dscf-core 0.3.7 → 0.3.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 140fe172991cc8a918430e1dfe062b715d930c0a6914820d16eec4bc4c7a9a9f
-  data.tar.gz: b6bd385bde47d38da59639170d16843c6000db6fc59410a086eb885c7b5e11b1
+  metadata.gz: c7a5e4e4e0fa072a549085c2e512fb502b59d3b7547d9265bbc5e969ff3b5225
+  data.tar.gz: 246be4bbcbb6660743154695649c2320998b85c890814d5629cc78899a3b3e30
 SHA512:
-  metadata.gz: f2f6606363b0d92186f267d703e29cc608f08f9be092500d94435e83b9ca2b44cc129d8898ceab3cea2933323b8c5a534542d1c75ecbab55ccf16ae3a34dd05e
-  data.tar.gz: e26442c83f27198db1e1eb2967838ef518e799d1926e76bb286030da06215e68fde220bd3d3f841bf38be2705a4061639be3b7e1b9faaf88ff8f29c56cbd3fc2
+  metadata.gz: c60bf6536fecbfff1826fa883c26abf8d5535d5e9ad8a8df96e2aaad29158b9f4d219737932398bfb23e6ec71c02fe511a9b4ffa981d2a4ef4c171da47e42af5
+  data.tar.gz: 45400ff88afccceafcf353327a53c787d1a7bb5ddeee7ab101f63e9f48cc6ce573b00a6232dedfca7b0860508c710cd4facbf18397eb842b9238c1f59b7f5695

data/app/controllers/concerns/dscf/core/authorizable.rb

@@ -13,6 +13,9 @@ module Dscf
       end
 
       def authorize_action!
+        # Only perform automatic before_action authorization for standard REST actions
+        return skip_authorization unless %w[index show create update destroy].include?(action_name)
+
         policy_target = resolve_policy_target
         return skip_authorization unless policy_target
 

data/app/controllers/concerns/dscf/core/common.rb

@@ -10,10 +10,12 @@ module Dscf
       included do
         before_action :set_clazz
         before_action :set_object, only: %i[show update]
+        skip_before_action :authorize_action!, raise: false
+        before_action :authorize_action!
       end
 
       def index
-        authorize @clazz.new, :index?
+        authorize @clazz.new, "#{action_name}?"
 
         data = nil
         options = {}

data/app/controllers/dscf/core/auth_controller.rb

@@ -154,13 +154,32 @@ module Dscf
       def create_retailer_from_signup!(user)
         return unless defined?(Dscf::Marketplace::Retailer)
 
-        Dscf::Marketplace::Retailer.create!(
+        retailer = Dscf::Marketplace::Retailer.create!(
           name: retailer_signup_params[:name],
           phone: retailer_signup_params[:phone],
           tin_number: retailer_signup_params[:tin_number],
           location: retailer_signup_params[:location],
           user: user
         )
+
+        if retailer.location.present? && defined?(Dscf::Core::Address)
+          lat_str, lng_str = retailer.location.split(",")
+          lat = lat_str.to_f
+          lng = lng_str.to_f
+
+          if lat != 0.0 && lng != 0.0
+            Dscf::Core::Address.create!(
+              user: user,
+              address_type: :shipping,
+              country: "Ethiopia",
+              city: "Addis Ababa",
+              latitude: lat,
+              longitude: lng
+            )
+          end
+        end
+      rescue => e
+        logger.warn "Failed to auto-create address from retailer onboarding location: #{e.message}"
       end
 
