ruby_cms 0.2.1.0 → 1.0.0

data/lib/generators/ruby_cms/templates/models/permittable.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Permittable
+  extend ActiveSupport::Concern
+
+  included do
+    before_destroy :ruby_cms_prevent_last_admin_deletion
+  end
+
+  # Block deleting the last administrator (would lock everyone out). No-op during
+  # bootstrap (before any Permission exists) where every user counts as admin.
+  def ruby_cms_prevent_last_admin_deletion
+    return if bootstrap?
+    return unless admin?
+    return if UserPermission.joins(:permission)
+                            .where(permissions: { key: "manage_admin" })
+                            .where.not(user_id: id).exists?
+
+    errors.add(:base, "Kan de laatste beheerder niet verwijderen.")
+    throw :abort
+  end
+
+  # Check if the user has a permission. record: reserved for future record-scoped permissions.
+  # Default-deny: unknown permission key = forbidden. Permission lookups are cached per-request.
+  def can?(permission_key, record: nil)
+    return bootstrap_allowed?(permission_key) if bootstrap?
+
+    k = permission_key.to_s
+    return false unless known_permission_keys.include?(k)
+
+    cms_permission_keys_cached.include?(k) ||
+      record&.can_edit?(self)
+  end
+
+  def bootstrap?
+    return @bootstrap_mode unless @bootstrap_mode.nil?
+
+    @bootstrap_mode = !Permission.exists?
+  end
+
+  # Default admin check: before any Permission exists the first user bootstraps as
+  # admin; afterwards admin = holds the manage_admin permission. Host apps may
+  # override this method on their User model.
+  def admin?
+    return true if bootstrap?
+
+    cms_permission_keys_cached.include?("manage_admin")
+  end
+
+  # Set of all permission keys that exist in the DB. Cached per-request so a
+  # page that calls `can?` 50 times only hits SQL once.
+  def known_permission_keys
+    @known_permission_keys ||= Permission.pluck(:key).to_set
+  end
+
+  def bootstrap_allowed?(permission_key)
+    return false unless Rails.application.config.ruby_cms.bootstrap_admin_with_role
+    return false unless respond_to?(:admin?) && admin?
+
+    permission_key.to_s == "manage_admin"
+  end
+
+  # Per-request cache of this user's permission keys. Never rely on client-side checks.
+  def cms_permission_keys_cached
+    @cms_permission_keys_cached ||=
+      UserPermission.where(user: self)
+                    .joins(:permission).pluck("permissions.key")
+  end
+end

data/lib/generators/ruby_cms/templates/models/preference.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+# Stores configuration preferences for the CMS admin interface.
+# Preferences are key-value pairs with optional type casting.
+class Preference < ApplicationRecord
+  self.table_name = "preferences"
+
+  VALUE_TYPES = %w[string integer boolean json].freeze
+
+  validates :key, presence: true, uniqueness: true
+  validates :value_type, inclusion: { in: VALUE_TYPES }
+
+  def self.get(key, default: nil)
+    pref = find_by(key: key.to_s)
+    return default if pref.nil?
+
+    pref.typed_value
+  end
+
+  def self.set(key, value)
+    pref = find_or_initialize_by(key: key.to_s)
+    pref.assign_value(value)
+    pref.save!
+    pref.typed_value
+  end
+
+  def self.all_as_hash
+    all.to_h { |pref| [ pref.key.to_sym, pref.typed_value ] }
+  end
+
+  def self.ensure_defaults!
+    defaults.each do |key, config|
+      next if exists?(key: key.to_s)
+
+      create!(
+        key: key.to_s,
+        value: serialize_seed_value(config[:value], config[:type]),
+        value_type: config[:type],
+        description: config[:description],
+        category: config[:category] || "general"
+      )
+    end
+  end
+
+  def self.by_category
+    all.group_by(&:category)
+  end
+
+  def self.defaults
+    RubyCms::SettingsRegistry.defaults_hash
+  end
+
+  def typed_value
+    case value_type
+    when "integer" then value.to_i
+    when "boolean" then boolean_cast(value)
+    when "json" then parse_json_value(value)
+    else value
+    end
+  rescue JSON::ParserError, TypeError
+    value.to_s
+  end
+
+  def assign_value(new_value)
+    self.value_type ||= detect_type(new_value)
+    self.value = serialize_value(new_value)
+  end
+
+  class << self
+    private
+
+    def serialize_seed_value(val, type)
+      case type.to_s
+      when "json"
+        val.to_json
+      when "boolean"
+        ActiveModel::Type::Boolean.new.cast(val).to_s
+      else
+        val.to_s
+      end
+    end
+  end
+
+  private
+
+  def boolean_cast(val)
+    ActiveModel::Type::Boolean.new.cast(val)
+  end
+
+  def parse_json_value(val)
+    JSON.parse(val.to_s)
+  end
+
+  def detect_type(val)
+    case val
+    when Integer then "integer"
+    when TrueClass, FalseClass then "boolean"
+    when Hash, Array then "json"
+    else "string"
+    end
+  end
+
+  def serialize_value(val)
+    case val
+    when Hash, Array then val.to_json
+    else val.to_s
+    end
+  end
+end

