has_helpers 5.0.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: aa5c53c4d86921735f76c8b472eff1793d0a1c1a04d5483d8426a22b2ea1d04b
+  data.tar.gz: 357d70f322e1710fc9179cd0255df2f46aa56bae046ca8f4405e2423d2af679f
+SHA512:
+  metadata.gz: 7ce9d157df1ba50be368a335896e2c2e00d5d00c2fdd4c3848b07c948484777cf0a1c5d3108a61eac09a51e79389049905a4f0fa73d7d80d25ceaa1426c06678
+  data.tar.gz: 301918c9e1efa0770adc5a87962e9564a67b1da069968a284b457d82e75c401f81344df7b44fd0ec5547649fe1d23f9c01ad2b30c8febc5032b12d84a8864813

data/.gitignore

@@ -0,0 +1,38 @@
+*.gem
+*.pgz
+*.tmproj
+.bundle
+.DS_Store
+.gitconfig
+.idea
+.rvmrc
+.sass-cache
+/.ey_local_data
+/.vagrant
+bin/*
+config/*.sphinx.conf
+spec/internal/config/database.yml
+config/sphinx.yml
+db/sphinx/
+Gemfile.lock
+log/*.log
+project.rvmrc
+public/assets
+public/flash/*.swf
+public/javascripts/packaged/*.js
+public/packages/*
+public/stylesheets/packaged/*.css
+sphinx/**/*
+tmp/**/*
+Gemfile.lock
+.byebug_history
+.tekton/charts*
+.tekton/Chart.lock
+
+## Environment normalization:
+/.bundle
+/vendor/bundle
+
+.rubocop-https---onehq-com-rubocop3-yml
+
+.simplecov

data/.rspec

@@ -0,0 +1,3 @@
+--format Fuubar
+--color
+--require spec_helper

data/.rubocop.yml

@@ -0,0 +1,10 @@
+inherit_from:
+  - https://onehq.com/rubocop3_4.yml
+
+inherit_mode:
+  merge:
+    - Exclude
+
+AllCops:
+  Exclude:
+    - "bin/bundle"

data/.ruby-gemset

@@ -0,0 +1 @@
+has_helpers

data/.ruby-version

@@ -0,0 +1 @@
+3.4.4

data/.tekton/Chart.yaml

@@ -0,0 +1,14 @@
+apiVersion: v2
+name: pipeline
+description: A Helm chart for Kubernetes
+
+type: application
+
+version: 0.1.0
+
+dependencies:
+  - name: ruby-pipelines
+    alias: delivery
+    version: "0.2.0-dev.6"
+    repository: "oci://public.ecr.aws/c6o8b8d1"
+

data/.tekton/templates/pipelinerun.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: {{ .Release.Name }}-{{ .Release.Revision }}
+  annotations:
+    "helm.sh/hook": post-upgrade,post-install
+spec:
+  serviceAccountName: build-bot
+  params:
+    - name: ci-image-name
+      value: onehq.azurecr.io/{{ .Values.gem }}-ci
+    - name: gem-name
+      value: "{{ .Values.gem }}"
+    - name: publish
+      value: '{{ .Values.publish }}'
+    - name: git-url
+      value: "https://{{ .Values.git.provider }}/{{ .Values.git.organization }}/{{ .Values.git.repository }}.git"
+    - name: git-sha
+      value: "{{ .Values.git.sha }}"
+    - name: git-ref
+      value: "{{ required "Required .Values.git.ref" .Values.git.ref }}"
+    - name: rubyVersion
+      value: "{{ .Values.rubyVersion }}"
+  pipelineRef:
+    name: gem-delivery
+  timeout: 1h30m0s
+  podTemplate:
+    volumes:
+      - name: oidc-token
+        projected:
+          sources:
+            - serviceAccountToken:
+                path: oidc-token
+                expirationSeconds: 1800
+  workspaces:
+    - name: git-source
+      volumeClaimTemplate:
+        spec:
+          storageClassName: rwm
+          accessModes:
+            - ReadWriteMany # access mode may affect how you can use this volume in parallel tasks
+          resources:
+            requests:
+              storage: 1Gi

