rails_webhook_outbox 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 72234fe9faabd82b982170783792dd9d50188b8a727b72f46ab30e5f8d36929a
-  data.tar.gz: bf7c3b453aaf3c66d1ce4a06fb2a72d169dfcae330cc3ba8819dbe75de020e67
+  metadata.gz: b4c853b16c9d48f970ebe2ccb83c7de3e1d6789d93a9e78407f788b6a5f8dd8d
+  data.tar.gz: a9a380da628a0f00c0d6d5ac08d2351edbc1e0fc3084b4d73ce6dab7e1f28c44
 SHA512:
-  metadata.gz: 6363ae17aa5037b3c58e8169d97c7bb6c997f5e8e515a963aa5964f9aba9ffe29c4e09805f1bcd69e69f569e7887b2e1f7c69119c93c25f8004258809ab6581e
-  data.tar.gz: 7009433848a306ff1465d73d526a9378230ca7730fa7a9bcc4aa3159091bdaab663f442e2124ff3b6507a9fb63adb65bda814607a3d56fb297ffc04b5018cc25
+  metadata.gz: 452c56fedabd11ecd4a9388af0fa7de18b4988c60585c4b567a2b28d9657ee5226ba3b492bcab0752cc29be2d843e2c329092c32391e52311e85dfd460c24f85
+  data.tar.gz: e464b60386edada571d92ad803f0c074e2b152fb4438b63d4e843b1833ff0d65686074a8fe0cc62d3817b50241d28aebc068d47605443be5cc4c6e5a5defa657

data/README.md

@@ -23,12 +23,14 @@ A Rails engine for sending outgoing webhooks with HMAC signing, ActiveJob-based
 - [HMAC Signing](#hmac-signing)
 - [Secret Rotation](#secret-rotation)
 - [Circuit Breaker](#circuit-breaker)
+- [Dashboard](#dashboard)
 - [Rake Tasks](#rake-tasks)
 - [Usage](#usage)
 - [Manual Dispatch](#manual-dispatch)
 - [Testing](#testing)
 - [Development](#development)
   - [Dummy App](#dummy-app)
+- [Upgrading](#upgrading)
 - [Contributing](#contributing)
 - [License](#license)
 
@@ -46,13 +48,16 @@ And then execute:
 $ bundle install
 ```
 
-Run the install generator:
+Run the install generator, then migrate:
 
 ```bash
 $ rails generate rails_webhook_outbox:install
 $ rails db:migrate
 ```
 
+The generator creates `config/initializers/rails_webhook_outbox.rb`. It does not copy any migrations:
+the engine adds its own to your app's migration paths, so `rails db:migrate` creates the tables.
+
 ## Configuration
 
 ```ruby
@@ -73,6 +78,7 @@ RailsWebhookOutbox.configure do |config|
   config.max_payload_size   = 65_536  # bytes; set to nil or 0 to disable
   config.secret_rotation_grace_period = 24.hours
   config.circuit_breaker_threshold = 10  # consecutive permanent failures before auto-disabling; nil or 0 disables
+  config.dashboard_enabled = true        # enable the mountable dashboard UI; defaults to true in development
 end
 ```
 
@@ -136,6 +142,23 @@ RailsWebhookOutbox::Delivery.delivered   # successfully delivered
 RailsWebhookOutbox::Delivery.failed      # exhausted all retries
 ```
 
+Every HTTP attempt is also recorded as a `RailsWebhookOutbox::DeliveryAttempt`, so earlier failures
+are kept after a retry succeeds (the delivery itself only stores the latest response):
+
+```ruby
+delivery.delivery_attempts.each do |attempt|
+  attempt.attempt_number  # => 1, 2, 3, ...
+  attempt.outcome         # => "failed" or "delivered"
+  attempt.response_code   # => 503
+  attempt.response_body   # => truncated to 1000 characters
+  attempt.duration_ms     # => 182
+  attempt.created_at
+end
+```
+
+Attempts are deleted with their delivery, including by `webhook_outbox:cleanup`. Upgrading from a
+version before 0.4.0 requires a migration — see [Upgrading](#upgrading).
