are
+covered too.
+
+Anything other than `y`/`yes` raises `ConsoleThinkTwice::Aborted`, which also stops a
+loop like `users.each(&:destroy!)` on the first refusal rather than asking 200 times.
+
+Every guarded method takes `force: true` to skip the prompt.
+
+### One prompt per call
+
+A `dependent: :destroy` cascade destroys child records, and `destroy_all` destroys its
+records one at a time — both would otherwise prompt again for every record. Nested prompts
+are suppressed for the duration of a confirmed call, so you are asked exactly once.
+
+### Nobody to ask
+
+When the input stream is not a terminal — piped input, a script fed to `rails console` —
+there is no one to answer, so the guard refuses the call instead of assuming yes. Pass
+`force: true` for destructive calls that are meant to run unattended.
+
+## Configuration
+
+```ruby
+ConsoleThinkTwice.configure do |config|
+  config.enabled = Rails.env.production?      # default: true, unless CONSOLE_THINK_TWICE is 0/false/no/off
+  config.label = "production (europe)"        # shown in the prompt; defaults to Rails.env
+  config.affirmative_answers = %w[y yes si]   # default: %w[y yes]
+  config.interactive = true                   # default: auto-detected from config.input.tty?
+  config.input = $stdin
+  config.output = $stdout
+end
+```
+
+Set `CONSOLE_THINK_TWICE=0` in the environment to turn the guard off without touching
+code. `ConsoleThinkTwice.disable!` turns it off for the rest of the current session.
+
+## Development
+
+```bash
+bundle install
+bundle exec rake        # specs and linter
+bundle exec rspec
+bundle exec standardrb
+```
+
+## License
+
+MIT. See [LICENSE](LICENSE).

data/lib/console_think_twice/configuration.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module ConsoleThinkTwice
+  class Configuration
+    DISABLING_ENV_VALUES = %w[0 false no off].freeze
+
+    attr_writer :enabled, :input, :interactive, :label, :output
+
+    # Answers accepted as a confirmation; anything else aborts.
+    attr_accessor :affirmative_answers
+
+    def initialize
+      @affirmative_answers = %w[y yes]
+    end
+
+    def input
+      @input || $stdin
+    end
+
+    def output
+      @output || $stdout
+    end
+
+    def enabled?
+      return @enabled unless @enabled.nil?
+
+      !DISABLING_ENV_VALUES.include?(ENV["CONSOLE_THINK_TWICE"].to_s.strip.downcase)
+    end
+
+    # Whether there is a human on the other end who can answer the prompt. Auto-detected from
+    # the input stream unless set, so piped input aborts instead of destroying unattended.
+    def interactive?
+      return @interactive unless @interactive.nil?
+
+      input.respond_to?(:tty?) && input.tty?
+    end
+
+    # Shown in the prompt to make the stakes obvious, e.g. "in production".
+    def label
+      return @label unless @label.nil?
+
+      ::Rails.env.to_s if defined?(::Rails) && ::Rails.respond_to?(:env)
+    end
+  end
+end

data/lib/console_think_twice/railtie.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require "rails/railtie"
+
+module ConsoleThinkTwice
+  class Railtie < ::Rails::Railtie
+    console { ConsoleThinkTwice.install! }
+  end
+end

data/lib/console_think_twice/record_guard.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module ConsoleThinkTwice
+  module RecordGuard
+    def destroy(force: false)
+      ConsoleThinkTwice.guard(self, action: :destroy, force: force) { super() }
+    end
+
+    def destroy!(force: false)
+      ConsoleThinkTwice.guard(self, action: :destroy, force: force) { super() }
+    end
+
+    def delete(force: false)
+      ConsoleThinkTwice.guard(self, action: :delete, force: force) { super() }
+    end
+  end
+end

data/lib/console_think_twice/relation_guard.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module ConsoleThinkTwice
+  module RelationGuard
+    def destroy_all(force: false)
+      ConsoleThinkTwice.guard(self, action: :destroy, force: force) { super() }
+    end
+
+    # CollectionProxy#delete_all takes an optional dependency strategy; Relation#delete_all takes none.
+    def delete_all(*args, force: false)
+      ConsoleThinkTwice.guard(self, action: :delete, force: force) { super(*args) }
+    end
+  end
+end

data/lib/console_think_twice/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module ConsoleThinkTwice
+  VERSION = "0.1.0"
+end

