rails_den 2.0.0

data/lib/rails_den/standalone_template.rb

@@ -0,0 +1,700 @@
+require "securerandom"
+require "shellwords"
+
+rails_den_spec = Gem.loaded_specs["rails_den"]
+rails_den_source = rails_den_spec&.full_gem_path
+
+gem "rails_den", "~> #{RailsDen::VERSION}"
+
+
+application <<~RUBY
+  config.react.sprockets_strategy = false
+RUBY
+
+after_bundle do
+  bin_rails_path = "bin/rails"
+  bin_rails = File.read(bin_rails_path)
+
+  rails_den_server_default = <<~'RAILS_DEN_SERVER'
+    rails_den_server_command = %w[server s].include?(ARGV.first)
+
+    rails_den_environment_explicit =
+      ENV["RAILS_ENV"] ||
+      ENV["RACK_ENV"] ||
+      ARGV.any? { |argument|
+        argument == "-e" ||
+          argument == "--environment" ||
+          argument.start_with?("--environment=")
+      }
+
+    if rails_den_server_command && !rails_den_environment_explicit
+      ENV["RAILS_ENV"] = "production"
+    end
+
+  RAILS_DEN_SERVER
+
+  unless bin_rails.include?('ENV["RAILS_ENV"] = "production"')
+    bin_rails.sub!(
+      "#!/usr/bin/env ruby\n",
+      "#!/usr/bin/env ruby\n\n#{rails_den_server_default}"
+    )
+
+    File.write(bin_rails_path, bin_rails)
+  end
+
+  generate "authentication"
+  generate "simple_form:install"
+
+  generate "migration",
+           "AddUsernameToUsers",
+           "username:string"
+
+  username_migration =
+    Dir["db/migrate/*_add_username_to_users.rb"].max
+
+  File.write(
+    username_migration,
+    <<~RUBY
+      class AddUsernameToUsers < ActiveRecord::Migration[8.1]
+        def change
+          add_column :users,
+                     :username,
+                     :string,
+                     null: false
+
+          add_index :users,
+                    :username,
+                    unique: true
+        end
+      end
+    RUBY
+  )
+
+  remove_file "app/models/user.rb"
+
+  file "app/models/user.rb", <<~RUBY
+    class User < ApplicationRecord
+      has_secure_password
+      has_many :sessions, dependent: :destroy
+
+      attr_accessor :current_password
+
+      normalizes :email_address,
+                 with: ->(email) {
+                   email.strip.downcase
+                 }
+
+      normalizes :username,
+                 with: ->(username) {
+                   username.strip.downcase
+                 }
+
+      validates :username,
+                presence: true,
+                uniqueness: {
+                  case_sensitive: false
+                },
+                length: {
+                  in: 3..30
+                },
+                format: {
+                  with: /\\A[a-z0-9_]+\\z/,
+                  message: "may contain only letters, numbers, and underscores"
+                }
+    end
+  RUBY
+
+  file "app/controllers/rails_den_controller.rb", <<~RUBY
+    class RailsDenController < ApplicationController
+      allow_unauthenticated_access
+    end
+  RUBY
+
+  remove_file "app/controllers/sessions_controller.rb"
+
+  file "app/controllers/sessions_controller.rb", <<~RUBY
+    class SessionsController < ApplicationController
+      allow_unauthenticated_access only: %i[new create]
+
+      rate_limit to: 10,
+                 within: 3.minutes,
+                 only: :create,
+                 with: -> {
+                   redirect_to new_session_path,
+                               alert: "Try again later."
+                 }
+
+      layout "rails_den/application"
+
+      def new
+        render "rails_den/sessions/new"
+      end
+
+      def create
+        credentials = params.expect(
+          session: [
+            :email_address,
+            :password
+          ]
+        )
+
+        if user = User.authenticate_by(credentials)
+          state = RailsDen::RestrictionResolver.account_state(user: user)
+
+          if state == "active"
+            start_new_session_for(user)
+            redirect_to after_authentication_url
+          elsif state == "suspended"
+            restriction = RailsDen::RestrictionResolver.active_restrictions(user: user)
+              .select { |item| item.kind == "suspension" }
+              .max_by(&:ends_at)
+
+            redirect_to new_session_path,
+                        alert: "Your community access is suspended until \#{I18n.l(restriction.ends_at, format: :long)}."
+          else
+            redirect_to new_session_path,
+                        alert: "Your community access has been banned."
+          end
+        else
+          redirect_to new_session_path,
+                      alert: "Try another email address or password."