+
 [Back to top](#table-of-contents)
 
 ## Async Delivery
@@ -351,6 +374,37 @@ single subsequent failure won't instantly re-trip the breaker.
 
 [Back to top](#table-of-contents)
 
+## Dashboard
+
+Mount the engine to get a browser dashboard for managing subscriptions and browsing deliveries:
+
+```ruby
+# config/routes.rb
+mount RailsWebhookOutbox::Engine => "/admin/webhooks"
+```
+
+The dashboard is gated by `config.dashboard_enabled` (default: `true` in development, `false`
+elsewhere) — set it explicitly to control access, and put the mount behind your own
+authentication/authorization in `routes.rb` (e.g. `constraints AdminConstraint.new do ... end`) since
+the engine itself has no concept of users.
+
+Pages:
+
+| Page | Purpose |
+|------|---------|
+| `/` | Overview — subscription/delivery counts, recent failures |
+| `/subscriptions` | List, create, and edit subscriptions; enable/disable with one click |
+| `/subscriptions/:id` | Detail — masked signing secret with reveal/copy, rotate-secret button |
+| `/deliveries` | Filterable delivery log (status, event, date range) with live status updates via Turbo Streams |
+| `/deliveries/:id` | Detail — attempt timeline, payload, response, and a manual retry button for failed deliveries |
+| `/events` | Registered events with subscriber counts and a recent payload example |
+
+The UI ships its own assets (CSS inlined, JS via importmap) and follows the system light/dark color
+scheme automatically — no asset pipeline configuration is required beyond what a standard Rails 7+
+app already has.
+
+[Back to top](#table-of-contents)
+
 ## Rake Tasks
 
 ```bash
@@ -534,6 +588,16 @@ RailsWebhookOutbox::Subscription.first.update!(url: "https://webhook.site/your-i
 
 [Back to top](#table-of-contents)
 
+## Upgrading
+
+Some releases need action from you, such as a database migration. Read [UPGRADING.md](UPGRADING.md)
+before updating the gem, and check the **BREAKING** entries in the [CHANGELOG](CHANGELOG.md).
+
+**0.4.0 requires a new table** (`webhook_outbox_delivery_attempts`): run `bin/rails db:migrate`
+before deploying. See [Upgrading to 0.4.0](UPGRADING.md#upgrading-to-040).
+
+[Back to top](#table-of-contents)
+
 ## Contributing
 
 Bug reports and pull requests are welcome on [GitHub](https://github.com/eclectic-coding/rails_webhook_outbox).

data/Rakefile

@@ -13,4 +13,9 @@ RuboCop::RakeTask.new(:lint)
 Bundler::Audit::Task.new
 RSpec::Core::RakeTask.new(:spec)
 
-task default: [:lint, :'bundle:audit:update', 'bundle:audit:check', :spec]
+desc "Run Brakeman static security analysis"
+task :brakeman do
+  sh "bundle exec brakeman -q --no-pager --force-scan --skip-files spec/ ."
+end
+
+task default: [:lint, :'bundle:audit:update', 'bundle:audit:check', :brakeman, :spec]

data/UPGRADING.md

@@ -0,0 +1,92 @@
+# Upgrading
+
+Notes for upgrades that need action from you, newest version first. For everything that changed in a
+release, see the [CHANGELOG](CHANGELOG.md).
+
+## Upgrading to 0.4.0
+
+**This release has a breaking change: it requires a new database table.** Run the migration _before_
+the 0.4.0 code starts processing deliveries.
+
+### What changed
+
+`DeliveryJob` now records every HTTP attempt as a `RailsWebhookOutbox::DeliveryAttempt` in the new
+`webhook_outbox_delivery_attempts` table. This is the data behind the delivery timeline in the
+dashboard. Previously only the latest response was kept on the delivery itself.
