jets 3.1.0 → 5.0.0

data/engines/internal/app/controllers/jets/welcome_controller.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class Jets::WelcomeController < Jets::ApplicationController # :nodoc:
+  skip_forgery_protection
+  layout false
+
+  def index
+  end
+end

data/engines/internal/app/functions/jets/base_path.rb

@@ -0,0 +1,109 @@
+begin
+  require 'bundler/setup'
+  # When require bundler/setup fails, AWS Lambda won't be able to load base_path_mapping
+  # So we'll require base_path_mapping within begin/rescue block so that it does not also
+  # fail the entire lambda function.
+  # require 'jets/internal/app/functions/jets/base_path_mapping'
+  require_relative "base_path_mapping"
+rescue Exception => e
+  # Note: rescue LoadError is not enough in AWS Lambda environment
+  # Actual exceptions:
+  #   require bundler/setup: Ruby exception "Bundler::GemNotFound"
+  #   require base_path_mappnig: AWS Lambda reported error "errorType": "Init<LoadError>"
+  # Will use a generic rescue Exception though in case error changes in the future.
+  puts "WARN: #{e.class} #{e.message}"
+  puts <<~EOL
+    Could not require bundler/setup.
+    This can happen for weird timeout missing error. Example:
+
+        Could not find timeout-0.3.2 in locally installed gems
+
+    Happens when the gem command is out-of-date on old versions of ruby 2.7.
+    See: https://community.boltops.com/t/could-not-find-timeout-0-3-1-in-any-of-the-sources/996
+  EOL
+end
+require 'cfn_response'
+
+STAGE_NAME = "<%= @stage_name %>"
+
+def lambda_handler(event:, context:)
+  cfn = CfnResponse.new(event, context)
+  cfn.response do
+    # Super edge case: mapping is nil when require bundler/setup fails
+    begin
+      mapping = BasePathMapping.new(event, STAGE_NAME)
+    rescue NameError => e
+      puts "ERROR: #{e.class} #{e.message}"
+      puts error_message
+    end
+
+    # This is the "second pass" of CloudFormation when it tries to delete the BasePathMapping during rollback
+    if mapping.nil? && event['RequestType'] == "Delete"
+      cfn.success # so that CloudFormation can continue the delete process from a rollback
+      delay
+      return
+    end
+
+    # Normal behavior when mapping is not nil when bundler/setup loads successfully
+    case event['RequestType']
+    when "Create", "Update"
+      mapping.update
+    when "Delete"
+      mapping.delete(true) if mapping.should_delete?
+    end
+  end
+end
+
+def delay
+  puts "Delaying 60 seconds to allow user some time to see lambda function logs."
+  60.times do
+    puts Time.now
+    sleep 1
+  end
+end
+
+def error_message
+  <<~EOL
+  This is ultimately the result of require bundler/setup failing to load.
+  On the CloudFormation first pass, the BasePathMapping fails to CREATE.
+  CloudFormation does a rollback and tries to delete the BasePathMapping.
+
+  Jets will send a success response to CloudFormation so it can continue and delete
+  BasePathMapping on the rollback. Otherwise, CloudFormation ends up in the terminal
+  UPDATE_FAILED state and the CloudFormation console provides 3 options:
+
+      1) retry 2) update 3) rollback.
+
+  The only option that seems to work is rollback to get it out of UPDATE_FAILED to
+  UPDATE_ROLLBACK_COMPLETE. But then, if we `jets deploy` again without fixing the
+  require bundler/setup issue, we'll end back up in the UPDATE_FAILED state.
+
+  Will handle this error so we can continue the stack because we do not want it to fail
+  and never be able to send the CfnResponse. Then we have to wait hours for a CloudFormation timeout.
+  Sometimes deleting the APP-dev-ApiDeployment20230518230443-EXAMPLEY8YQP0 stack
+  allows the cloudformation stacks to continue, but usually, it'll only just slightly speed up the rollback.
+
+  Some examples of actual rollback times:
+
+  When left alone, the rollback takes about 2.5 hours.
+
+      2023-05-19 05:39:25  User Initiated
+      2023-05-19 08:01:48  UPDATE_ROLLBACK_COMPLETE
+
+  When deleting the APP-dev-ApiDeployment20230518230443-EXAMPLEY8YQP0 stack, it takes about 1.5 hours.
+
+      2023-05-19 06:25:41  User Initiated
+      2023-05-19 07:47:03  UPDATE_ROLLBACK_COMPLETE
+
+  Rescuing and handling the error here allows the CloudFormation stack to continue and finish the rollback process.
+  It takes the rollback time down to about 3 minutes. Example:
+
+      2023-05-19 16:34:19 User Initiated
+      2023-05-19 16:37:34 UPDATE_ROLLBACK_COMPLETE
+
+  Note: The first cloudformation CREATE pass sends FAILED Status to CloudFormation,
+  and the second cloudformation DELETE pass sends SUCCESS Status to CloudFormation.
+
+  Related: https://community.boltops.com/t/could-not-find-timeout-0-3-1-in-any-of-the-sources/996
+  EOL
+end

