rails_nexus 2.1.0 → 2.1.2

data/app/controllers/rails_nexus/database_health_controller.rb

@@ -2,8 +2,6 @@
 
 module RailsNexus
   class DatabaseHealthController < ApplicationController
-    before_action :verify_access
-
     def index
       @period = params[:period]&.to_i || 7
       @period = [@period, 1].max
@@ -21,14 +19,6 @@ module RailsNexus
 
     private
 
-    def verify_access
-      config = RailsNexus.configuration
-      return if config.auth_block.nil?
-      unless config.auth_block&.call(self)
-        render plain: "Forbidden", status: :forbidden
-      end
-    end
-
     def collect_pool_by_error(time_range)
       # Get all errors with system_health data in the time range
       exceptions = LoggedException.where(created_at: time_range)

data/app/controllers/rails_nexus/logged_exceptions_controller.rb

@@ -2,8 +2,6 @@
 
 module RailsNexus
   class LoggedExceptionsController < ApplicationController
-    before_action :rails_nexus_require_auth!
-
     RANSACK_FILTERS = %i[
       action_name_cont assigned_to_cont controller_name_cont created_at_gteq created_at_lteq
       exception_class_cont fingerprint_cont message_cont

data/app/controllers/rails_nexus/n1_patterns_controller.rb

@@ -1,7 +1,5 @@
 module RailsNexus
   class N1PatternsController < ApplicationController
-    before_action :rails_nexus_require_auth!
-
     def index
       @patterns = RailsNexus::LoggedException.n_plus_one_patterns(limit: 50)
       @summary = RailsNexus::LoggedException.n_plus_one_summary

data/app/controllers/rails_nexus/settings_controller.rb

@@ -2,8 +2,6 @@
 
 module RailsNexus
   class SettingsController < ApplicationController
-    before_action :verify_access
-
     def index
       @webhooks = RailsNexus.configuration.webhooks || []
       @webhook_headers = RailsNexus.configuration.webhook_headers || {}
@@ -43,14 +41,6 @@ module RailsNexus
 
     private
 
-    def verify_access
-      config = RailsNexus.configuration
-      return if config.auth_block.nil?
-      unless config.auth_block&.call(self)
-        render plain: "Forbidden", status: :forbidden
-      end
-    end
-
     def build_test_payload
       {
         event: "webhook.test",
@@ -66,35 +56,7 @@ module RailsNexus
     end
 
     def deliver_test_webhook(url, payload)
-      require "net/http"
-      require "uri"
-      require "json"
-
-      uri = URI(url)
-      http = Net::HTTP.new(uri.host, uri.port)
-      http.use_ssl = uri.scheme == "https"
-      http.open_timeout = 10
-      http.read_timeout = 10
-
-      request = Net::HTTP::Post.new(uri)
-      request["Content-Type"] = "application/json"
-      request.body = payload.to_json
-
-      start_time = Time.now
-      response = http.request(request)
-      duration = Time.now - start_time
-
-      {
-        success: response.is_a?(Net::HTTPSuccess),
-        status_code: response.code,
-        body: response.body&.truncate(500),
-        duration: duration.round(3)
-      }
-    rescue StandardError => e
-      {
-        success: false,
-        error: e.message
-      }
+      RailsNexus::WebhookClient.deliver(url: url, payload: payload, timeout: 10)
     end
   end
 end

data/app/controllers/rails_nexus/source_code_controller.rb

@@ -7,27 +7,23 @@ module RailsNexus
     # GET /rails_nexus/source_code?file=...&line=...
     def show
       file_path = params[:file]
-      line_number = params[:line]&.to_i
+      line_number = Integer(params[:line], exception: false)
 
-      if file_path.blank? || line_number.blank?
+      if file_path.blank? || !line_number&.positive?
         render json: { error: "file and line parameters required" }, status: :bad_request
         return
       end
 