+
+### Steps
+
+1. Update the gem:
+
+   ```bash
+   bundle update rails_webhook_outbox
+   ```
+
+2. Run the migration. The engine adds its migrations to your app's migration paths, so there is
+   nothing to copy:
+
+   ```bash
+   bin/rails db:migrate
+   ```
+
+3. Confirm it ran:
+
+   ```bash
+   bin/rails db:migrate:status | grep delivery_attempts
+   # up     20261027000001  Create webhook outbox delivery attempts
+   ```
+
+In a deploy pipeline, run `db:migrate` before the new code starts serving requests or running jobs
+(the usual release-phase step on most hosts).
+
+### If you ran the install generator on an earlier version
+
+Before 0.4.0, `rails generate rails_webhook_outbox:install` also copied the engine's table migrations
+into your app's `db/migrate`. The engine adds those same migrations to your app on its own, so with
+the copies present `db:migrate` fails:
+
+```
+ActiveRecord::DuplicateMigrationNameError: Multiple migrations have the name CreateWebhookOutboxSubscriptions.
+```
+
+To fix it, delete the copies and migrate. The engine's migrations now skip tables, columns, and
+indexes that already exist, so they are safe to run against a database the copies already built:
+
+```bash
+rm db/migrate/*_create_webhook_outbox_subscriptions.rb \
+   db/migrate/*_create_webhook_outbox_deliveries.rb
+bin/rails db:migrate
+```
+
+Commit the deletions. `db:migrate:status` will keep listing the old copied versions as `NO FILE`;
+that is harmless. The run also adds anything the copies lacked, such as the unique index on
+`idempotency_key`, and creates the new `webhook_outbox_delivery_attempts` table.
+
+### If you deploy the code without migrating
+
+`DeliveryJob` sends the HTTP request first and records the attempt afterwards. Without the table,
+recording the attempt raises `ActiveRecord::StatementInvalid`, so:
+
+- the webhook **is still sent** to the subscriber, but the delivery is left `pending` with
+  `attempts: 0`, and the engine's `DeliveryError` retry does not apply to this error;
+- every job fails the same way until the migration is run.
+
+Run `db:migrate`, then re-enqueue the stuck deliveries:
+
+```ruby
+RailsWebhookOutbox::Delivery.pending.find_each { |d| RailsWebhookOutbox::DeliveryJob.perform_later(d) }
+```
+
+The subscriber will receive those webhooks a second time. It can deduplicate them with the
+`X-Webhook-Delivery` header, which is stable across attempts. (`webhook_outbox:retry_failed` does not
+help here: it only re-enqueues `failed` deliveries.)
+
+### Existing data
+
+Deliveries created before the upgrade have no attempt history; it starts with the first attempt made
+after the migration. Nothing is backfilled.
+
+### Downgrading
+
+Downgrading the gem back to 0.3.0 is safe without rolling the migration back: 0.3.0 never reads the
+table, and the foreign key cascades on delete, so `webhook_outbox:cleanup` keeps working.

