rockstart 0.1.0 → 0.1.1

data/lib/generators/rockstart/quality/rubocop/USAGE

@@ -0,0 +1,11 @@
+Description:
+    Installs rubocop with configured rules
+
+Example:
+    rails generate rockstart:quality:rubocop
+
+    This will create:
+        Installs rubocop
+        Adds a rake task for controlling rubocop
+        Generates a default configuration file
+        Builds a rubocop_todo.yml file based off any current violations

data/lib/generators/rockstart/quality/rubocop/rubocop_generator.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require "rockstart/generators/system_helpers"
+module Rockstart::Quality
+  class RubocopGenerator < Rails::Generators::Base
+    include Rockstart::Generators::SystemHelpers
+
+    source_root File.expand_path("templates", __dir__)
+
+    def add_default_configuration
+      copy_file "rubocop.yml", ".rubocop.yml"
+    end
+
+    def add_rake_task
+      copy_file "rubocop.rake", "lib/tasks/rubocop.rake"
+    end
+
+    # Rebuild .rubocop_todo.yml, ensuring only existing code is excluded
+    def build_rubocop_todo
+      system! "bundle exec rake rubocop:auto_gen_config"
+    end
+  end
+end

data/lib/generators/rockstart/quality/rubocop/templates/rubocop.rake

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+begin
+  require "rubocop/rake_task"
+  RuboCop::RakeTask.new
+rescue LoadError
+  raise "Please install the rubocop-rails gem!!!" unless Rails.env.production?
+end
+
+namespace :rubocop do
+  desc "Rebuild rubocop_todo.yml"
+  task :auto_gen_config do
+    require "rubocop"
+
+    cli = RuboCop::CLI.new
+    result = cli.run(["--auto-gen-config", "--exclude-limit", "100"])
+    abort("RuboCop failed!") if result.nonzero?
+  end
+end

data/lib/generators/rockstart/rockstart_generator.rb

@@ -1,77 +1,25 @@
 # frozen_string_literal: true
 
-class RockstartGenerator < Rails::Generators::Base
-  desc "The quickest way for getting Rails Ready to Rock!"
-
-  class_option :devise, type: :boolean,
-                        desc: "Include Devise support",
-                        default: true
-
-  class_option :postgres, type: :boolean,
-                          desc: "Include Postgres support",
-                          default: Rockstart::Env.postgres_db?
-
-  class_option :pundit, type: :boolean,
-                        desc: "Include Pundit support",
-                        default: true
-
-  def generate_logging
-    generate "rockstart:logging"
-  end
-
-  def generate_rspec
-    generate "rockstart:rspec"
-  end
-
-  def generate_postgres
-    return unless options[:postgres]
-
-    generate "rockstart:postgres"
-  end
-
-  def generate_smtp_mailer
-    generate "rockstart:smtp_mailer"
-  end
+require "rockstart/generators/class_option_helpers"
+require "rockstart/generators/content_security_options"
 
-  def generate_scaffold_templates
-    generate "rockstart:scaffold_templates", devise_option, pundit_option
-  end
-
-  def generate_devise
-    return unless options[:devise]
-
-    generate "rockstart:devise", pundit_option
-  end
-
-  def generate_pundit
-    return unless options[:pundit]
-
-    generate "rockstart:pundit"
-  end
-
-  def generate_security
-    generate "rockstart:security"
-  end
-
-  def generate_docker
-    generate "rockstart:docker", postgres_option, devise_option
-  end
+class RockstartGenerator < Rails::Generators::Base
+  include Rockstart::Generators::ClassOptionHelpers
+  include Rockstart::Generators::ContentSecurityOptions
 
-  def generate_quality
-    generate "rockstart:quality"
-  end
+  desc "The quickest way for getting Rails Ready to Rock!"
 