data/.tekton/values-main.yaml

@@ -0,0 +1,53 @@
+publish: true
+
+delivery:
+  rbac:
+    rolebindings:
+      - role: cr_admin_pipes
+        name: adminpipe
+        subjects:
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_release_adminpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygemsadminallpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_adminallpipe
+      - role: cr_operator_pipes
+        name: operatorpipe
+        subjects:
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_release_operatorpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_operatorallpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_operatorallpipe
+      - role: cr_read_PLR
+        name: readPLR
+        subjects:
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_release_readpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_readallpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_readallpipe
+      - role: cr_read_rerun_PLR
+        name: readrerunPLR
+        subjects:
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_release_readrerunpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_readrerunallpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_readrerunallpipe

data/.tekton/values-pr.yaml

@@ -0,0 +1,40 @@
+publish: false
+delivery:
+  rbac:
+    rolebindings:
+      - role: cr_admin_pipes
+        name: adminpipe
+        subjects:
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_pr_adminpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_adminallpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_adminallpipe
+      - role: cr_operator_pipes
+        name: operatorpipe
+        subjects:
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_pr_operatorpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_operatorallpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_operatorallpipe
+      - role: cr_read_rerun_PLR
+        name: readrerunPLR
+        subjects:
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_pr_readrerunpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_rubygems_readrerunallpipe
+          - kind: Group
+            apiGroup: rbac.authorization.k8s.io
+            name: g_hq_readrerunallpipe

data/.tekton/values.yaml

@@ -0,0 +1,17 @@
+publish: false
+
+gem: &gem has_helpers
+git:
+  provider: github.com
+  organization: OneHQ
+  repository: *gem
+
+global:
+  taskAnnotations:
+    vault.security.banzaicloud.io/vault-addr: "https://vault-onehq.apps.hub.internal.onehq.com"
+    vault.security.banzaicloud.io/vault-path: "jwt-hub"
+    vault.security.banzaicloud.io/vault-auth-method: "jwt"
+    vault.security.banzaicloud.io/vault-tls-secret: "custom-trusted-ca"
+  gem: *gem
+  rubyVersion: 3.4.4
+  mountGemDockerfile: true