data/app/assets/stylesheets/rails_webhook_outbox/_01_base.css

@@ -0,0 +1,53 @@
+*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+
+:root {
+  --bg:            #f8f9fa;
+  --surface:       #ffffff;
+  --border:        #dee2e6;
+  --text:          #212529;
+  --muted:         #6c757d;
+  --accent:        #4f46e5;
+  --accent-text:   #ffffff;
+  --danger:        #dc3545;
+  --success-bg:    #d1e7dd;
+  --success-text:  #0f5132;
+  --warning-bg:    #fff3cd;
+  --warning-text:  #664d03;
+  --danger-bg:     #f8d7da;
+  --danger-text:   #842029;
+  --radius:        6px;
+  --shadow:        0 1px 3px rgba(0,0,0,.08);
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg:            #16181d;
+    --surface:       #1f2229;
+    --border:        #333844;
+    --text:          #e9ecef;
+    --muted:         #9aa1ac;
+    --accent:        #7c7ff2;
+    --accent-text:   #ffffff;
+    --danger:        #e25563;
+    --success-bg:    #10321f;
+    --success-text:  #7fe0a4;
+    --warning-bg:    #3a2f0b;
+    --warning-text:  #f0c96b;
+    --danger-bg:     #3a1216;
+    --danger-text:   #f0949c;
+    --shadow:        0 1px 3px rgba(0,0,0,.4);
+  }
+}
+
+body {
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+  font-size: 14px;
+  line-height: 1.5;
+  color: var(--text);
+  background: var(--bg);
+}
+
+a { color: var(--accent); }
+
+.rwo-monospace { font-family: ui-monospace, "SFMono-Regular", Menlo, monospace; font-size: 12px; }
+.rwo-muted     { color: var(--muted); font-size: 12px; }

data/app/assets/stylesheets/rails_webhook_outbox/_02_layout.css

@@ -0,0 +1,88 @@
+.rwo-nav {
+  display: flex;
+  gap: 1.5rem;
+  padding: 1rem 2rem;
+  background: var(--surface);
+  border-bottom: 1px solid var(--border);
+}
+
+.rwo-nav-link {
+  color: var(--text);
+  text-decoration: none;
+  font-weight: 600;
+}
+
+.rwo-nav-link:hover { color: var(--accent); }
+
+.rwo-main { padding: 2rem; max-width: 1100px; margin: 0 auto; }
+
+.rwo-header { margin-bottom: 1.5rem; }
+
+.rwo-header-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  margin-bottom: 1rem;
+}
+
+.rwo-section-title { margin: 1.5rem 0 0.75rem; font-size: 16px; }
+
+.rwo-back { display: inline-block; margin-bottom: 1rem; font-size: 13px; }
+
+.rwo-empty { color: var(--muted); padding: 1rem 0; }
+
+.rwo-stats-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
+  gap: 1rem;
+  margin-bottom: 2rem;
+}
+
+.rwo-stat {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow);
+  padding: 1rem;
+}
+
+.rwo-stat-label { color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: .04em; }
+.rwo-stat-value { font-size: 28px; font-weight: 700; }
+
+.rwo-detail {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow);
+  padding: 1rem;
+  margin-bottom: 1rem;
+}
+
+.rwo-detail-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
+  gap: 1rem;
+}
+
+.rwo-detail-label { color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: .04em; }
+.rwo-detail-value { font-size: 15px; }
+
+.rwo-code-block {
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 1rem;
+  overflow-x: auto;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+
+.rwo-event {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow);
+  padding: 1rem;
+  margin-bottom: 1rem;
+}

data/app/assets/stylesheets/rails_webhook_outbox/_03_table.css

@@ -0,0 +1,26 @@
+.rwo-table {
+  width: 100%;
+  border-collapse: collapse;
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  overflow: hidden;
+}
+
+.rwo-table th, .rwo-table td {
+  text-align: left;
+  padding: 0.6rem 0.75rem;
+  border-bottom: 1px solid var(--border);
+}
+
+.rwo-table th { font-size: 12px; text-transform: uppercase; letter-spacing: .04em; color: var(--muted); }
+
+.rwo-table tbody tr:last-child td { border-bottom: none; }
+
+.rwo-path { font-weight: 600; }
+
+.rwo-pagination {
+  display: flex;
+  justify-content: space-between;
+  margin-top: 1rem;
+}