-  private
+  all_class_options
 
-  def devise_option
-    options[:devise] ? "--devise" : "--no-devise"
+  def add_rebuid_script
+    generate "rockstart:development:rebuild", *all_class_options, *content_security_options
   end
 
-  def postgres_option
-    options[:postgres] ? "--postgres" : "--no-postgres"
+  def install_all_gems
+    generate "rockstart:gemset", *all_class_options, *content_security_options
   end
 
-  def pundit_option
-    options[:pundit] ? "--pundit" : "--no-pundit"
+  def run_rockstart_generators
+    generate "rockstart:run", *all_class_options, *content_security_options
   end
 end

data/lib/generators/rockstart/run/USAGE

@@ -0,0 +1,17 @@
+Description:
+    Runs all rockstart generators without installing gems
+
+Example:
+    rails generate rockstart:run
+
+    This will run the core rockstart generators:
+        rockstart:development
+        rockstart:testing
+        rockstart:storage
+        rockstart:mailers
+        rockstart:frontend_app
+        rockstart:authorization
+        rockstart:monitoring
+        rockstart:security
+        rockstart:deployment
+        rockstart:quality

data/lib/generators/rockstart/run/run_generator.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "rockstart/generators/class_option_helpers"
+require "rockstart/generators/content_security_options"
+
+class Rockstart::RunGenerator < Rails::Generators::Base
+  include Rockstart::Generators::ClassOptionHelpers
+  include Rockstart::Generators::ContentSecurityOptions
+
+  all_class_options
+
+  def setup_development_environment
+    generate "rockstart:development",
+             auth0_option,
+             devise_option,
+             postgres_option,
+             pundit_option
+  end
+
+  def generate_testing
+    generate "rockstart:testing", auth0_option, devise_option
+  end
+
+  def generate_storage
+    generate "rockstart:storage", memcached_option, postgres_option
+  end
+
+  def generate_mailers
+    generate "rockstart:mailers"
+  end
+
+  def generate_workers
+    generate "rockstart:workers", devise_option, sidekiq_option
+  end
+
+  def generate_frontend_app
+    return unless frontend?
+
+    generate "rockstart:frontend_app"
+  end
+
+  def generate_authorization
+    generate "rockstart:authorization", auth0_option, devise_option, pundit_option
+  end
+
+  def generate_monitoring
+    generate "rockstart:monitoring",
+             auth0_option,
+             devise_option,
+             memcached_option,
+             rollbar_option,
+             sidekiq_option
+  end
+
+  def generate_security
+    generate "rockstart:security", devise_option, rollbar_option, *content_security_options
+  end
+
+  def generate_deployment
+    generate "rockstart:deployment",
+             auth0_option,
+             devise_option,
+             frontend_option,
+             memcached_option,
+             postgres_option,
+             rollbar_option,
+             sidekiq_option
+  end
+
+  def generate_quality
+    generate "rockstart:quality"
+  end
+end

data/lib/generators/rockstart/security/brakeman/USAGE

@@ -0,0 +1,9 @@
+Description:
+    Installs Brakeman for monitoring potential exploits
+
+Example:
+    rails generate rockstart:security:brakeman Thing
+
+    This will create:
+        The brakeman gem
+        A rake task for generating a brakeman report

data/lib/generators/rockstart/security/brakeman/brakeman_generator.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Rockstart::Security
+  class BrakemanGenerator < Rails::Generators::Base
+    source_root File.expand_path("templates", __dir__)
+
+    def add_rake_tasks
+      copy_file "brakeman.rake", "lib/tasks/brakeman.rake"
+    end
+
+    def add_output_to_gitignore
+      append_to_file ".gitignore", "brakeman\n"
+    end
+  end
+end

data/lib/generators/rockstart/security/{templates → brakeman/templates}/brakeman.rake

@@ -2,5 +2,5 @@
 
 desc "Run brakeman check on your codebase"
 task :brakeman do
-  system "bundle exec brakeman -w 2 -o brakeman"
+  system("bundle exec brakeman -w 2 -o brakeman") || abort("brakeman failed!!!")
 end

data/lib/generators/rockstart/security/bundler_audit/USAGE

@@ -0,0 +1,8 @@
+Description:
+    Adds bundler-audit for detecting gems with exploits
+
+Example:
+    rails generate rockstart:security:bundler_audit
+
+    This will create:
+        Adds a bundle:audit rake task

data/lib/generators/rockstart/security/bundler_audit/bundler_audit_generator.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Rockstart::Security
+  class BundlerAuditGenerator < Rails::Generators::Base
+    source_root File.expand_path("templates", __dir__)
+
+    def add_rake_task
+      copy_file "bundler_audit.rake", "lib/tasks/bundler_audit.rake"
+    end
+  end
+end

data/lib/generators/rockstart/security/bundler_audit/templates/bundler_audit.rake