       def agent_signup_params

data/app/controllers/dscf/core/documents_controller.rb

@@ -0,0 +1,42 @@
+module Dscf
+  module Core
+    class DocumentsController < ApplicationController
+      include Common
+
+      def index
+        super do
+          business = Business.find(params[:business_id])
+          business.documents
+        end
+      end
+
+      def create
+        super do
+          business = Business.find(params[:business_id])
+          doc = business.documents.new(document_type: :business_license)
+          if params[:document] && params[:document][:file].present?
+            doc.files.attach(params[:document][:file])
+          end
+          doc
+        end
+      end
+
+      private
+
+      def model_params
+        params.require(:document).permit(:document_type, :file)
+      end
+
+      def eager_loaded_associations
+        [:files_attachments]
+      end
+
+      def set_object
+        business = Business.find(params[:business_id])
+        @obj = business.documents.find(params[:id])
+      rescue ActiveRecord::RecordNotFound
+        render_error("Document not found", status: :not_found)
+      end
+    end
+  end
+end

data/app/policies/dscf/core/address_policy.rb

@@ -0,0 +1,25 @@
+module Dscf
+  module Core
+    class AddressPolicy < ApplicationPolicy
+      def index?
+        user.present?
+      end
+
+      def show?
+        user.present? && (record.user_id == user.id || record.user_id.nil?)
+      end
+
+      def create?
+        user.present?
+      end
+
+      def update?
+        user.present? && (record.user_id == user.id || record.user_id.nil?)
+      end
+
+      def destroy?
+        user.present? && (record.user_id == user.id || record.user_id.nil?)
+      end
+    end
+  end
+end

data/app/policies/dscf/core/business_policy.rb

@@ -22,7 +22,7 @@ module Dscf
       end
 
       def my_business?
-        user.has_permission?("businesses.index")
+        user.present?
       end
     end
   end

data/app/policies/dscf/core/document_policy.rb

@@ -0,0 +1,25 @@
+module Dscf
+  module Core
+    class DocumentPolicy < ApplicationPolicy
+      def index?
+        user.present?
+      end
+
+      def show?
+        user.present? && (record.documentable.respond_to?(:user_id) ? record.documentable.user_id == user.id : true)
+      end
+
+      def create?
+        user.present?
+      end
+
+      def update?
+        user.present? && (record.documentable.respond_to?(:user_id) ? record.documentable.user_id == user.id : true)
+      end
+
+      def destroy?
+        user.present? && (record.documentable.respond_to?(:user_id) ? record.documentable.user_id == user.id : true)
+      end
+    end
+  end
+end

data/app/serializers/dscf/core/document_serializer.rb

@@ -1,7 +1,7 @@
 module Dscf
   module Core
     class DocumentSerializer < ActiveModel::Serializer
-      attributes :id, :document_type, :file_urls, :is_verified, :verified_at, :created_at, :updated_at
+      attributes :id, :document_type, :file_urls, :is_verified, :verified_at, :created_at, :updated_at, :name, :url
 
       belongs_to :documentable, polymorphic: true
       belongs_to :verified_by, polymorphic: true, optional: true
@@ -9,6 +9,14 @@ module Dscf
       def file_urls
         object.file_urls
       end
+
+      def name
+        object.files.attached? ? object.files.first.filename.to_s : object.document_type.to_s.titleize
+      end
+
+      def url
+        object.file_urls.first
+      end
     end
   end
 end

data/app/services/dscf/core/file_storage/client.rb

@@ -1,79 +1,106 @@
 # frozen_string_literal: true
 
+require "aws-sdk-s3"
+require "securerandom"
+
 module Dscf
   module Core
     module FileStorage
-      # Low-level HTTP client for MinIO service
-      # This is an internal class - other engines should NOT use this directly
+      # Low-level S3 client for object storage (Garage / MinIO / any S3-compatible service).
+      # This is an internal class - other engines should NOT use this directly; go through
+      # FileStorage, Uploader, or the Attachable concern instead.
+      #
+      # Configuration is read from the environment:
+      #   S3_ENDPOINT_URL       - e.g. http://garage:3900 (required)
+      #   S3_BUCKET             - bucket name (required)
+      #   S3_ACCESS_KEY_ID      - access key (required)
+      #   S3_SECRET_ACCESS_KEY  - secret key (required)
+      #   S3_REGION             - region (optional, defaults to "garage")
+      #
+      # File keys are flat UUIDs (no "/") so they stay valid for the
+      # `files/:file_key` route constraint (`/[^\/]+/`).
       class Client
-        include HTTParty
-
         class UploadError < StandardError; end
         class DownloadError < StandardError; end
         class ConfigurationError < StandardError; end
 