-      # Security: only allow reading files within Rails.root
-      begin
-        real_path = File.realpath(file_path)
-        unless real_path.start_with?(Rails.root.to_s)
-          render json: { error: "Access denied" }, status: :forbidden
-          return
-        end
-      rescue Errno::ENOENT
-        render json: { error: "File not found" }, status: :not_found
+      resolved_path = resolve_source_path(file_path)
+      unless resolved_path
+        render json: { error: "File not found or access denied" }, status: :not_found
         return
       end
 
-      source = read_source_snippet(file_path, line_number, context_lines: params[:context]&.to_i || 5)
-      blame = git_blame_for_line(file_path, line_number)
+      requested_context = Integer(params[:context], exception: false) || 5
+      context_lines = requested_context.clamp(0, 50)
+      source = read_source_snippet(resolved_path, line_number, context_lines: context_lines)
+      blame = git_blame_for_line(resolved_path, line_number)
 
       if source
         render json: { source: source, blame: blame }

data/app/controllers/rails_nexus/stats_controller.rb

@@ -2,8 +2,6 @@
 
 module RailsNexus
   class StatsController < ApplicationController
-    before_action :verify_access
-
     def index
       @system_stats = collect_system_stats
       @ruby_stats = collect_ruby_stats
@@ -19,14 +17,6 @@ module RailsNexus
 
     private
 
-    def verify_access
-      config = RailsNexus.configuration
-      return if config.auth_block.nil?
-      unless config.auth_block&.call(self)
-        render plain: "Forbidden", status: :forbidden
-      end
-    end
-
     def collect_system_stats
       stats = {}
 
@@ -83,7 +73,7 @@ module RailsNexus
         process_stats[:thread_count] = "N/A"
       end
       begin
-        process_stats[:open_files] = `ls /proc/#{pid}/fd 2>/dev/null | wc -l`.strip.to_i
+        process_stats[:open_files] = Dir.children("/proc/#{pid}/fd").size
       rescue StandardError
         process_stats[:open_files] = 0
       end
@@ -133,13 +123,14 @@ module RailsNexus
         }
       else
         # Fallback: use `df` command
-        df_output = `df -h / 2>/dev/null`.split("\n").last&.split
+        stdout, _stderr, status = Open3.capture3("df", "-h", "/")
+        df_output = status.success? ? stdout.lines.last&.split : nil
         if df_output
           {
             total_gb: df_output[1],
             used_gb: df_output[2],
             available_gb: df_output[3],
-            usage_percent: df_output[4]&.to_i || 0
+            usage_percent: df_output[4].to_i
           }
         else
           { total_gb: "N/A", used_gb: "N/A", available_gb: "N/A", usage_percent: 0 }
@@ -201,11 +192,7 @@ module RailsNexus
       stats[:pool_available] = pool.available? ? pool.connections.size : 0
 
       # Database version
-      begin
-        stats[:version] = ActiveRecord::Base.connection.select_value("SELECT version()")
-      rescue StandardError
-        stats[:version] = "N/A"
-      end
+      stats[:version] = RailsNexus::DatabaseAdapter.database_version
 
       # Table stats (rails_nexus tables)
       stats[:tables] = collect_table_stats
@@ -308,24 +295,24 @@ module RailsNexus
       end
 
       # Check for pg_dump (PostgreSQL)
-      if system("which pg_dump > /dev/null 2>&1")
+      if (version = executable_version("pg_dump"))
         stats[:detected] = true
         stats[:gem] ||= "pg_dump"
-        stats[:details][:pg_dump] = `pg_dump --version 2>/dev/null`.strip
+        stats[:details][:pg_dump] = version
       end
 
       # Check for mysqldump (MySQL)
-      if system("which mysqldump > /dev/null 2>&1")
+      if (version = executable_version("mysqldump"))
         stats[:detected] = true
         stats[:gem] ||= "mysqldump"
-        stats[:details][:mysqldump] = `mysqldump --version 2>/dev/null`.strip
+        stats[:details][:mysqldump] = version
       end
 