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+namespace :bundle do
+  task :audit do
+    require "bundler/audit/cli"
+
+    IGNORE_LIST = [
+      "CVE-2015-9284" # Using POST for OAuth
+    ].freeze
+
+    Bundler::Audit::CLI.start ["update"]
+    Bundler::Audit::CLI.start ["check", "--ignore", IGNORE_LIST.join(",")]
+  end
+end

data/lib/generators/rockstart/security/content_security/USAGE

@@ -0,0 +1,8 @@
+Description:
+    Explain the generator
+
+Example:
+    rails generate content_security Thing
+
+    This will create:
+        what/will/it/create

data/lib/generators/rockstart/security/content_security/content_security_generator.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require "rockstart/generators/class_option_helpers"
+require "rockstart/generators/content_security_options"
+require "rockstart/generators/template_helpers"
+
+module Rockstart::Security
+  class ContentSecurityGenerator < Rails::Generators::Base
+    include Rockstart::Generators::ClassOptionHelpers
+    include Rockstart::Generators::ContentSecurityOptions
+    include Rockstart::Generators::TemplateHelpers
+
+    source_root File.expand_path("templates", __dir__)
+
+    class_option :session_name, type: :string,
+                                desc: "Name used for Rails Sessions",
+                                default: Rockstart::Env.default_session_name
+
+    rollbar_class_option
+
+    def add_initializer
+      initializer_template "content_security_policy"
+    end
+
+    def configure_session_store
+      initializer_template "session_store"
+    end
+
+    def add_csp_violations_controller
+      template "csp_violations_controller.rb.tt", "app/controllers/csp_violations_controller.rb"
+      route "resources :csp_violations, only: [:create]"
+      template "content_security_spec.rb.tt", "spec/requests/content_security_spec.rb"
+    end
+
+    private
+
+    def session_name
+      options[:session_name]
+    end
+  end
+end

data/lib/generators/rockstart/security/{templates → content_security/templates}/content_security_policy_initializer.rb.tt

@@ -14,7 +14,7 @@ csp_script_sources = <%= script_hosts.inspect %>
 csp_style_sources = <%= style_hosts.inspect %>
 
 # Allow the asset host to serve assets
-if (asset_host = Rails.application.config.action_controller.asset_host.presence)
+if (asset_host = ENV["ASSET_HOST"].presence)
   csp_font_sources.append(asset_host)
   csp_image_sources.append(asset_host)
   csp_script_sources.append(asset_host)
@@ -31,7 +31,7 @@ Rails.application.config.content_security_policy do |policy|
   policy.default_src :none
   policy.connect_src :self, *csp_connect_sources
   policy.font_src    :self, *csp_font_sources
-  policy.img_src     :self, :data, *csp_image_sources
+  policy.img_src     :self, :data, :https, *csp_image_sources
   policy.object_src  :none
   policy.script_src  :self, *csp_script_sources
   policy.style_src   :self, *csp_style_sources

data/lib/generators/rockstart/security/{templates → content_security/templates}/content_security_spec.rb.tt

@@ -6,18 +6,17 @@ RSpec.describe "ContentSecurity", type: :request do
   describe "HTTP Headers" do
     context "after sign in" do
       before do
-        user = create(:user)
-        post user_session_path params: { user: { email: user.email, password: user.password } }
+        sign_in create(:user)
       end
 
       it "includes all expected secure headers", :aggregate_failures do
+        get url_for_user_dashboard
+
         # Cookies
         session_cookie = cookies.get_cookie("<%= session_name %>")
         expect(session_cookie).to be_http_only
         expect(session_cookie.to_h["SameSite"]).to eq("Lax")
 