+        DEFAULT_REGION = "garage"
+        DEFAULT_CONTENT_TYPE = "application/octet-stream"
+
+        # @param app_name [String, nil] retained for backwards compatibility (unused)
+        # @param record_class [Class, nil] retained for backwards compatibility (unused)
         def initialize(app_name: nil, record_class: nil)
-          @base_uri = ENV.fetch("MINIO_SERVICE_URL", "http://localhost:3001")
-          @record_class = record_class
-          @api_key = resolve_api_key(app_name)
+          @endpoint = ENV["S3_ENDPOINT_URL"].presence
+          @bucket = ENV["S3_BUCKET"].presence
+          @access_key_id = ENV["S3_ACCESS_KEY_ID"].presence
+          @secret_access_key = ENV["S3_SECRET_ACCESS_KEY"].presence
+          @region = ENV.fetch("S3_REGION", DEFAULT_REGION)
           validate_configuration!
         end
 
-        # Upload a file to MinIO
-        # @param file [ActionDispatch::Http::UploadedFile, File, IO] the file to upload
+        # Upload a file to object storage.
+        # @param file [ActionDispatch::Http::UploadedFile, File, Hash] the file to upload
         # @param filename [String] optional custom filename
         # @return [Hash] { file_key:, filename:, size:, content_type: }
         def upload(file, filename: nil)
           prepared = prepare_file(file, filename)
-
-          response = self.class.post(
-            "#{@base_uri}/upload",
-            headers: auth_headers,
-            body: {file: prepared[:io]},
-            multipart: true,
-            timeout: 60
+          file_key = generate_file_key(prepared[:filename])
+          io = prepared[:io]
+          io.rewind if io.respond_to?(:rewind)
+
+          s3.put_object(
+            bucket: @bucket,
+            key: file_key,
+            body: io,
+            content_type: prepared[:content_type] || DEFAULT_CONTENT_TYPE,
+            metadata: {"filename" => prepared[:filename].to_s}
           )
 
-          handle_upload_response(response, prepared)
+          {
+            file_key: file_key,
+            filename: prepared[:filename],
+            size: prepared[:size],
+            content_type: prepared[:content_type]
+          }
+        rescue Aws::Errors::ServiceError => e
+          raise UploadError, "Upload failed: #{e.message}"
         end
 
-        # Download a file from MinIO
-        # @param file_key [String] the file key/name in MinIO
+        # Download a file from object storage.
+        # @param file_key [String] the object key
         # @return [Hash] { data:, filename:, content_type: }
         def download(file_key)
-          response = self.class.get(
-            "#{@base_uri}/download/#{URI.encode_www_form_component(file_key)}",
-            headers: auth_headers,
-            timeout: 60
-          )
+          response = s3.get_object(bucket: @bucket, key: file_key)
 
-          handle_download_response(response, file_key)
+          {
+            data: response.body.read,
+            filename: response.metadata["filename"].presence || file_key,
+            content_type: response.content_type.presence || DEFAULT_CONTENT_TYPE
+          }
+        rescue Aws::S3::Errors::NoSuchKey => e
+          raise DownloadError, "File not found: #{file_key} (#{e.message})"
+        rescue Aws::Errors::ServiceError => e
+          raise DownloadError, "Download failed: #{e.message}"
         end
 
-        # Check if file exists
-        # @param file_key [String] the file key/name in MinIO
+        # Check if an object exists.
+        # @param file_key [String] the object key
         # @return [Boolean]
         def exists?(file_key)
-          response = self.class.head(
-            "#{@base_uri}/download/#{URI.encode_www_form_component(file_key)}",
-            headers: auth_headers,
-            timeout: 10
-          )
-          response.success?
+          s3.head_object(bucket: @bucket, key: file_key)
+          true
+        rescue Aws::S3::Errors::NotFound, Aws::S3::Errors::NoSuchKey
+          false
         rescue StandardError
           false
         end
 