data/app/assets/stylesheets/rails_webhook_outbox/_04_badges.css

@@ -0,0 +1,19 @@
+.rwo-badge {
+  display: inline-block;
+  padding: 0.2rem 0.6rem;
+  border-radius: 999px;
+  font-size: 12px;
+  font-weight: 600;
+}
+
+.rwo-badge--delivered { background: var(--success-bg); color: var(--success-text); }
+.rwo-badge--pending    { background: var(--warning-bg); color: var(--warning-text); }
+.rwo-badge--failed     { background: var(--danger-bg);  color: var(--danger-text); }
+
+.rwo-alert {
+  background: var(--danger-bg);
+  color: var(--danger-text);
+  border-radius: var(--radius);
+  padding: 0.75rem 1rem;
+  margin-bottom: 1rem;
+}

data/app/assets/stylesheets/rails_webhook_outbox/_05_forms.css

@@ -0,0 +1,42 @@
+.rwo-form { max-width: 480px; }
+
+.rwo-field { margin-bottom: 1rem; }
+
+.rwo-field label { display: block; font-size: 12px; text-transform: uppercase; letter-spacing: .04em; color: var(--muted); margin-bottom: 0.3rem; }
+
+.rwo-input, .rwo-select {
+  width: 100%;
+  padding: 0.5rem 0.6rem;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  background: var(--surface);
+  color: var(--text);
+  font-size: 14px;
+}
+
+.rwo-checkbox-group { display: flex; flex-direction: column; gap: 0.4rem; }
+.rwo-checkbox-label { display: flex; align-items: center; gap: 0.4rem; font-weight: 400; text-transform: none; letter-spacing: normal; }
+
+.rwo-btn, .rwo-btn-small, .rwo-btn-danger, .rwo-btn-reset {
+  display: inline-block;
+  border: none;
+  border-radius: var(--radius);
+  cursor: pointer;
+  font-size: 14px;
+  font-weight: 600;
+  text-decoration: none;
+}
+
+.rwo-btn { background: var(--accent); color: var(--accent-text); padding: 0.55rem 1rem; }
+.rwo-btn-small { background: var(--surface); color: var(--text); border: 1px solid var(--border); padding: 0.35rem 0.7rem; font-size: 12px; }
+.rwo-btn-danger { background: var(--danger); color: #fff; padding: 0.55rem 1rem; }
+.rwo-btn-reset { background: transparent; color: var(--muted); padding: 0.55rem 0.75rem; }
+
+.rwo-secret {
+  display: flex;
+  align-items: center;
+  gap: 0.6rem;
+  margin-bottom: 0.5rem;
+}
+
+.rwo-secret-display { font-size: 14px; }

data/app/assets/stylesheets/rails_webhook_outbox/_06_filters.css

@@ -0,0 +1,13 @@
+.rwo-filters {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: end;
+  gap: 1rem;
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 1rem;
+  margin-bottom: 1.5rem;
+}
+
+.rwo-filters .rwo-field { margin-bottom: 0; min-width: 140px; }

data/app/assets/stylesheets/rails_webhook_outbox/_07_timeline.css

@@ -0,0 +1,31 @@
+.rwo-timeline {
+  list-style: none;
+  margin-left: 6px;
+  border-left: 2px solid var(--border);
+}
+
+.rwo-timeline-item {
+  position: relative;
+  padding: 0 0 1rem 1.25rem;
+}
+
+.rwo-timeline-item::before {
+  content: "";
+  position: absolute;
+  left: -7px;
+  top: 4px;
+  width: 12px;
+  height: 12px;
+  border-radius: 50%;
+  border: 2px solid var(--bg);
+  background: var(--muted);
+}
+
+.rwo-timeline-item--delivered::before { background: var(--success-text); }
+.rwo-timeline-item--failed::before    { background: var(--danger); }
+.rwo-timeline-item--scheduled::before { background: var(--warning-text); }
+
+.rwo-timeline-title { font-weight: 600; }
+
+.rwo-timeline-response { margin-top: 0.25rem; }
+.rwo-timeline-response summary { cursor: pointer; }

data/app/controllers/rails_webhook_outbox/base_controller.rb

@@ -0,0 +1,15 @@
+module RailsWebhookOutbox
+  class BaseController < ActionController::Base
+    protect_from_forgery with: :exception
+    layout "rails_webhook_outbox/application"
+    helper RailsWebhookOutbox::ApplicationHelper
+
+    before_action :check_dashboard_enabled
+
+    private
+
+      def check_dashboard_enabled
+        head :forbidden unless RailsWebhookOutbox.config.dashboard_enabled
+      end
+  end
+end

data/app/controllers/rails_webhook_outbox/deliveries_controller.rb

@@ -0,0 +1,46 @@