-        follow_redirect!
-
         # Security Headers
         expect(response.headers["X-Frame-Options"]).to eq "SAMEORIGIN"
         expect(response.headers["X-XSS-Protection"]).to eq "1; mode=block"
@@ -28,15 +27,15 @@ RSpec.describe "ContentSecurity", type: :request do
 
         # Content Security Policy
         content_security_policy = response.headers["Content-Security-Policy"]
-        expect(content_security_policy).to have_content("default-src 'none'")
-        expect(content_security_policy).to have_content("connect-src 'self'")
-        expect(content_security_policy).to have_content("font-src 'self'<% if font_hosts.any? %> <%= font_hosts.join(' ') %><% end %>")
-        expect(content_security_policy).to have_content("img-src 'self' data:<% if image_hosts.any? %> <%= image_hosts.join(' ') %><% end %>")
-        expect(content_security_policy).to have_content("object-src 'none'")
-        expect(content_security_policy).to have_content("script-src 'self'<% if script_hosts.any? %> <%= script_hosts.join(' ') %><% end %>")
-        expect(content_security_policy).to have_content("style-src 'self'<% if style_hosts.any? %> <%= style_hosts.join(' ') %><% end %>")
-        expect(content_security_policy).to have_content("block-all-mixed-content")
-        expect(content_security_policy).to have_content("upgrade-insecure-requests")
+        expect(content_security_policy).to have_content("default-src 'none';")
+        expect(content_security_policy).to have_content("connect-src 'self';")
+        expect(content_security_policy).to have_content("font-src 'self'<% if font_hosts.any? %> <%= font_hosts.join(' ') %><% end %>;")
+        expect(content_security_policy).to have_content("img-src 'self' data: https:<% if image_hosts.any? %> <%= image_hosts.join(' ') %><% end %>;")
+        expect(content_security_policy).to have_content("object-src 'none';")
+        expect(content_security_policy).to have_content("script-src 'self'<% if script_hosts.any? %> <%= script_hosts.join(' ') %><% end %>;")
+        expect(content_security_policy).to have_content("style-src 'self'<% if style_hosts.any? %> <%= style_hosts.join(' ') %><% end %>;")
+        expect(content_security_policy).to have_content("block-all-mixed-content;")
+        expect(content_security_policy).to have_content("upgrade-insecure-requests;")
         expect(content_security_policy).to have_content("report-uri /csp_violations")
 
         # Content Security Policy should not require any unsafe exceptions

data/lib/generators/rockstart/security/{templates/csp_violations_controller.rb → content_security/templates/csp_violations_controller.rb.tt}

@@ -10,19 +10,29 @@ class CspViolationsController < ApplicationController
       report = report_base["csp-report"]
       message = build_content_security_message(report)
 
-      # Post message using Lograge formatter
-      Rails.logger.error(message.to_json)
+      log_csp_report_violation(message)
+<% if rollbar? -%>
+      Rollbar.warning("csp-violation", message) unless ENV["ROLLBAR_ACCESS_TOKEN"].blank?
+<% end -%>
     end
     head :ok
   end
 
   private
 
+  def log_csp_report_violation(message)
+    # Post message using Lograge format
+    Rails.logger.warn message.merge(
+      "@timestamp" => ::Time.now.utc,
+      type: "csp-report",
+      request_id: request.request_id,
+      user_agent: request.headers["User-Agent"]
+    ).to_json
+  end
+
   # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
   def build_content_security_message(report)
     {
-      "@timestamp" => ::Time.now.utc,
-      type: "csp-report",
       blocked_uri: report["blocked-uri"].try(:downcase),
       disposition: report["disposition"].try(:downcase),
       document_uri: report["document-uri"],
@@ -30,8 +40,6 @@ class CspViolationsController < ApplicationController
       violated_directive: report["violated-directive"].try(:downcase),
       referrer: report["referrer"].try(:downcase),
       status_code: (report["status-code"].presence || 0).to_i,
-      request_id: request.request_id,
-      user_agent: request.headers["User-Agent"],
       raw_report: report
     }
   end