data/lib/generators/ruby_cms/templates/models/redirect.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+# Redirect rules served by RedirectMiddleware.
+#
+# - source_path is normalized (downcased, trailing slash stripped) so we never
+#   miss a hit because of casing or a trailing "/".
+# - target_path is optional only for 410 (Gone) rules.
+# - lookup is cached in Rails.cache for the request hot path; create/update/
+#   destroy bust the entire `redirect:*` namespace via expire_cache.
+class Redirect < ApplicationRecord
+  include Discard::Model
+  include Ransackable
+  include PgSearch::Model
+  ransack_attrs :source_path, :target_path, :status_code, :enabled, :hits, :last_hit_at, :note, :created_at, :discarded_at
+
+  STATUS_CODES = [ 301, 302, 410 ].freeze
+
+  before_validation :normalize_source_path
+
+  validates :source_path, presence: true, uniqueness: { case_sensitive: false }
+  validate  :source_path_shape
+  validates :status_code, presence: true, inclusion: { in: STATUS_CODES }
+  validates :target_path, presence: true, unless: :gone?
+
+  after_save :expire_cache
+  after_destroy :expire_cache
+
+  pg_search_scope :search,
+    against: { source_path: "A", target_path: "B", note: "C" },
+    using: { tsearch: { prefix: true, dictionary: "english", any_word: true } }
+
+  scope :active,   -> { where(enabled: true) }
+  scope :disabled, -> { where(enabled: false) }
+  scope :external, -> { where("target_path LIKE 'http%'") }
+
+  def self.lookup(path)
+    return nil if path.blank?
+
+    key = normalize_path_for_lookup(path)
+    Rails.cache.fetch("redirect:#{key}", expires_in: 5.minutes) do
+      compute_lookup(key)
+    end
+  end
+
+  # Convenience for ad-hoc cache busting (also called by callbacks).
+  def self.bust_cache(_path = nil)
+    Rails.cache.delete_matched("redirect:*")
+  rescue NotImplementedError
+    # MemoryStore in test/dev supports delete_matched; some stores don't.
+    Rails.cache.clear
+  end
+
+  def gone?
+    status_code.to_i == 410
+  end
+
+  private
+
+  def self.normalize_path_for_lookup(path)
+    p = path.to_s.downcase
+    p = p.chomp("/") if p.length > 1 && p.end_with?("/")
+    p
+  end
+
+  def self.compute_lookup(path)
+    rule = active.where("LOWER(source_path::text) = ?", path).first
+
+    rule ||= active
+      .where("source_path::text LIKE '%*'")
+      .find { |r| wildcard_match?(r.source_path.to_s.downcase, path) }
+
+    return nil unless rule
+
+    { id: rule.id, target: rule.target_path, status_code: rule.status_code }
+  end
+
+  def self.wildcard_match?(pattern, path)
+    prefix = pattern.chomp("*")
+    path.start_with?(prefix)
+  end
+
+  def normalize_source_path
+    return if source_path.blank?
+
+    normalized = source_path.to_s.strip.downcase
+    normalized = normalized.chomp("/") if normalized.length > 1 && normalized.end_with?("/")
+    self.source_path = normalized
+  end
+
+  def source_path_shape
+    return if source_path.blank?
+
+    valid = source_path.start_with?("/") || source_path.match?(%r{\Ahttps?://}i)
+    errors.add(:source_path, "must start with '/' or be a full URL") unless valid
+  end
+
+  def expire_cache
+    self.class.bust_cache
+  end
+end