+        end
+      end
+
+      def destroy
+        terminate_session
+        redirect_to new_session_path, status: :see_other
+      end
+    end
+  RUBY
+
+  file "app/controllers/registrations_controller.rb", <<~RUBY
+    class RegistrationsController < ApplicationController
+      allow_unauthenticated_access only: %i[new create]
+
+      before_action :ensure_registration_enabled, only: %i[new create]
+
+      layout "rails_den/application"
+
+      def new
+        @user = User.new
+
+        render "rails_den/registrations/new"
+      end
+
+      def create
+        @user = User.new(registration_params)
+
+        if save_registration
+          start_new_session_for(@user)
+          redirect_to "/rails_den"
+        else
+          render "rails_den/registrations/new",
+                 status: :unprocessable_entity
+        end
+      end
+
+      def edit
+        @user = Current.user
+
+        render "rails_den/registrations/edit"
+      end
+
+      def update
+        @user = Current.user
+        @user.current_password = params.dig(:user, :current_password)
+
+        unless @user.authenticate(@user.current_password.to_s)
+          @user.errors.add(:base, "Current password is incorrect.")
+
+          return render "rails_den/registrations/edit",
+                        status: :unprocessable_entity
+        end
+
+        attributes = account_params.to_h.symbolize_keys
+
+        if attributes[:password].blank?
+          attributes.delete(:password)
+          attributes.delete(:password_confirmation)
+        end
+
+        if @user.update(attributes)
+          destroy_other_sessions if attributes.key?(:password)
+
+          redirect_to edit_registration_path,
+                      notice: "Your account has been updated."
+        else
+          render "rails_den/registristrations/edit",
+                 status: :unprocessable_entity
+        end
+      end
+
+      private
+
+      def save_registration
+        User.transaction do
+          next false unless @user.save
+
+          if User.count == 1
+            RailsDen::Administrator.create!(
+              user: @user
+            )
+          end
+
+          true
+        end
+      end
+
+      def registration_params
+        params.require(:user).permit(
+          :username,
+          :email_address,
+          :password,
+          :password_confirmation
+        )
+      end
+
+      def account_params
+        params.require(:user).permit(
+          :username,
+          :email_address,
+          :password,
+          :password_confirmation
+        )
+      end
+
+      def destroy_other_sessions
+        @user.sessions.where.not(id: Current.session.id).destroy_all
+      end
+
+      def ensure_registration_enabled
+        head :not_found unless RailsDen.config.registration_enabled
+      end
+    end
+  RUBY
+
+  remove_file "app/controllers/passwords_controller.rb"
+
+  file "app/controllers/passwords_controller.rb", <<~RUBY
+    class PasswordsController < ApplicationController
+      allow_unauthenticated_access
+
+      before_action :set_user_by_token,
+                    only: %i[edit update]
+
+      rate_limit to: 10,
+                 within: 3.minutes,
+                 only: :create,
+                 with: -> {
+                   redirect_to new_password_path,
+                               alert: "Try again later."
+                 }
+
+      layout "rails_den/application"
+
+      def new
+        render "rails_den/passwords/new"
+      end
+
+      def create
+        email_address = password_reset_params[:email_address]
+
+        if user = User.find_by(email_address: email_address)
+          PasswordsMailer.reset(user).deliver_later
+        end
+
+        redirect_to new_session_path,
+                    notice: "Password reset instructions sent (if user with that email address exists)."
+      end
+
+      def edit
+        render "rails_den/passwords/edit"
+      end
+
+      def update
+        if @user.update(password_params)
+          @user.sessions.destroy_all
+
+          redirect_to new_session_path,
+                      notice: "Password has been reset."
+        else
+          redirect_to edit_password_path(params[:token]),
+                      alert: "Passwords did not match."
+        end
+      end
+
+      private
+
+      def password_reset_params
+        params.require(:password_reset).permit(
+          :email_address
+        )
+      end
+
+      def password_params
+        params.require(:password).permit(
+          :password,
+          :password_confirmation
+        )
+      end
+
+      def set_user_by_token
+        @user = User.find_by_password_reset_token!(
+          params[:token]
+        )
+      rescue ActiveSupport::MessageVerifier::InvalidSignature
+        redirect_to new_password_path,
+                    alert: "Password reset link is invalid or has expired."