data/engines/internal/app/functions/jets/base_path_mapping.rb

@@ -0,0 +1,191 @@
+require 'aws-sdk-apigateway'
+require 'aws-sdk-cloudformation'
+
+class BasePathMapping
+  def initialize(event, stage_name)
+    @event, @stage_name = event, stage_name
+    aws_config_update!
+  end
+
+  # Override the AWS retry settings. The aws-sdk-core has expondential backup with this formula:
+  #
+  #   2 ** c.retries * c.config.retry_base_delay
+  #
+  # So the max delay will be 2 ** 7 * 0.6 = 76.8s
+  #
+  # Useful links:
+  #
+  #   https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-core/lib/aws-sdk-core/plugins/retry_errors.rb
+  #   https://docs.aws.amazon.com/apigateway/latest/developerguide/limits.html
+  #
+  def aws_config_update!
+    Aws.config.update(
+      retry_limit: 7, # default: 3
+      retry_base_delay: 0.6, # default: 0.3
+    )
+  end
+
+  # Cannot use update_base_path_mapping to update the base_mapping because it doesnt
+  # allow us to change the rest_api_id. So we delete and create.
+  def update
+    puts "BasePathMapping update"
+    if rest_api_changed?
+      delete(true)
+      create
+    else
+      puts "BasePathMapping update: rest_api_id #{rest_api_id} did not change. Skipping."
+    end
+
+    puts "BasePathMapping update complete"
+  end
+
+  def rest_api_changed?
+    puts "BasePathMapping checking if rest_api_id changed"
+    mapping = current_base_path_mapping
+    return true unless mapping
+    mapping.rest_api_id != rest_api_id
+  end
+
+  def current_base_path_mapping
+    resp = apigateway.get_base_path_mapping(base_path: "(none)", domain_name: domain_name)
+  rescue Aws::APIGateway::Errors::NotFoundException
+    return nil
+  end
+
+  # Dont delete the newly created base path mapping unless this is an operation
+  # where we're fully deleting the stack
+  def should_delete?
+    deleting_parent?
+  end
+
+  def delete(fail_silently=false)
+    puts "BasePathMapping delete"
+    options = {
+      domain_name: domain_name, # required
+      base_path: base_path.empty? ? '(none)' : base_path,
+    }
+    puts "BasePathMapping delete options #{options.inspect}"
+    apigateway.delete_base_path_mapping(options)
+    wait_for_delete
+    puts "BasePathMapping delete complete"
+  # https://github.com/tongueroo/jets/issues/255
+  # Used to return: Aws::APIGateway::Errors::NotFoundException
+  # Now returns: Aws::APIGateway::Errors::InternalFailure
+  # So we'll use a more generic error
+  rescue Aws::APIGateway::Errors::ServiceError => e
+    raise(e) unless fail_silently
+  end
+
+  # Wait for deletion to complete
+  # Otherwise, CloudFormation continues too fast during a `jets delete`
+  # and the initially fails deletion. CloudFormaton then retries until it's successfully.
+  # The stack ultimately finishes deleting successfully but the error messages
+  # are confusing to the user.
+  def wait_for_delete
+    loop do
+      resp = apigateway.get_base_path_mapping(
+        domain_name: domain_name,
+        base_path: base_path.empty? ? '(none)' : base_path,
+      )
+      break if resp.nil? || resp.empty?
+      sleep(5)
+    end
+  rescue Aws::APIGateway::Errors::NotFoundException
+    nil
+  end
+
+  def create
+    puts "BasePathMapping create"