data/.tool-versions

@@ -0,0 +1 @@
+ruby 3.4.4

data/CHANGELOG.md

@@ -0,0 +1,204 @@
+# HAS_HELPERS
+
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## 5.0.2 2026-07-29
+
+### Enhancements [PD-27248]
+
+- Adds a `two_factor_trust_id` (`text`, nullable) column to `user_sessions` via the `AddTwoFactorTrustIdToUserSessions` migration. Stores the FusionAuth native two-factor "trust" identifier (`twoFactorTrustId`) returned when a user opts to trust the device during MFA, so it can be replayed on later logins to let FusionAuth skip the MFA challenge — replacing the app-side `is_trusted_device` bypass.
+
+## 3.2.110 2026-07-16
+
+### Fixes [PD-26658]
+
+- `HasHelpers::Search::SearchUtils` now symbolizes the `with` search option keys before sanitizing `organization_id`, so an `organization_id` passed with a string key (e.g. from the GraphQL JSON scalar) is correctly detected and scoped to the current user instead of being ignored.
+
+## 3.3.0 2026-07-03
+
+### Enhancements [PD-24459]
+
+- `HasHelpers::UserRestrictions` now `include`s `CanCan::Ability`: it registers the standard OneHQ action aliases, defines the negative authorization rules (`can :manage, :all` when unrestricted, otherwise a catch-all block delegating to `restricted?`), and memoizes authorization results per (subject, action) within the instance (mirrors frameworkhq's `Ability`).
+- Adds the `cancancan ~> 3.0` runtime dependency.
+- The existing query API (`restricted?`, `empty?`, `restrictions`, `restricted_resource_names`) is unchanged.
+
+## 3.2.108 2026-06-19
+
+### Enhancements
+
+- Enhanced cards core to support hover cards, compact layout and badge lists
+
+## 3.2.107 2026-06-17
+
+### Fixes
+
+- Pin `i18n` to `< 1.15.0` since 1.15.0 uses `Fiber[]` (Ruby 3.2+) and breaks on Ruby 3.1.
+
+## 3.2.106 2026-06-16
+
+### Fixes [PD-26079]
+
+- Set `columnType` to `"link"` for BelongsTo and HasMany select options instead of the DB column type.
+
+## 3.2.105 2026-06-04
+
+### Enhancements
+
+- Add GoodJob changelog-based Elasticsearch workers to process pending ChangeLog rows through existing HasHelpers
+  reindex queues
+- Add master worker to enqueue one processor job per indexed model and dependency model discovered from HasHelpers::
+  Index.indices
+
+## 3.2.104 2026-05-28
+
+### Fixes [PD-25551]
+
+- Guard against nil nodes in `ExternalGraphqlClient` edges response to prevent `NoMethodError` on `query_all_resources`
+- Improve `Reports::Importer` messages: include resource/option name on failure and correct resource ID on success
+- Use `safe_constantize` instead of `constantize` in `run_all` to avoid `NameError` on unresolvable resource names
+- Replace `Flatteners.constants` filesystem scan with `all_flattener_classes` to correctly discover namespaced
+  flatteners (e.g. `HasHelpers::Organization`)
+- Strip spaces from association names in `HasManyOptions.build_resource_name` to produce valid resource name strings
+
+## 3.2.103 2026-05-27
+
+### Enhancements
+
+- Add `HasHelpers::ServiceTrust`: asymmetric JWT-based trusted service-to-service messaging primitives plus integration
+  adapters.
+- **Primitives**: self-sovereign keypair generation (encrypted at rest, per-environment binding), JWKS endpoint,
+  `Signer` and `Verifier` with algorithm
+  allowlist, audience/expiry/env enforcement, Redis-backed `jti` replay dedup, per-issuer rate limiting, audit log with
+  async writer and retention cleanup, key
+  rotation via Rake task.
+- **Integration adapters**: outbound `Client` (signed HTTP with retry/backoff) and `GraphQLClient`; inbound
+  `VerifyMiddleware`, `AuthenticatedAsService`
+  and `GraphQLAuthentication` controller concerns; `GraphQL::Authorizable` mixin for per-operation capability
+  authorization; receiver-authoritative
+  `allowed_capabilities` allowlist per trusted issuer; strict-by-default capability enforcement with `:none` opt-out.
+- Add Cards role proxy support via `HasHelpers::Cards.configure` and `HasHelpers::Cards::Roles`, with `:server` and
+  `:client` modes.