data/lib/generators/ruby_cms/templates/models/user_permission.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class UserPermission < ApplicationRecord
+  self.table_name = "user_permissions"
+
+  belongs_to :user, class_name: "User", optional: false
+  belongs_to :permission, class_name: "Permission"
+
+  validates :user_id, uniqueness: { scope: :permission_id }
+
+  before_destroy :prevent_last_admin_lockout
+
+  private
+
+  # Never let the manage_admin grant be removed from the last admin — that would
+  # lock everyone out. Covers revoke / bulk-revoke / toggle (all hit destroy).
+  def prevent_last_admin_lockout
+    return unless permission&.key == "manage_admin"
+    return if self.class.joins(:permission)
+                  .where(permissions: { key: "manage_admin" }).where.not(id: id).exists?
+
+    errors.add(:base, "Kan de manage_admin-permissie van de laatste beheerder niet verwijderen.")
+    throw :abort
+  end
+end

data/lib/generators/ruby_cms/templates/models/visitor_error.rb

@@ -0,0 +1,157 @@
+# frozen_string_literal: true
+
+require "uri"
+
+class VisitorError < ApplicationRecord
+  include Discard::Model
+  include Ransackable
+  include AASM
+  include PgSearch::Model
+
+  ransack_attrs :error_class, :error_message, :request_path, :request_method, :ip_address, :resolved, :state, :created_at, :discarded_at
+
+  pg_search_scope :search_by_term,
+                  against: { error_class: "A", request_path: "B", error_message: "C" },
+                  using: { tsearch: { prefix: true, dictionary: "english" } }
+
+  self.table_name = "visitor_errors"
+
+  aasm column: :state, whiny_persistence: false do
+    state :open, initial: true
+    state :acknowledged
+    state :resolved
+    state :ignored
+
+    event :acknowledge do
+      transitions from: %i[open], to: :acknowledged
+    end
+
+    event :resolve do
+      transitions from: %i[open acknowledged ignored], to: :resolved, after: -> { self.resolved = true }
+    end
+
+    event :reopen do
+      transitions from: %i[resolved acknowledged ignored], to: :open, after: -> { self.resolved = false }
+    end
+
+    event :ignore do
+      transitions from: %i[open acknowledged], to: :ignored
+    end
+  end
+
+  scope :recent, -> { order(created_at: :desc) }
+  scope :unresolved, -> { where(resolved: false) }
+  scope :by_page, ->(path) { where(request_path: path) }
+  scope :today, -> { where(created_at: Date.current.beginning_of_day..) }
+
+  def self.log_error(exception, request)
+    err = create!(
+      **base_request_attrs(request),
+      **exception_attrs(exception),
+      request_params: sanitize_params(request.params)
+    )
+    notify_admins(err)
+    err
+  rescue StandardError => e
+    Rails.logger.error "Failed to log visitor error: #{e.message}"
+  end
+
+  def self.notify_admins(err)
+    return unless defined?(::AdminAlertNotifier)
+
+    AdminAlertNotifier.with(
+      record: err,
+      kind: :error,
+      title: err.error_class.to_s,
+      body: "#{err.request_path} — #{err.error_message.to_s.truncate(120)}",
+      url: Rails.application.routes.url_helpers.admin_visitor_error_path(err)
+    ).deliver(User.where(admin: true))
+  rescue StandardError => e
+    Rails.logger.warn("[VisitorError] notifier failed: #{e.class}: #{e.message}")
+  end
+
+  # Log routing errors (404s) from catch-all route.
+  # Called by RubyCms::ErrorsController#not_found
+  def self.log_routing_error(request)
+    return if Rails.env.development?
+    return if request.path.start_with?("/admin")
+
+    create!(
+      **base_request_attrs(request),
+      error_class: "ActionController::RoutingError",
+      error_message: routing_error_message(request),
+      backtrace: nil,
+      request_params: nil
+    )
+  rescue StandardError => e
+    Rails.logger.error "Failed to log routing error: #{e.message}"
+  end
+
+  # Returns the code path: backtrace for exceptions, or synthetic path for routing errors
+  def codepath
+    if backtrace.present?
+      backtrace
+    elsif error_class == "ActionController::RoutingError"
+      <<~TEXT.strip
+        Request → Router (no matching route) → RubyCms::ErrorsController#not_found
+        (Routing errors don't generate stack traces; the request never reached a controller action.)
+      TEXT
+    else
+      "No stack trace available."
+    end
+  end
+
+  def browser_info
+    return "Unknown" if user_agent.blank?
+
+    case user_agent
+    when /Chrome/ then "Chrome"
+    when /Firefox/ then "Firefox"
+    when /Safari(?!.*Chrome)/ then "Safari"
+    when /Edge/ then "Edge"
+    else "Other"
+    end
+  end
+
+  class << self
+    private
+
+    def sanitize_params(params)
+      return nil unless params
+
+      h = params.respond_to?(:to_unsafe_h) ? params.to_unsafe_h : params.to_h
+      filtered = h.except("password", "password_confirmation", "authenticity_token")
+      filtered.to_json.truncate(500)
+    end
+
+    def base_request_attrs(request)
+      {
+        request_path: request.path,
+        request_method: request.request_method,
+        ip_address: request.remote_ip,
+        user_agent: request.user_agent,
+        session_id: safe_session_id(request),
+        referer: request.referer.presence&.truncate(500),
+        query_string: request.query_string.presence&.truncate(500)
+      }
+    end
+
+    def exception_attrs(exception)
+      {
+        error_class: exception.class.name,
+        error_message: exception.message,
+        backtrace: exception.backtrace&.first(10)&.join("\n")
+      }
+    end
+
+    def routing_error_message(request)
+      "No route matches [#{request.request_method}] \"#{request.path}\""
+    end
+
+    def safe_session_id(request)
+      request.session.id
+    rescue StandardError
+      nil
+    end
+  end
+end