-        # Delete a file from MinIO
-        # @param file_key [String] the file key/name in MinIO
+        # Delete an object.
+        # @param file_key [String] the object key
         # @return [Boolean]
         def delete(file_key)
-          response = self.class.delete(
-            "#{@base_uri}/delete/#{URI.encode_www_form_component(file_key)}",
-            headers: auth_headers,
-            timeout: 30
-          )
-          response.success?
+          s3.delete_object(bucket: @bucket, key: file_key)
+          true
         rescue StandardError => e
           Rails.logger.error("FileStorage::Client delete error: #{e.message}")
           false
@@ -81,60 +108,32 @@ module Dscf
 
         private
 
-        def resolve_api_key(app_name)
-          # Priority: explicit app name -> engine-specific -> default
-          key_name = app_name&.upcase&.gsub("-", "_") || detect_engine_name
-
-          # Check all possible env var keys
-          possible_keys = [
-            "MINIO_API_KEY_DSCF_#{key_name}",
-            "MINIO_API_KEY_#{key_name}",
-            "MINIO_API_KEY"
-          ]
-
-          api_key = possible_keys.find { |k| ENV[k].present? }.then { |k| ENV[k] }
-
-          Rails.logger.debug("MinIO API Key lookup: key_name=#{key_name}, tried=#{possible_keys.inspect}, found=#{api_key.present?}")
-          Rails.logger.debug("Available MINIO env vars: #{ENV.select { |k, _v| k.start_with?('MINIO_') }.keys.inspect}")
-
-          api_key
-        end
-
-        def detect_engine_name
-          # First try to detect from record class namespace
-          if @record_class
-            namespace = @record_class.name.split("::")[1] # Dscf::Credit::Bank -> Credit
-            if namespace && namespace != "Core"
-              Rails.logger.debug("MinIO engine detection: from record_class=#{@record_class.name}, detected=#{namespace.upcase}")
-              return namespace.upcase
-            end
-          end
-
-          # Fallback: Auto-detect engine based on caller (skip dscf_core since storage is in core)
-          caller_paths = caller.select { |c| c.include?("/dscf_") && !c.include?("/dscf_core/") }
-
-          caller_path = caller_paths.first
-          return "CORE" unless caller_path
-
-          match = caller_path.match(%r{/dscf_(\w+)/})
-          detected = match ? match[1].upcase : "CORE"
-
-          Rails.logger.debug("MinIO engine detection: caller_path=#{caller_path}, detected=#{detected}")
-          detected
+        def s3
+          @s3 ||= Aws::S3::Client.new(
+            endpoint: @endpoint,
+            region: @region,
+            access_key_id: @access_key_id,
+            secret_access_key: @secret_access_key,
+            force_path_style: true
+          )
         end
 
         def validate_configuration!
-          raise ConfigurationError, "MINIO_SERVICE_URL is not configured" if @base_uri.blank?
+          missing = []
+          missing << "S3_ENDPOINT_URL" if @endpoint.blank?
+          missing << "S3_BUCKET" if @bucket.blank?
+          missing << "S3_ACCESS_KEY_ID" if @access_key_id.blank?
+          missing << "S3_SECRET_ACCESS_KEY" if @secret_access_key.blank?
 
-          return unless @api_key.blank?
+          return if missing.empty?
 