+- Add Redis-backed remote role caching and ServiceTrust-backed GraphQL role reads using the `roles:read` capability.
+- Add migrations to remove the org-scoped role FK from `role_resource_cards` and add nullable `disabled_at` for
+  soft-disabling orphaned cards.
+- Add internal Role GraphQL type/resolvers for admin apps to mount in service-trust-gated schemas.
+- Add `HasHelpers::Cards::OrphanCardSweeper`; consumer apps are responsible for registering the daily GoodJob cron
+  entry.
+
+## 3.2.102 - 2026-05-25
+
+### Enhancements
+
+- Add sets: parameter to hydrates to declare which model attributes are populated by a hydration that manages more than
+  one attribute.
+
+## 3.2.101 2026-05-22
+
+### Enhancements
+
+- Move health check endpoints from FrameworkHQ into HasHelpers.
+- Add warehouse, GoodJob, and combined database health check endpoints.
+
+## 3.2.100 2026-05-03
+
+### Enhancements
+
+- Hydrate Concern added
+
+## 3.2.99 2026-04-29
+
+### Fixes
+
+- Fix resource mutation name in build_select_option and build_filter_option methods
+
+## 3.2.98 2026-04-29
+
+### Fixes
+
+- Fix `YAML.safe_load` call in `LazyConfig` to use keyword arguments, resolving `ArgumentError` on Ruby 3.1+
+- Fix `NameError` in `provider.rb` where a `HasHelpers::User` prefix caused an invalid instance variable name
+
+## 3.2.96 2026-04-16
+
+## Enhancements
+
+- Added indexes in stats table
+
+## 3.2.95 2026-04-14
+
+### Fixes
+
+- Classify `ExternalDataSync` outcomes correctly: return `retry` only when dependencies are missing, return `fail` with
+  contextual error details for permanent mapping failures, and keep `ok` for successful syncs.
+- Add nullable `error` field to `ExternalDataSync` mutation responses to expose failure context to consumers.
+- Align `HasHelpers::SyncUtils.handle_destruction` return contract with `save_with_result` by returning `true` on
+  success and error message strings on failure.
+- Touch dependency records on successful sync via `dependencies` arg (`touch_dependencies!`) to refresh related
+  `updated_at` timestamps without failing the mutation when individual touches fail.
+
+## 3.2.91 2026-04-10
+
+### Fixes
+
+- Allow `HasHelpers::UserSession` records without organization by updating factory/spec expectations and uniqueness
+  semantics
+
+## 3.2.94 - 2026-04-01
+
+### Enhancements
+
+- Added ImportableAccessors concern to define and register accessor fields that can be used in the data import process.
+
+## 3.2.93 2026-03-27
+
+### Enhancements
+
+- Added SlackNotifier and missing Search class to HasHelpers
+
+## 3.2.92 2026-03-23
+
+### Fixes
+
+- Rescue unhandled exceptions in `ExternalDataSync` mutation and raise as `GraphQL::ExecutionError` so errors are
+  returned as JSON instead of a 500 HTML response
+
+## 3.2.91 2026-03-11
+
+### Fixes
+
+- Restore Elasticsearch delete on record destroy for both Sidekiq and GoodJob backends. When a record is destroyed, its
+  ID is now correctly removed from the search index. Previously, delete operations had been commented out due to routing
+  issues.
+- Fix routing for Elasticsearch deletes: the `organization_id` is now captured in the `ReindexQueue` entry at the time
+  the `reindex` callback fires (while the record's attributes are still in memory), ensuring the correct routing key is
+  available when the delete is processed asynchronously.
+
+## 3.2.89 2026-02-26
+
+### Fixes
+
+- Fix dependency class lookup in `dependencies_satisfied?` to correctly resolve namespaced AR classes (e.g.
+  `HasHelpers::User`) using `ActiveRecord::Base.descendants` instead of `safe_constantize`
+- Update `ExternalDataSync` mutation to support `dependencies` argument and return `status` field
+
+## 3.2.87 2026-02-17
+
+### Fixes
+
+- Fix issue with e2e factory override
+
+## 3.2.86 2026-02-12
+
+### Enhancements
+
+- Added e2e factories api
+
+## 3.2.83 - 2026-02-03
+
+### Enhancements
+
+- Added virtual cards and fields. Removed card custom field constants. Added logig to autogenerate identifier constants.
+
+- Improve Sentry tracing for GraphQL operations