data/lib/generators/ruby_cms/templates/nav/analytics.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :analytics, label: "Analytics", path: lambda(&:admin_analytics_path), icon: :chart_bar, section: :settings, permission: :manage_analytics, order: 1)

data/lib/generators/ruby_cms/templates/nav/audit_log.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :audit_log, label: "Audit log", path: lambda(&:admin_audit_log_entries_path), icon: :clipboard_document_list, section: :settings, permission: :manage_audit_log, order: 22)

data/lib/generators/ruby_cms/templates/nav/commands.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :commands, label: "Commando's", path: lambda(&:admin_settings_commands_path), icon: :wrench, section: :settings, permission: :manage_admin, order: 14)

data/lib/generators/ruby_cms/templates/nav/content_blocks.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :content_blocks, label: "Content blocks", path: lambda(&:admin_content_blocks_path), icon: :document_duplicate, section: :main, permission: :manage_content_blocks, order: 11)

data/lib/generators/ruby_cms/templates/nav/core.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :dashboard,        label: "Dashboard", path: lambda(&:admin_root_path), icon: :home, section: :main, permission: :manage_admin, order: 1)
+
+# Group: Content (slot 10) — children registered by content_blocks / media / redirects nav fragments
+RubyCms.nav_group(key: :website_content,      label: "Website & content", icon: :newspaper, section: :main, children: %i[content_blocks media_library redirects], default_open: true, order: 10)
+
+# Group: Instellingen (slot 10) — children registered by permissions / users / commands nav fragments
+RubyCms.nav_group(key: :instellingen,         label: "Instellingen", icon: :cog_6_tooth, section: :settings, children: %i[settings_overview permissions users commands], default_open: false, order: 10)
+RubyCms.register_page(key: :settings_overview, label: "Overzicht", path: lambda(&:admin_settings_path), icon: :cog_6_tooth, section: :settings, permission: :manage_admin, order: 11)
+
+# Group: Systeem (slot 20) — children registered when security / audit_log / system_health modules are installed
+RubyCms.nav_group(key: :systeem,              label: "Systeem", icon: :shield_check, section: :settings, children: %i[visitor_errors audit_log system_health security], default_open: false, order: 20)

data/lib/generators/ruby_cms/templates/nav/media.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :media_library, label: "Media library", path: lambda(&:admin_media_assets_path), icon: :photograph, section: :main, permission: :manage_media, order: 13)

data/lib/generators/ruby_cms/templates/nav/permissions.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :permissions, label: "Rechten", path: lambda(&:admin_permissions_path), icon: :shield_check, section: :settings, permission: :manage_permissions, order: 12)

data/lib/generators/ruby_cms/templates/nav/redirects.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :redirects, label: "Redirects", path: lambda(&:admin_redirects_path), icon: :arrow_path, section: :main, permission: :manage_redirects, order: 14)

data/lib/generators/ruby_cms/templates/nav/security.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :visitor_errors,   label: "Errors",           path: lambda(&:admin_visitor_errors_path),   icon: :exclamation_triangle, section: :settings, permission: :manage_visitor_errors, order: 21)
+RubyCms.register_page(key: :security,         label: "Security",        path: lambda(&:admin_security_index_path),   icon: :shield_check, section: :settings, permission: :manage_security, order: 24)