       # Check for AWS CLI (RDS backups)
-      if system("which aws > /dev/null 2>&1")
+      if (version = executable_version("aws"))
         stats[:detected] = true
         stats[:gem] ||= "aws-cli"
-        stats[:details][:aws_cli] = `aws --version 2>/dev/null`.strip
+        stats[:details][:aws_cli] = version
 
         # Check for RDS snapshots if configured
         begin
@@ -339,16 +326,16 @@ module RailsNexus
       end
 
       # Check for docker backup solutions
-      if File.exist?("/var/lib/docker")
+      if File.exist?("/var/lib/docker") && (version = executable_version("docker"))
         stats[:detected] = true
         stats[:gem] ||= "docker"
-        stats[:details][:docker] = `docker --version 2>/dev/null`.strip
+        stats[:details][:docker] = version
       end
 
       # Check for crontab entries related to backups
       begin
-        crontab = `crontab -l 2>/dev/null`
-        if crontab.include?("backup") || crontab.include?("dump")
+        crontab, _stderr, status = Open3.capture3("crontab", "-l")
+        if status.success? && (crontab.include?("backup") || crontab.include?("dump"))
           stats[:details][:crontab_backup] = true
           stats[:status] = "scheduled" if stats[:status] == "unknown"
         end
@@ -391,11 +378,13 @@ module RailsNexus
         begin
           next unless ActiveRecord::Base.connection.table_exists?(table_name)
 
-          count = ActiveRecord::Base.connection.select_value("SELECT COUNT(*) FROM #{table_name}")
+          quoted_table = ActiveRecord::Base.connection.quote_table_name(table_name)
+          count = ActiveRecord::Base.connection.select_value("SELECT COUNT(*) FROM #{quoted_table}").to_i
           tables << {
             name: table_name,
             row_count: count,
-            size_mb: 0,
+            size_mb: nil,
+            size_supported: false,
             status: count > 0 ? "active" : "empty"
           }
         rescue StandardError
@@ -415,7 +404,7 @@ module RailsNexus
           SQL
           result.each do |row|
             table = tables.find { |t| t[:name] == row["table_name"] }
-            table[:size_mb] = row["size_mb"] if table
+            table&.merge!(size_mb: row["size_mb"].to_f, size_supported: true)
           end
         elsif adapter.include?("postgresql")
           result = ActiveRecord::Base.connection.execute(<<~SQL)
@@ -427,7 +416,7 @@ module RailsNexus
           SQL
           result.each do |row|
             table = tables.find { |t| t[:name] == row["table_name"] }
-            table[:size_mb] = (row["size_bytes"].to_f / 1024 / 1024).round(2) if table
+            table&.merge!(size_mb: (row["size_bytes"].to_f / 1024 / 1024).round(2), size_supported: true)
           end
         end
       rescue StandardError
@@ -437,6 +426,20 @@ module RailsNexus
       tables
     end
 
+    def executable_version(name)
+      executable = ENV.fetch("PATH", "").split(File::PATH_SEPARATOR)
+        .map { |directory| File.join(directory, name) }
+        .find { |path| File.file?(path) && File.executable?(path) }
+      return nil unless executable
+
+      stdout, stderr, status = Open3.capture3(executable, "--version")
+      return nil unless status.success?
+
+      [stdout, stderr].find(&:present?)&.lines&.first&.strip
+    rescue Errno::ENOENT, Errno::EACCES
+      nil
+    end
+
     def collect_platform_stats
       {
         breakdown: LoggedException.platform_stats,
@@ -476,17 +479,14 @@ module RailsNexus
     end
 