+      end
+    end
+  RUBY
+
+  remove_file "app/mailers/passwords_mailer.rb"
+
+  file "app/mailers/passwords_mailer.rb", <<~RUBY
+    class PasswordsMailer < ApplicationMailer
+      def reset(user)
+        @user = user
+
+        mail(
+          subject: "Reset your password",
+          to: user.email_address,
+          template_path: "rails_den/passwords_mailer",
+          template_name: "reset"
+        )
+      end
+    end
+  RUBY
+
+  remove_file "app/views/sessions/new.html.erb"
+  remove_file "app/views/passwords/new.html.erb"
+  remove_file "app/views/passwords/edit.html.erb"
+  remove_file "app/views/passwords_mailer/reset.html.erb"
+  remove_file "app/views/passwords_mailer/reset.text.erb"
+
+  rails_den_stylesheet =
+    File.join(
+      rails_den_source,
+      "app/assets/stylesheets/rails_den/application.css"
+    )
+
+  file(
+    "app/assets/stylesheets/rails_den/application.css",
+    File.read(rails_den_stylesheet)
+  )
+
+  route <<~RUBY
+    root to: redirect("/rails_den")
+
+    resource :registration, only: %i[new create edit update]
+
+    mount RailsDen::Engine => "/rails_den"
+  RUBY
+
+  initializer "rails_den.rb", <<~RUBY
+    RailsDen.configure do |config|
+      config.community_name = "RailsDen"
+      config.user_class = "User"
+      config.user_display_name_method = :username
+      config.user_mention_name_method = :username
+
+      config.user_mention_resolver = ->(normalized_name) {
+        User.find_by(username: normalized_name)
+      }
+
+      config.user_mention_candidates_resolver = ->(prefix, limit) {
+        escaped_prefix = ActiveRecord::Base.sanitize_sql_like(prefix)
+
+        User.where("username LIKE ?", "\#{escaped_prefix}%")
+            .order(:username)
+            .limit(limit)
+      }
+
+      config.current_user_resolver = -> {
+        if respond_to?(:authenticated?, true)
+          authenticated? ? Current.user : nil
+        elsif (session_id = cookies.signed[:session_id])
+          Session.find_by(id: session_id)&.user
+        end
+      }
+
+      config.authentication_handler = -> {
+        session[:return_to_after_authenticating] = request.url
+        redirect_to main_app.new_session_path
+      }
+
+      config.presence_redis_url = "redis://127.0.0.1:6379/0"
+
+      config.parent_controller = "RailsDenController"
+    end
+  RUBY
+
+  dockerfile_path = "Dockerfile"
+  dockerfile = File.read(dockerfile_path)
+
+  base_packages =
+    "apt-get install --no-install-recommends -y curl libjemalloc2 libvips postgresql-client"
+
+  unless dockerfile.include?(base_packages)
+    raise "RailsDen standalone generation failed because the generated Dockerfile base package list was not recognized."
+  end
+
+  dockerfile.sub!(base_packages) do
+    "#{base_packages} redis-server"
+  end
+
+  default_command =
+    'CMD ["./bin/thrust", "./bin/rails", "server"]'
+
+  unless dockerfile.include?(default_command)
+    raise "RailsDen standalone generation failed because the generated Dockerfile server command was not recognized."
+  end
+
+  dockerfile.sub!(default_command) do
+    'CMD ["sh", "-c", "redis-server --bind 127.0.0.1 --protected-mode yes --save \'\' --appendonly no --daemonize no --dir /tmp & exec ./bin/thrust ./bin/rails server"]'
+  end
+
+  File.write(dockerfile_path, dockerfile)
+
+  app_name =
+    File.basename(destination_root)
+      .downcase
+      .gsub(/[^a-z0-9_]/, "_")
+
+  database_role = app_name
+  database_password = SecureRandom.base64(36).tr("/+", "AZ")
+
+  production_databases = [
+    "#{app_name}_production",
+    "#{app_name}_production_cache",
+    "#{app_name}_production_queue",
+    "#{app_name}_production_cable"
+  ]
+
+  password_file =
+    File.join(destination_root, "config", "rails_den_database_password")
+
+  File.write(password_file, "#{database_password}\n")
+  File.chmod(0o600, password_file)
+
+  append_file ".gitignore", <<~TEXT
+
+    # RailsDen production database password
+    /config/rails_den_database_password
+  TEXT
+
+  database_yml = File.read("config/database.yml")
+
+  unless database_yml.include?("    host: 127.0.0.1\n")
+    database_yml.sub!(
+      "  primary: &primary_production\n    <<: *default\n",
+      "  primary: &primary_production\n    <<: *default\n    host: 127.0.0.1\n"
+    )
+  end
+
+  environment_variable =
+    "#{app_name.upcase}_DATABASE_PASSWORD"
+
+  database_yml.gsub!(
+    %(<%= ENV["#{environment_variable}"] %>),
+    %(<%= File.read(Rails.root.join("config/rails_den_database_password")).strip %>)
+  )
+
+  File.write("config/database.yml", database_yml)
+
+  escaped_role =
+    database_role.gsub("'", "''")
+
+  escaped_password =
+    database_password.gsub("'", "''")
+
+  role_sql = <<~SQL
+    DO
+    $do$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT FROM pg_catalog.pg_roles
+        WHERE rolname = '#{escaped_role}'
+      ) THEN
+        CREATE ROLE "#{database_role}"
+          LOGIN
+          PASSWORD '#{escaped_password}';
+      ELSE
+        ALTER ROLE "#{database_role}"
+          WITH LOGIN
+          PASSWORD '#{escaped_password}';
+      END IF;
+    END
+    $do$;
+  SQL
+
+  unless system(
+    "sudo",
+    "-u",
+    "postgres",
+    "psql",
+    "-v",
+    "ON_ERROR_STOP=1",
+    "-d",
+    "postgres",
+    "-c",
+    role_sql
+  )
+    raise "RailsDen standalone generation failed while creating the PostgreSQL production role."