+    options = {
+      domain_name: domain_name, # required
+      base_path: base_path,
+      rest_api_id: rest_api_id, # required
+      stage: @stage_name,
+    }
+    puts "BasePathMapping create options #{options.inspect}"
+    apigateway.create_base_path_mapping(options)
+    puts "BasePathMapping create complete"
+  rescue Aws::APIGateway::Errors::ServiceError => e
+    puts "ERROR: #{e.class}: #{e.message}"
+    puts "BasePathMapping create failed"
+    if e.message.include?("Invalid domain name identifier specified")
+      puts <<~EOL
+        This super edge case error seems to happen when the cloudformation stack does a rollback
+        because the BasePathMapping custom resource fails. This has happened with a strange combination of
+        ruby 2.7 and the timeout gem not being picked up in the AWS Lambda runtime environment
+        Specifically, when jets deploy was used with a rubygems install that is out-of-date.
+        See: https://community.boltops.com/t/could-not-find-timeout-0-3-1-in-any-of-the-sources/996
+
+        The new base path mapping is not created correctly and the old base path mapping is not properly deleted.
+        The old ghost base mapping interferes with the new base path mapping.
+        The workaround solution seems to require removing all the config.domain settings and deploying again. Example:
+
+        config/application.rb
+
+            config.domain.cert_arn = "arn:aws:acm:us-west-2:111111111111:certificate/EXAMPLE1-a3de-4fe7-b72e-4cc153c5303e"
+            config.domain.hosted_zone_name = "example.com"
+
+        Comment out those settings, deploy, then uncomment and deploy again.
+        If there's a better workaround, please let us know.
+      EOL
+    end
+    raise(e)
+  end
+
+  def mapping_stack
+    @mapping_stack ||= cfn.describe_stacks(stack_name: @event['StackId']).stacks.first
+  end
+
+  def rest_api_id
+    @rest_api_id ||= parameter_value('RestApi')
+  end
+
+  def domain_name
+    @domain_name ||= parameter_value('DomainName')
+  end
+
+  def base_path
+    @base_path ||= parameter_value('BasePath') || ''
+  end
+
+  def parameter_value(parameter_key)
+    puts "mapping_stack #{mapping_stack.inspect}"
+    param = mapping_stack[:parameters].find { |p| p.parameter_key == parameter_key }
+    param&.parameter_value # possible for this to be nil when removing the config: IE: config.domain.name = nil
+  end
+
+  def deleting_parent?
+    stack = cfn.describe_stacks(stack_name: parent_stack_name).stacks.first
+    stack.stack_status == 'DELETE_IN_PROGRESS'
+  end
+
+  def parent_stack_name
+    mapping_stack[:root_id]
+  end
+
+  def apigateway
+    @apigateway ||= Aws::APIGateway::Client.new(aws_options)
+  end
+
+  def cfn
+    @cfn ||= Aws::CloudFormation::Client.new(aws_options)
+  end
+
+  def aws_options
+    options = {
+      retry_limit: 7, # default: 3
+      retry_base_delay: 0.6, # default: 0.3
+    }
+    options.merge!(
+      log_level: :debug,
+      logger: Logger.new($stdout),
+    ) if ENV['JETS_DEBUG_AWS_SDK']
+    options
+  end
+end
+
+if __FILE__ == $0
+  event = JSON.load(File.read(ARGV[0]))
+  stage_name = 'dev' # change to test
+  BasePathMapping.new(event, stage_name).update
+end