     def process_uptime
-      start_time = File.read("/proc/#{Process.pid}/stat").split[21].to_i rescue nil
-      if start_time
-        uptime_seconds = Time.now.to_i - (Process.clock_gettime(Process::CLOCK_MONOTONIC).to_i - start_time)
-        seconds = Time.now.to_i - start_time
-        days = seconds / 86400
-        hours = (seconds % 86400) / 3600
-        minutes = (seconds % 3600) / 60
-        "#{days}d #{hours}h #{minutes}m"
-      else
-        "N/A"
-      end
+      stdout, _stderr, status = Open3.capture3("ps", "-o", "etimes=", "-p", Process.pid.to_s)
+      return "N/A" unless status.success?
+
+      seconds = stdout.to_i
+      days = seconds / 86_400
+      hours = (seconds % 86_400) / 3600
+      minutes = (seconds % 3600) / 60
+      "#{days}d #{hours}h #{minutes}m"
     rescue StandardError
       "N/A"
     end

data/app/helpers/rails_nexus/logged_exceptions_helper.rb

@@ -2,6 +2,7 @@
 
 module RailsNexus
   module LoggedExceptionsHelper
+    include SourceCodeHelper
     def pretty_exception_date(exception)
       if RailsNexus.configuration.date_format
         return exception.created_at.strftime(RailsNexus.configuration.date_format)
@@ -186,58 +187,12 @@ module RailsNexus
 
     # Read source code snippet around a file:line
     def read_source_snippet(file_path, line_number, context: 5)
-      return nil unless file_path.present? && line_number.present?
-      return nil unless File.exist?(file_path)
-
-      lines = File.readlines(file_path)
-      start_line = [line_number - context, 0].max
-      end_line = [line_number + context, lines.length - 1].min
-
-      snippet_lines = (start_line..end_line).map do |i|
-        {
-          number: i + 1,
-          content: lines[i]&.rstrip,
-          highlighted: (i + 1) == line_number
-        }
-      end
-
-      { lines: snippet_lines, start: start_line + 1, end: end_line + 1 }
-    rescue StandardError
-      nil
+      super(file_path, line_number, context_lines: context)
     end
 
     # Get git blame for a file:line range
-    def git_blame_for_line(file_path, line_number, context: 2)
-      return nil unless file_path.present? && line_number.present?
-      return nil unless File.exist?(file_path)
-
-      start_line = [line_number - context, 1].max
-      end_line = line_number + context
-
-      result = `git blame -L #{start_line},#{end_line} --porcelain #{file_path} 2>/dev/null`
-      return nil unless $?.success?
-
-      blame_data = {}
-      current_sha = nil
-
-      result.each_line do |line|
-        if line =~ /^([0-9a-f]{40})\s+(\d+)\s+(\d+)/
-          current_sha = $1
-          line_num = $2.to_i
-          blame_data[line_num] = { sha: current_sha&.slice(0, 7) } if line_num == line_number
-        elsif line =~ /^author\s+(.+)/
-          blame_data.each_value { |v| v[:author] = $1.strip if v[:sha] == current_sha&.slice(0, 7) && v[:author].nil? }
-        elsif line =~ /^author-time\s+(\d+)/
-          time = Time.at($1.to_i)
-          blame_data.each_value { |v| v[:date] = time.strftime("%Y-%m-%d") if v[:sha] == current_sha&.slice(0, 7) && v[:date].nil? }
-        elsif line =~ /^summary\s+(.+)/
-          blame_data.each_value { |v| v[:message] = $1.strip if v[:sha] == current_sha&.slice(0, 7) && v[:message].nil? }
-        end
-      end
-
-      blame_data[line_number]
-    rescue StandardError
-      nil
+    def git_blame_for_line(file_path, line_number, **_options)
+      super(file_path, line_number)
     end
 