+  end
+
+  production_databases.each do |database|
+    database_exists =
+      system(
+        "sudo",
+        "-u",
+        "postgres",
+        "psql",
+        "-d",
+        "postgres",
+        "-tAc",
+        "SELECT 1 FROM pg_database WHERE datname='#{database}'"
+      )
+
+    unless database_exists
+      raise "RailsDen standalone generation failed while checking PostgreSQL database #{database}."
+    end
+
+    existing_database =
+      `sudo -u postgres psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname='#{database}'"`.strip
+
+    if existing_database != "1"
+      unless system(
+        "sudo",
+        "-u",
+        "postgres",
+        "createdb",
+        "--owner=#{database_role}",
+        database
+      )
+        raise "RailsDen standalone generation failed while creating PostgreSQL database #{database}."
+      end
+    end
+  end
+
+  unless system("bin/rails", "active_storage:install")
+    raise "RailsDen standalone generation failed while installing Active Storage."
+  end
+
+  unless system("bin/rails", "rails_den:install:migrations")
+    raise "RailsDen standalone generation failed while installing RailsDen migrations."
+  end
+
+  unless system(
+    { "RAILS_ENV" => "production" },
+    "bin/rails",
+    "db:prepare"
+  )
+    raise "RailsDen standalone generation failed while preparing the production databases."
+  end
+
+  unless system(
+    {
+      "RAILS_ENV" => "production",
+      "SECRET_KEY_BASE_DUMMY" => "1"
+    },
+    "bin/rails",
+    "assets:precompile"
+  )
+    raise "RailsDen standalone generation failed while precompiling production assets."
+  end
+
+  unless system(
+    {
+      "RAILS_ENV" => "production",
+      "SECRET_KEY_BASE_DUMMY" => "1"
+    },
+    "bin/rails",
+    "runner",
+    "abort 'RailsDen production boot failed' unless Rails.env.production?"
+  )
+    raise "RailsDen standalone generation failed while verifying the production application."
+  end
+
+  say
+  say "============================================================"
+  say
+  say "RailsDen production application is ready!"
+  say
+  say "PostgreSQL role:"
+  say
+  say "    #{database_role}"
+  say
+  say "Production databases:"
+  production_databases.each do |database|
+    say
+    say "    #{database}"
+  end
+  say
+  say "RailsDen has:"
+  say
+  say "    created the PostgreSQL application role"
+  say "    created the production databases"
+  say "    migrated the production databases"
+  say "    precompiled production assets"
+  say "    successfully booted Rails in production"
+  say
+  say "The database password is stored in:"
+  say
+  say "    config/rails_den_database_password"
+  say
+  say "The password file is mode 0600 and excluded from Git."
+  say
+  say "Users sign in with their email address and are publicly"
+  say "identified by username."
+  say
+  say "The first registered user becomes a RailsDen administrator."
+  say
+  say "Start RailsDen in production with:"
+  say
+  say "    RAILS_ENV=production bin/rails server"
+  say
+  say "CONFIGURATION"
+  say
+  say "RailsDen's main configuration file is:"
+  say
+  say "    config/initializers/rails_den.rb"
+  say
+  say "RailsDen is mounted in:"
+  say
+  say "    config/routes.rb"
+  say
+  say "The generated application mounts RailsDen at /rails_den."
+  say
+  say "CUSTOMIZATION"
+  say
+  say "RailsDen's authentication views are built in and already active."
+  say "You do NOT need to install them unless you want to customize them."
+  say
+  say "To copy the RailsDen views into this application, run:"
+  say
+  say "    rails_den install:views"
+  say
+  say "The copied files will appear under app/views and override"
+  say "RailsDen's packaged defaults."
+  say
+  say "RailsDen's stylesheet has been copied to:"
+  say
+  say "    app/assets/stylesheets/rails_den/application.css"
+  say
+  say "Edit that file to customize the appearance of your community."
+  say
+  say "MIGRATING FROM DISCOURSE?"
+  say
+  say "1. Create and download an official Discourse backup."
+  say
+  say "2. From this RailsDen application directory, run:"
+  say
+  say "    bin/rails rails_den:import:discourse /path/to/discourse-backup.tar.gz"
+  say
+  say "The Discourse importer requires PostgreSQL."
+  say "Imported users must reset their password before first sign-in."
+  say
+  say "============================================================"
+  say
+end