data/engines/internal/app/jobs/jets/preheat_job.rb

@@ -0,0 +1,67 @@
+class Jets::PreheatJob < Jets::Job::Base
+  include Jets::AwsServices
+
+  class_timeout 30
+  class_memory 1024
+  class_iam_policy([
+    {
+      Sid: "Statement1",
+      Action: ["logs:*"],
+      Effect: "Allow",
+      Resource: [{
+        "Fn::Sub": "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${JetsPreheatJobWarmLambdaFunction}"
+      }]
+    },
+    {
+      Sid: "Statement2",
+      Action: ["lambda:InvokeFunction", "lambda:InvokeAsync"],
+      Effect: "Allow",
+      Resource: [{
+        "Fn::Sub": "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:#{Jets.project_namespace}-*"
+      }]
+    }
+  ])
+
+  def warm
+    options = call_options(event[:quiet])
+    Jets::Preheat.warm_all(options)
+    "Finished prewarming your application."
+  end
+
+  class << self
+    # Can use this to prewarm post deploy
+    def prewarm!
+      perform_now(:warn, quiet: true)
+    end
+  end
+
+private
+  # Usually: jets-preheat_job-warm unless JETS_RESET=1, in that case need to lookup the function name
+  def warm_function_name
+    # Return early to avoid lookup call normally
+    return "jets-preheat_job-warm" unless ENV['JETS_RESET'] == "1"
+
+    parent_stack = cfn.describe_stack_resources(stack_name: Jets::Names.parent_stack_name)
+    preheat_stack = parent_stack.stack_resources.find do |resource|
+      resource.logical_resource_id =~ /JetsPreheatJob/
+    end
+
+    resp = cfn.describe_stack_resources(stack_name: preheat_stack.physical_resource_id)
+    resources = resp.stack_resources
+    warm_function = resources.find do |resource|
+      resource.logical_resource_id =~ /WarmLambdaFunction/
+    end
+    warm_function.physical_resource_id # IE: jets-preheat_job-warm
+  end
+
+  def call_options(quiet)
+    options = {}
+    options.merge!(mute: true, mute_output: true) if quiet
+    # All the methods in this Job class leads to Jets::Commands::Call.
+    # This is true for the Jets::Preheat.warm_all also.
+    # These jobs delegate out to Lambda function calls. We do not need/want
+    # the invocation type: RequestResponse in this case.
+    options.merge!(invocation_type: "Event")
+    options
+  end
+end

data/engines/internal/app/views/jets/info/properties.html.erb

@@ -0,0 +1 @@
+<%= @info.html_safe %>

data/engines/internal/app/views/jets/info/routes.html.erb

@@ -0,0 +1,10 @@
+<h2>
+  Routes
+</h2>
+
+<p>
+  Routes match in priority from top to bottom
+</p>
+
+<%# @routes_inspector.format(ActionDispatch::Routing::HtmlTableFormatter.new(self)) %>
+<%= raw @routes_table %>

data/{lib/jets → engines}/internal/app/views/jets/mailers/email.html.erb

@@ -1,5 +1,6 @@
 <!DOCTYPE html>
 <html><head>
+<title><%= @page_title %></title>
 <meta name="viewport" content="width=device-width" />
 <style type="text/css">
   html, body, iframe {
@@ -55,35 +56,35 @@
   <dl>
     <% if @email.respond_to?(:smtp_envelope_from) && Array(@email.from) != Array(@email.smtp_envelope_from) %>
       <dt>SMTP-From:</dt>
-      <dd><%= @email.smtp_envelope_from %></dd>
+      <dd id="smtp_from"><%= @email.smtp_envelope_from %></dd>
     <% end %>
 
     <% if @email.respond_to?(:smtp_envelope_to) && @email.to != @email.smtp_envelope_to %>
       <dt>SMTP-To:</dt>
-      <dd><%= @email.smtp_envelope_to %></dd>
+      <dd id="smtp_to"><%= @email.smtp_envelope_to %></dd>
     <% end %>
 
     <dt>From:</dt>
-    <dd><%= @email.header['from'] %></dd>
+    <dd id="from"><%= @email.header['from'] %></dd>
 
     <% if @email.reply_to %>
       <dt>Reply-To:</dt>
-      <dd><%= @email.header['reply-to'] %></dd>
+      <dd id="reply_to"><%= @email.header['reply-to'] %></dd>
     <% end %>
 
     <dt>To:</dt>
-    <dd><%= @email.header['to'] %></dd>
+    <dd id="to"><%= @email.header['to'] %></dd>
 
     <% if @email.cc %>
       <dt>CC:</dt>
-      <dd><%= @email.header['cc'] %></dd>
+      <dd id="cc"><%= @email.header['cc'] %></dd>
     <% end %>
 
     <dt>Date:</dt>
-    <dd><%= Time.current.rfc2822 %></dd>
+    <dd id="date"><%= Time.current.rfc2822 %></dd>
 
     <dt>Subject:</dt>
-    <dd><strong><%= @email.subject %></strong></dd>
+    <dd><strong id="subject"><%= @email.subject %></strong></dd>
 