data/Gemfile

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+source "http://rubygems.org"
+
+source "https://vLEyAxzPMpJK8itRTFw6@gem.fury.io/onehq/" do
+  gem "has_owner",                         "~> 5.0.0"
+  gem "has_utils",                         "~> 5.0.0"
+  gem "has_validated_attributes",          "~> 5.0.0"
+  gem "hq-graphql",                        "~> 5.0.0"
+  gem "psql_hq",                           "~> 5.0.0"
+  gem "testhq",                            "~> 5.0.0"
+end
+
+gem "kt-paperclip"                         # This allows the paperclip gem to be required when the internal Rails app call bundle/setup
+gem "observer"                             # Removed from Ruby 3.4 stdlib
+gem "ostruct",                             "~> 0.6"
+gem "redis",                               "~> 4.8"
+gem "strong_migrations",                   "~> 2.5"  # helps ensure bad things don't happen in migrations
+
+source "https://enterprise.contribsys.com/" do
+  gem "sidekiq-ent"
+  gem "sidekiq-pro"
+end
+
+gemspec

data/README.md

@@ -0,0 +1,76 @@
+# HelpersHQ [![Build Status](https://magnum.travis-ci.com/OneHQ/has_helpers.svg?token=Kags5JpNRoHd1RT1bpp8&branch=master)](https://magnum.travis-ci.com/OneHQ/has_helpers) [![Code Climate](https://codeclimate.com/repos/5536687c695680203c000289/badges/857758e9d6250df65888/gpa.svg)](https://codeclimate.com/repos/5536687c695680203c000289/feed)
+
+An engine that faciliates paperclicip, has_attachment other other HQ gems:
+
+## Setup
+
+`
+git clone the repo
+`
+
+`
+Run bundle or bundle install
+`
+`
+Please note: install the ruby version located in the .ruby-version file
+`
+
+`
+rbenv local ruby_version e.g 3.0.0
+`
+
+## Testing
+
+`
+Create your database.yml in spec/internal/config directory
+`
+
+## Cards Role Proxy
+
+See `docs/cards_role_proxy.md` for configuring cross-app card role resolution with `HasHelpers::Cards::Roles`.
+
+## Test database setup
+```
+# EXAMPLE
+  test:
+  adapter: postgresql
+  host: localhost
+  database: has_helpers_test
+  username: postgres
+  password:
+  timeout: 5000
+  encoding: utf8
+  pool: 5
+ ```
+
+## Running Test
+
+whole suite
+
+1. bundle exec rspec spec
+
+Single
+
+2. bundle exec rspec --backtrace spec/PATH_TO_FILE.rb Note: --backtrace for full error stack
+
+Extra tips
+
+1. bundle exec irb to use your local ruby version
+2. bundle exec ruby PATH_TO_FILE.rb to run a single ruby file with the ruby version for the app
+
+
+## Linting
+
+You must make sure the code is properly linted. Achieve that by running the line below
+
+`bundle exec rubocop
+`
+
+1. Update the .rubocop-https---onehq-com-rubocop-yml file if any modifications are required.
+2. Make sure to update `TargetRubyVersion` in the file for any ruby version upgrade.
+3. Example below is a linting issue:
+`
+lib/has_helpers/engine.rb:21:33: W: Lint/SendWithMixinArgument: Use include ::HasHelpers::Controller instead of send(:include, ::HasHelpers::Controller).
+        ::ApplicationController.send(:include, ::HasHelpers::Controller)
+`
+4. Solutin: replace  `send(:include, ::HasHelpers::Controller)` with `include ::HasHelpers::Controller`

data/Rakefile

@@ -0,0 +1,46 @@
+#!/usr/bin/env rake
+# frozen_string_literal: true
+
+begin
+  require "bundler/setup"
+  # Load has_utils changelog tasks directly (no Rails needed)
+  load File.join(Gem.loaded_specs.fetch("has_utils").full_gem_path,
+                 "lib/has_utils/changelog/tasks.rake")
+rescue LoadError
+  puts "You must `gem install bundler` and `bundle install` to run rake tasks"
+rescue KeyError
+  # has_utils not in the bundle; skip changelog tasks
+end
+begin
+  require "rdoc/task"
+rescue LoadError
+  require "rdoc/rdoc"
+  require "rake/rdoctask"
+  RDoc::Task = Rake::RDocTask
+end
+
+RDoc::Task.new(:rdoc) do |rdoc|
+  rdoc.rdoc_dir = "rdoc"
+  rdoc.title    = "HasHelpers"
+  rdoc.options << "--line-numbers"
+  rdoc.rdoc_files.include("README.rdoc")
+  rdoc.rdoc_files.include("lib/**/*.rb")
+end
+
+# APP_RAKEFILE = File.expand_path("../test/dummy/Rakefile", __FILE__)
+# load "rails/tasks/engine.rake"
+
+
+
+Bundler::GemHelper.install_tasks
+
+require "rake/testtask"
+
+Rake::TestTask.new(:test) do |t|
+  t.libs << "lib"
+  t.libs << "test"
+  t.pattern = "test/**/*_test.rb"
+  t.verbose = false
+end
+
+task default: :test