+module RailsWebhookOutbox
+  class DeliveriesController < BaseController
+    PER_PAGE = 50
+
+    def index
+      @status = params[:status] if Delivery.statuses.key?(params[:status])
+      @event = params[:event] if RailsWebhookOutbox.config.events.include?(params[:event])
+      @from = parse_date(params[:from])
+      @to = parse_date(params[:to])
+      @page = params[:page].to_i
+      @page = 1 if @page < 1
+
+      deliveries = Delivery.order(created_at: :desc)
+      deliveries = deliveries.where(status: @status) if @status
+      deliveries = deliveries.where(event: @event) if @event
+      deliveries = deliveries.where(created_at: @from..) if @from
+      deliveries = deliveries.where(created_at: ..@to.end_of_day) if @to
+
+      @total_count = deliveries.count
+      @deliveries = deliveries.limit(PER_PAGE).offset((@page - 1) * PER_PAGE)
+    end
+
+    def show
+      @delivery = Delivery.find(params[:id])
+    end
+
+    def retry
+      @delivery = Delivery.find(params[:id])
+      @delivery.update!(status: :pending, next_retry_at: nil)
+      DeliveryJob.perform_later(@delivery)
+
+      respond_to do |format|
+        format.turbo_stream
+        format.html { redirect_to delivery_path(@delivery) }
+      end
+    end
+
+    private
+
+      def parse_date(value)
+        Date.parse(value) if value.present?
+      rescue ArgumentError
+        nil
+      end
+  end
+end

data/app/controllers/rails_webhook_outbox/events_controller.rb

@@ -0,0 +1,13 @@
+module RailsWebhookOutbox
+  class EventsController < BaseController
+    def index
+      @events = RailsWebhookOutbox.config.events.map do |event|
+        {
+          name: event,
+          subscriber_count: Subscription.active.select { |s| s.subscribes_to?(event) }.size,
+          example: Delivery.where(event: event).order(created_at: :desc).first&.payload
+        }
+      end
+    end
+  end
+end

data/app/controllers/rails_webhook_outbox/overview_controller.rb

@@ -0,0 +1,7 @@
+module RailsWebhookOutbox
+  class OverviewController < BaseController
+    def show
+      @overview = Overview.new
+    end
+  end
+end

data/app/controllers/rails_webhook_outbox/subscriptions_controller.rb

@@ -0,0 +1,62 @@
+module RailsWebhookOutbox
+  class SubscriptionsController < BaseController
+    def index
+      @subscriptions = Subscription.order(created_at: :desc)
+    end
+
+    def show
+      @subscription = Subscription.find(params[:id])
+    end
+
+    def new
+      @subscription = Subscription.new
+    end
+
+    def create
+      @subscription = Subscription.new(subscription_params)
+
+      if @subscription.save
+        redirect_to subscription_path(@subscription)
+      else
+        render :new, status: 422
+      end
+    end
+
+    def edit
+      @subscription = Subscription.find(params[:id])
+    end
+
+    def update
+      @subscription = Subscription.find(params[:id])
+
+      if @subscription.update(subscription_params)
+        redirect_to subscription_path(@subscription)
+      else
+        render :edit, status: 422
+      end
+    end
+
+    def rotate_secret
+      @subscription = Subscription.find(params[:id])
+      @subscription.rotate_secret!
+      redirect_to subscription_path(@subscription)
+    rescue RailsWebhookOutbox::SecretRotationError
+      redirect_to subscription_path(@subscription, rotation_error: true)
+    end
+
+    private
+
+      def subscription_params
+        permitted = params.require(:subscription).permit(:url, :description, :active, events: [])
+        raw_events = params[:subscription][:events]
+
+        if raw_events.is_a?(String)
+          permitted[:events] = raw_events.split(",").map(&:strip).reject(&:empty?)
+        elsif permitted.key?(:events)
+          permitted[:events] = Array(permitted[:events]).map(&:to_s).map(&:strip).reject(&:empty?)
+        end
+
+        permitted
+      end
+  end
+end