     # Parse backtrace line into file path and line number

data/app/helpers/rails_nexus/source_code_helper.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require "open3"
+require "pathname"
+
 module RailsNexus
   module SourceCodeHelper
     # Parse a backtrace line into components
@@ -20,16 +23,22 @@ module RailsNexus
     # Read source code snippet around a specific line
     # Returns { lines: Array, file: String, from_line: Integer, to_line: Integer, error_line: Integer }
     def read_source_snippet(file_path, error_line, context_lines: 5)
-      return nil unless file_path.present? && File.exist?(file_path)
+      resolved_path = resolve_source_path(file_path)
+      return nil unless resolved_path
+
+      error_line = Integer(error_line, exception: false)
+      return nil unless error_line&.positive?
+
+      context_lines = (Integer(context_lines, exception: false) || 5).clamp(0, 50)
 
-      total_lines = File.foreach(file_path).count
+      total_lines = File.foreach(resolved_path).count
       from_line = [error_line - context_lines, 1].max
       to_line = [error_line + context_lines, total_lines].min
 
       lines = []
       current_line = 0
 
-      File.foreach(file_path) do |raw_line|
+      File.foreach(resolved_path) do |raw_line|
         current_line += 1
         break if current_line > to_line
         next if current_line < from_line
@@ -43,7 +52,7 @@ module RailsNexus
 
       {
         lines: lines,
-        file: file_path,
+        file: resolved_path,
         from_line: from_line,
         to_line: to_line,
         error_line: error_line
@@ -53,13 +62,23 @@ module RailsNexus
     # Get git blame for a specific line
     # Returns { sha: String, author: String, date: String, message: String }
     def git_blame_for_line(file_path, line_number)
-      return nil unless file_path.present? && line_number.present?
-      return nil unless File.exist?(file_path)
-      return nil unless system("git", "rev-parse", "--git-dir", File.dirname(file_path), [:out, :err] => File::NULL)
+      resolved_path = resolve_source_path(file_path)
+      line_number = Integer(line_number, exception: false)
+      return nil unless resolved_path && line_number&.positive?
+
+      directory = File.dirname(resolved_path)
+      repository_root, _stderr, status = Open3.capture3("git", "-C", directory, "rev-parse", "--show-toplevel")
+      return nil unless status.success?
+
+      repository_root = Pathname.new(repository_root.strip).realpath
+      relative_path = Pathname.new(resolved_path).relative_path_from(repository_root).to_s
+      return nil if relative_path == ".." || relative_path.start_with?("../")
 
       # Get blame for single line
-      blame_output = `git -C "#{File.dirname(file_path)}" blame -L #{line_number},#{line_number} -p "#{File.basename(file_path)}" 2>/dev/null`
-      return nil unless $?.success?
+      blame_output, _stderr, status = Open3.capture3(
+        "git", "-C", repository_root.to_s, "blame", "-L", "#{line_number},#{line_number}", "--porcelain", "--", relative_path
+      )
+      return nil unless status.success?
 
       # Parse porcelain blame output
       result = {}
@@ -80,6 +99,8 @@ module RailsNexus
       end
 
       result.presence
+    rescue ArgumentError, Errno::ENOENT, Errno::EACCES
+      nil
     end
 
     # Get source code with git blame for multiple backtrace lines
@@ -99,9 +120,27 @@ module RailsNexus
           parsed: parsed,
           source: source,
           blame: blame,
-          is_app_code: parsed[:file]&.start_with?(Rails.root.to_s)
+          is_app_code: resolve_source_path(parsed[:file]).present?
         }
       end
     end
+
+    # Resolve a path and ensure its canonical location is a regular file inside Rails.root.
+    def resolve_source_path(file_path)
+      return nil if file_path.blank?
+
+      root = Pathname.new(Rails.root).realpath
+      candidate = Pathname.new(file_path.to_s)
+      candidate = root.join(candidate) unless candidate.absolute?
+      resolved = candidate.realpath
+      relative = resolved.relative_path_from(root).to_s
+
+      return nil if relative == ".." || relative.start_with?("../")
+      return nil unless resolved.file?
+
+      resolved.to_s
+    rescue ArgumentError, Errno::ENOENT, Errno::EACCES
+      nil
+    end
   end
 end

data/app/javascript/rails_nexus/application.js

@@ -1,4 +1,3 @@
-import "@hotwired/turbo-rails"
 import { Application } from "@hotwired/stimulus"
 
 import RailsNexusController from "rails_nexus/controllers/rails_nexus"
@@ -6,8 +5,19 @@ import RailsNexusDetailController from "rails_nexus/controllers/rails_nexus_deta
 import RailsNexusSidebarController from "rails_nexus/controllers/rails_nexus_sidebar"
 import RailsNexusThemeController from "rails_nexus/controllers/rails_nexus_theme"
 