     <% unless @email.attachments.nil? || @email.attachments.empty? %>
       <dt>Attachments:</dt>
@@ -96,15 +97,17 @@
     <% end %>
 
     <dt>Format:</dt>
-    <% if @email.multipart? %>
+    <% if @email.html_part && @email.text_part %>
       <dd>
         <select id="part" onchange="refreshBody(false);">
           <option <%= request.format == Mime[:html] ? 'selected' : '' %> value="<%= part_query('text/html') %>">View as HTML email</option>
           <option <%= request.format == Mime[:text] ? 'selected' : '' %> value="<%= part_query('text/plain') %>">View as plain-text email</option>
         </select>
       </dd>
+    <% elsif @part %>
+      <dd id="mime_type" data-mime-type="<%= part_query(@part.mime_type) %>"><%= @part.mime_type == 'text/html' ? 'HTML email' : 'plain-text email' %></dd>
     <% else %>
-      <dd id="mime_type" data-mime-type="<%= part_query(@email.mime_type) %>"><%= @email.mime_type == 'text/html' ? 'HTML email' : 'plain-text email' %></dd>
+      <dd id="mime_type" data-mime-type=""></dd>
     <% end %>
 
     <% if I18n.available_locales.count > 1 %>
@@ -120,7 +123,14 @@
   </dl>
 </header>
 
-<iframe seamless name="messageBody" src="?part=<%= part_query(@part.mime_type) %>"></iframe>
+<% if @part && @part.mime_type %>
+  <iframe name="messageBody" src="?<%= part_query(@part.mime_type) %>"></iframe>
+<% else %>
+  <p>
+    You are trying to preview an email that does not have any content.
+    This is probably because the <em>mail</em> method has not been called in <em><%= @preview.preview_name %>#<%= @email_action %></em>.
+  </p>
+<% end %>
 
 <script>
   function refreshBody(reload) {
@@ -130,14 +140,24 @@
     var part_param = part_select ?
       part_select.options[part_select.selectedIndex].value :
       document.querySelector('#mime_type').dataset.mimeType;
-    var fresh_location = '?part=' + part_param;
-    var doc = iframe.contentWindow.document;
+    var locale_param = locale_select ? locale_select.options[locale_select.selectedIndex].value : null;
+    var fresh_location;
+    if (locale_param) {
+      fresh_location = '?' + part_param + '&' + locale_param;
+    } else {
+      fresh_location = '?' + part_param;
+    }
+    iframe.contentWindow.location = fresh_location;
 
-    doc.open();
-    doc.write("Loading...");
-    doc.close();
+    var url = location.pathname.replace(/\.(txt|html)$/, '');
+    var format = /html/.test(part_param) ? '.html' : '.txt';
+    var state_to_replace = locale_param ? (url + format + '?' + locale_param) : (url + format);
 
-    iframe.contentWindow.location = fresh_location;
+    if (reload) {
+      location.href = state_to_replace;
+    } else if (history.replaceState) {
+      window.history.replaceState({}, '', state_to_replace);
+    }
   }
 </script>
 

data/engines/internal/app/views/jets/mailers/index.html.erb

@@ -0,0 +1,8 @@
+<% @previews.each do |preview| %>
+<h3><%= link_to preview.preview_name.titleize, url_for(controller: "jets/mailers", action: "preview", path: preview.preview_name) %></h3>
+<ul>
+<% preview.emails.each do |email| %>
+<li><%= link_to email, url_for(controller: "jets/mailers", action: "preview", path: "#{preview.preview_name}/#{email}") %></li>
+<% end %>
+</ul>
+<% end %>

data/engines/internal/app/views/jets/mailers/mailer.html.erb

@@ -0,0 +1,6 @@
+<h3><%= @preview.preview_name.titleize %></h3>
+<ul>
+<% @preview.emails.each do |email| %>
+<li><%= link_to email, url_for(controller: "jets/mailers", action: "preview", path: "#{@preview.preview_name}/#{email}") %></li>
+<% end %>
+</ul>

data/{lib/jets/commands/templates/skeleton/public/index.html.tt → engines/internal/app/views/jets/welcome/index.html.erb}