data/lib/console_think_twice.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+require "active_record"
+require "active_support/core_ext/string/inflections"
+
+require_relative "console_think_twice/version"
+require_relative "console_think_twice/configuration"
+require_relative "console_think_twice/record_guard"
+require_relative "console_think_twice/relation_guard"
+
+# Confirmation prompts for destructive Active Record calls typed into a console.
+#
+#   >> User.first.destroy!
+#   This will permanently destroy User #1 in production.
+#   Cascades to: sessions, company_memberships, comments, api_keys
+#   Confirm? (y/N)
+#
+# Every guarded call takes `force: true` to skip the prompt. In a Rails app the railtie
+# installs this on console boot only, so the web app, jobs and `rails runner` are untouched.
+module ConsoleThinkTwice
+  # Raised when a destructive call is declined, or when there is nobody to ask.
+  Aborted = Class.new(StandardError)
+
+  CASCADING_STRATEGIES = %i[destroy destroy_async delete_all].freeze
+  SUPPRESSION_KEY = :console_think_twice_suppressed
+
+  class << self
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    def configure
+      yield configuration
+    end
+
+    def install!
+      return false unless configuration.enabled?
+
+      unless @installed
+        ActiveRecord::Base.prepend(RecordGuard)
+        ActiveRecord::Relation.prepend(RelationGuard)
+        ActiveRecord::Associations::CollectionProxy.prepend(RelationGuard)
+        @installed = true
+      end
+
+      @active = true
+      announce
+      true
+    end
+
+    def disable!
+      @active = false
+    end
+
+    def active?
+      !!@active
+    end
+
+    # Confirms the call, then runs it with nested prompts suppressed so that a `dependent:`
+    # cascade, or a relation destroying its records one by one, only ever asks once.
+    def guard(target, action:, force:)
+      return yield if !active? || suppressed?
+
+      count = affected_count(target)
+      return yield if count.zero?
+
+      confirm!(target, action, count) unless force
+      suppressed { yield }
+    end
+
+    private
+
+    def confirm!(target, action, count)
+      summary = summarize(target, action, count)
+      unless configuration.interactive?
+        raise Aborted, "#{summary} No terminal to confirm on — pass `force: true` to proceed."
+      end
+
+      output = configuration.output
+      output.puts
+      output.puts highlight(summary)
+      cascades = cascading_associations(model_of(target))
+      output.puts "Cascades to: #{cascades.join(", ")}" if cascades.any?
+      output.print "Confirm? (y/N) "
+      output.flush
+
+      answer = configuration.input.gets.to_s.strip.downcase
+      return if configuration.affirmative_answers.include?(answer)
+
+      raise Aborted, "Aborted. Nothing was #{(action == :delete) ? "deleted" : "destroyed"}."
+    end
+
+    def summarize(target, action, count)
+      verb = (action == :delete) ? "permanently delete, skipping callbacks," : "permanently destroy"
+
+      subject = if target.is_a?(ActiveRecord::Base)
+        "#{target.class.name} ##{target.id}"
+      else
+        model = model_of(target).name
+        "#{count} #{(count == 1) ? model : model.pluralize}"
+      end
+
+      ["This will #{verb} #{subject}", configuration.label && " in #{configuration.label}", "."].compact.join
+    end
+
+    def affected_count(target)
+      return target.persisted? ? 1 : 0 if target.is_a?(ActiveRecord::Base)
+
+      target.size
+    end
+
+    def model_of(target)
+      target.is_a?(ActiveRecord::Base) ? target.class : target.klass
+    end
+
+    def cascading_associations(model)
+      model.reflect_on_all_associations
+        .select { |reflection| CASCADING_STRATEGIES.include?(reflection.options[:dependent]) }
+        .map(&:name)
+    end
+
+    def suppressed?
+      Thread.current[SUPPRESSION_KEY]
+    end
+
+    def suppressed
+      previous = Thread.current[SUPPRESSION_KEY]
+      Thread.current[SUPPRESSION_KEY] = true
+      yield
+    ensure
+      Thread.current[SUPPRESSION_KEY] = previous
+    end
+
+    def announce
+      return unless configuration.interactive?
+
+      configuration.output.puts highlight(
+        "Think twice: destroy and delete calls ask for confirmation. Pass `force: true` to skip."
+      )
+    end
+
+    def highlight(text)
+      output = configuration.output
+      (output.respond_to?(:tty?) && output.tty?) ? "\e[1;31m#{text}\e[0m" : text
+    end
+  end
+end
+
+require_relative "console_think_twice/railtie" if defined?(::Rails)

metadata

@@ -0,0 +1,86 @@
+--- !ruby/object:Gem::Specification
+name: console_think_twice
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Agustin Gomez
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-08-26 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: activerecord
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+description: 'Prompts before destroy, destroy!, delete, destroy_all and delete_all
+  when they are called from a Rails console, so a stray User.destroy_all cannot wipe
+  production. Pass force: true to skip the prompt.'
+email:
+- agustin@gomezcampero.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- lib/console_think_twice.rb
+- lib/console_think_twice/configuration.rb
+- lib/console_think_twice/railtie.rb
+- lib/console_think_twice/record_guard.rb
+- lib/console_think_twice/relation_guard.rb
+- lib/console_think_twice/version.rb
+homepage: https://github.com/agomezcampero/console-think-twice
+licenses:
+- MIT
+metadata:
+  allowed_push_host: https://rubygems.org
+  source_code_uri: https://github.com/agomezcampero/console-think-twice
+  changelog_uri: https://github.com/agomezcampero/console-think-twice/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.23
+signing_key:
+specification_version: 4
+summary: Ask for confirmation before destructive Active Record calls in a console.
+test_files: []