-          detected = detect_engine_name
-          raise ConfigurationError,
-                "MINIO_API_KEY is not configured. Looked for: MINIO_API_KEY_DSCF_#{detected}, MINIO_API_KEY_#{detected}, MINIO_API_KEY"
+          raise ConfigurationError, "Object storage is not configured. Missing: #{missing.join(', ')}"
         end
 
-        def auth_headers
-          {"x-api-key" => @api_key}
+        # Flat, unique, slash-free key (kept compatible with the files/:file_key route).
+        def generate_file_key(filename)
+          ext = filename ? File.extname(filename.to_s).downcase : ""
+          "#{SecureRandom.uuid}#{ext}"
         end
 
         def prepare_file(file, custom_filename)
@@ -166,44 +165,6 @@ module Dscf
             raise ArgumentError, "Unsupported file type: #{file.class}"
           end
         end
-
-        def handle_upload_response(response, prepared)
-          unless response.success?
-            error_message = response.parsed_response&.dig("message") || "Upload failed"
-            raise UploadError, "#{error_message} (HTTP #{response.code})"
-          end
-
-          body = response.parsed_response
-          {
-            file_key: body["fileName"],
-            filename: prepared[:filename],
-            size: body["size"] || prepared[:size],
-            content_type: body["mimeType"] || prepared[:content_type]
-          }
-        end
-
-        def handle_download_response(response, file_key)
-          unless response.success?
-            error_message = response.parsed_response&.dig("message") || "Download failed"
-            raise DownloadError, "#{error_message} (HTTP #{response.code})"
-          end
-
-          content_disposition = response.headers["content-disposition"]
-          filename = extract_filename(content_disposition) || file_key
-
-          {
-            data: response.body,
-            filename: filename,
-            content_type: response.headers["content-type"] || "application/octet-stream"
-          }
-        end
-
-        def extract_filename(content_disposition)
-          return nil unless content_disposition
-
-          match = content_disposition.match(/filename="?([^";\s]+)"?/)
-          match&.[](1)
-        end
       end
     end
   end

data/app/services/dscf/core/notification_service.rb

@@ -5,9 +5,14 @@ module Dscf
     class NotificationService
       class << self
         def deliver(notification)
+          phone = notification.recipient&.phone
+          raise ArgumentError, "Recipient phone is blank" if phone.blank?
           adapter = resolve_adapter
-          adapter.send_sms(notification.recipient.phone, notification.body)
+          adapter.send_sms(phone, notification.body)
           notification.update!(status: :delivered, delivered_at: Time.current)
+        rescue => e
+          Rails.logger.error("Notification delivery failed: #{e.message}")
+          notification.update(status: :failed) rescue nil
         end
 
         def resolve_adapter

data/config/routes.rb

@@ -13,6 +13,7 @@ Dscf::Core::Engine.routes.draw do
       patch "request_modification"
       patch "resubmit"
     end
+    resources :documents, only: %i[index create destroy], controller: "documents"
   end
 
   resources :roles do

data/lib/dscf/core/version.rb

@@ -1,5 +1,5 @@
 module Dscf
   module Core
-    VERSION = "0.3.7".freeze
+    VERSION = "0.3.9".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dscf-core
 version: !ruby/object:Gem::Version
-  version: 0.3.7
+  version: 0.3.9
 platform: ruby
 authors:
 - Asrat
@@ -51,6 +51,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 4.1.0
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-s3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bcrypt
   requirement: !ruby/object:Gem::Requirement
@@ -442,6 +456,7 @@ files:
 - app/controllers/dscf/core/auth_controller.rb
 - app/controllers/dscf/core/business_types_controller.rb
 - app/controllers/dscf/core/businesses_controller.rb
+- app/controllers/dscf/core/documents_controller.rb
 - app/controllers/dscf/core/fayda_verifications_controller.rb
 - app/controllers/dscf/core/files_controller.rb
 - app/controllers/dscf/core/permissions_controller.rb
@@ -475,9 +490,11 @@ files:
 - app/models/dscf/core/user_profile.rb
 - app/models/dscf/core/user_role.rb
 - app/policies/dscf/core/account_management_policy.rb
+- app/policies/dscf/core/address_policy.rb
 - app/policies/dscf/core/application_policy.rb
 - app/policies/dscf/core/business_policy.rb
 - app/policies/dscf/core/business_type_policy.rb
+- app/policies/dscf/core/document_policy.rb
 - app/policies/dscf/core/permission_policy.rb
 - app/policies/dscf/core/role_policy.rb
 - app/serializers/dscf/core/address_serializer.rb