@@ -79,12 +79,16 @@
         $ open http://localhost:8888/posts
         $ jets help
       </code></pre></div>
-      <p>More on info: <a href="http://rubyonjets.com">rubyonjets.com</a></p>
-      <p>Also check out the <a href="http://rubyonjets.com/reference">Jets CLI reference</a>.</p>
+      <p>Docs on: <a href="http://rubyonjets.com">rubyonjets.com</a></p>
+      <p>CLI: <a href="http://rubyonjets.com/reference">Jets CLI reference</a></p>
+      <p>Jets Info: <%= link_to "Properties", controller: "jets/info", action: "properties" %></p>
+      <p>Jets Info: <%= link_to "Routes", controller: "jets/info", action: "routes" %></p>
     </div>
     <p class="version">
-      <strong>Jets version:</strong> <%= Jets.version %><br />
-      <strong>Ruby version:</strong> <%= RUBY_VERSION %>
+      <ul>
+        <li><strong>Jets version:</strong> <%= Jets.version %></li>
+        <li><strong>Ruby version:</strong> <%= RUBY_DESCRIPTION %></li>
+      </ul>
     </p>
   </div>
 </body>

data/engines/internal/app/views/layouts/application.html.erb

@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title><%= @page_title %></title>
+  <style>
+    body { background-color: #fff; color: #333; }
+
+    body, p, ol, ul, td {
+      font-family: helvetica, verdana, arial, sans-serif;
+      font-size:   13px;
+      line-height: 18px;
+    }
+
+    pre {
+      background-color: #eee;
+      padding: 10px;
+      font-size: 11px;
+      white-space: pre-wrap;
+    }
+
+    a { color: #000; }
+    a:visited { color: #666; }
+    a:hover { color: #fff; background-color:#000; }
+
+    h2 { padding-left: 10px; }
+
+    @media (prefers-color-scheme: dark) {
+      body {
+        background-color: #222;
+        color: #ececec;
+      }
+
+      pre {
+        background-color: #333;
+      }
+
+      a { color: #fff; }
+      a:visited { color: #999; }
+      a:hover { color: #000; background-color: #fff; }
+    }
+
+    <%= yield :style %>
+  </style>
+</head>
+<body>
+
+<%= yield %>
+
+</body>
+</html>

data/engines/internal/lib/internal/actiondispatch.rb

@@ -0,0 +1,39 @@
+require "active_support/messages/rotation_configuration"
+
+module Jets::Internal
+  # Reference: https://github.com/rails/rails/blob/master/actiondispatch/lib/action_dispatch/railtie.rb
+  class Actiondispatch < ::Jets::Turbine
+    config.action_dispatch = ActiveSupport::OrderedOptions.new
+    config.action_dispatch.x_sendfile_header = nil
+    config.action_dispatch.ip_spoofing_check = true
+    config.action_dispatch.show_exceptions = true
+    config.action_dispatch.tld_length = 1
+    config.action_dispatch.ignore_accept_header = false
+    config.action_dispatch.rescue_templates = {}
+    config.action_dispatch.rescue_responses = {}
+    config.action_dispatch.default_charset = nil
+    config.action_dispatch.rack_cache = false
+    config.action_dispatch.http_auth_salt = "http authentication"
+    config.action_dispatch.signed_cookie_salt = "signed cookie"
+    config.action_dispatch.encrypted_cookie_salt = "encrypted cookie"
+    config.action_dispatch.encrypted_signed_cookie_salt = "signed encrypted cookie"
+    config.action_dispatch.authenticated_encrypted_cookie_salt = "authenticated encrypted cookie"
+    config.action_dispatch.use_authenticated_cookie_encryption = false
+    config.action_dispatch.use_cookies_with_metadata = false
+    config.action_dispatch.perform_deep_munge = true
+    config.action_dispatch.request_id_header = "X-Request-Id"
+    config.action_dispatch.return_only_request_media_type_on_content_type = true
+    config.action_dispatch.log_rescued_responses = true
+
+    config.action_dispatch.default_headers = {
+      "X-Frame-Options" => "SAMEORIGIN",
+      "X-XSS-Protection" => "1; mode=block",
+      "X-Content-Type-Options" => "nosniff",
+      "X-Download-Options" => "noopen",
+      "X-Permitted-Cross-Domain-Policies" => "none",
+      "Referrer-Policy" => "strict-origin-when-cross-origin"
+    }
+
+    config.action_dispatch.cookies_rotations = ActiveSupport::Messages::RotationConfiguration.new
+  end
+end