-// Keep the engine independent from the host application's Stimulus setup.
-const application = Application.start()
+async function ensureTurbo() {
+  if (window.Turbo) return
+
+  const module = await import("@hotwired/turbo-rails")
+  window.Turbo = module.Turbo
+}
+
+// Reuse an explicitly exposed host Stimulus application when possible. If the
+// host keeps it module-local, create one namespaced engine application only.
+const application = window.Stimulus?.register
+  ? window.Stimulus
+  : (window.RailsNexusStimulus ||= Application.start())
+
 application.debug = false
 
 // Register engine controllers
@@ -15,3 +25,5 @@ application.register("rails_nexus", RailsNexusController)
 application.register("rails_nexus-theme", RailsNexusThemeController)
 application.register("rails_nexus-sidebar", RailsNexusSidebarController)
 application.register("rails_nexus-detail", RailsNexusDetailController)
+
+ensureTurbo()

data/app/models/rails_nexus/backup_config.rb

@@ -26,6 +26,10 @@ module RailsNexus
     attribute :split_chunks,       :boolean, default: false
 
     validates :name, presence: true, uniqueness: true
+    validates :name, format: {
+      with: /\A[a-zA-Z0-9_$][a-zA-Z0-9_$.-]*\z/,
+      message: "may contain only letters, numbers, dots, underscores, dollar signs, and hyphens"
+    }
     validates :database_name, presence: true, if: -> { adapter != "redis" }
     validates :adapter, presence: true, inclusion: { in: ADAPTERS }
     validates :storage_path, presence: true
@@ -38,6 +42,11 @@ module RailsNexus
     validates :s3_secret_key, presence: true, if: :s3_enabled?
     validates :gpg_password, presence: true, if: :gpg_enabled?
     validates :email_to, presence: true, if: :email_notify?
+    validates :port, :rsync_port,
+      numericality: { only_integer: true, greater_than: 0, less_than_or_equal_to: 65_535 },
+      allow_nil: true
+    validate :database_identifier_is_safe
+    validate :remote_sync_values_are_safe
 
     scope :enabled,  -> { where(enabled: true) }
     scope :disabled, -> { where(enabled: false) }
@@ -139,6 +148,28 @@ module RailsNexus
 
     private
 
+    def database_identifier_is_safe
+      return if database_name.blank? || sqlite?
+
+      unless database_name.match?(/\A[a-zA-Z0-9_$][a-zA-Z0-9_$.-]*\z/) && !database_name.include?("..")
+        errors.add(:database_name, "contains unsupported characters")
+      end
+    end
+
+    def remote_sync_values_are_safe
+      return unless rsync_enabled?
+
+      unless rsync_host.to_s.match?(/\A[a-zA-Z0-9](?:[a-zA-Z0-9.-]*[a-zA-Z0-9])?\z/)
+        errors.add(:rsync_host, "is not a valid hostname")
+      end
+      unless rsync_user.to_s.match?(/\A[a-zA-Z0-9_][a-zA-Z0-9_.-]*\z/)
+        errors.add(:rsync_user, "contains unsupported characters")
+      end
+      unless rsync_path.to_s.start_with?("/") && !rsync_path.to_s.match?(/[\0\r\n]/)
+        errors.add(:rsync_path, "must be an absolute remote path")
+      end
+    end
+
     def dump_extension
       parts = ["sql"]
       parts << "gz" if compress? && !bzip2_compress?