data/lib/generators/ruby_cms/templates/nav/system_health.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :system_health, label: "System health", path: lambda(&:admin_system_health_path), icon: :bolt, section: :settings, permission: :manage_system_health, order: 23)

data/lib/generators/ruby_cms/templates/nav/trash.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :trash, label: "Trash", path: lambda(&:admin_trash_path), icon: :trash, section: :settings, permission: :manage_admin, order: 26)

data/lib/generators/ruby_cms/templates/nav/users.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :users, label: "Gebruikers", path: lambda(&:admin_users_path), icon: :user_group, section: :settings, permission: :manage_permissions, order: 13)

data/lib/generators/ruby_cms/templates/nav/visual_editor.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+RubyCms.register_page(key: :visual_editor, label: "Visual editor", path: lambda(&:admin_visual_editor_path), icon: :pencil_square, section: :main, permission: :manage_content_blocks, order: 2)

data/lib/generators/ruby_cms/templates/routes/analytics.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+get "analytics",                  to: "analytics#index",           as: :analytics
+get "analytics/page_details",     to: "analytics#page_details",    as: :analytics_page_details
+get "analytics/visitor_details",  to: "analytics#visitor_details", as: :analytics_visitor_details

data/lib/generators/ruby_cms/templates/routes/audit_log.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+resources :audit_log_entries, only: %i[index show], path: "audit_log"

data/lib/generators/ruby_cms/templates/routes/auth.public.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+get   "invitations/:token", to: "invitations#show", as: :invitation
+patch "invitations/:token", to: "invitations#update"

data/lib/generators/ruby_cms/templates/routes/auth.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+resources :invitations, only: %i[create destroy] do
+  member     { post :resend }
+  collection { post :resend_all }
+end

data/lib/generators/ruby_cms/templates/routes/commands.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+get   "settings/commands",         to: "commands#index",            as: :settings_commands
+post  "settings/commands/run",     to: "commands#run",              as: :settings_commands_run

data/lib/generators/ruby_cms/templates/routes/content_blocks.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+resources :content_blocks do
+  collection do
+    delete :bulk_delete
+    patch  :bulk_publish
+    patch  :bulk_unpublish
+  end
+  resources :versions, controller: "content_block_versions", only: %i[index show] do
+    member { post :rollback }
+  end
+end

data/lib/generators/ruby_cms/templates/routes/core.public.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+# RubyCMS: catch-all for 404 tracking — must be LAST route
+match "*path", to: "errors#not_found", via: :all,
+               constraints: ->(req) { !req.path.start_with?("/rails/", "/assets/") }

data/lib/generators/ruby_cms/templates/routes/core.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+root to: "dashboard#index"
+
+resources :notifications, only: [] do
+  member     { post :mark_read }
+  collection { post :mark_all_read }
+end
+
+get   "settings",                  to: "settings#index", as: :settings
+patch "settings",                  to: "settings#update"
+post  "settings",                  to: "settings#update"
+post  "settings/nav_order",        to: "settings#update_nav_order", as: :settings_nav_order
+post  "settings/reset_defaults",   to: "settings#reset_defaults",   as: :settings_reset_defaults
+
+patch "locale", to: "locale#update", as: :locale

data/lib/generators/ruby_cms/templates/routes/media.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+resources :media_assets, path: "media" do
+  collection do
+    delete :bulk_delete
+    patch  :bulk_move
+    get    :picker
+  end
+end

data/lib/generators/ruby_cms/templates/routes/passkeys.public.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+post "passkey_sessions/new", to: "passkey_sessions#new", as: :new_passkey_session
+resources :passkey_sessions, only: %i[create]

data/lib/generators/ruby_cms/templates/routes/passkeys.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+resources :passkey_credentials, only: %i[index destroy]
+resource  :passkey_registration, only: %i[new create]
+post "passkey_registration/options", to: "passkey_registrations#options", as: :passkey_registration_options

data/lib/generators/ruby_cms/templates/routes/permissions.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+resources :permissions, only: %i[index create destroy] do
+  collection { delete :bulk_delete }
+end

data/lib/generators/ruby_cms/templates/routes/redirects.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+resources :redirects do
+  collection do
+    delete :bulk_delete
+    patch  :bulk_enable
+    patch  :bulk_disable
+    post   :import_csv
+  end
+end

data/lib/generators/ruby_cms/templates/routes/security.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+resources :visitor_errors, only: %i[index show] do
+  member do
+    patch :resolve
+    patch :unresolve
+  end
+  collection do
+    delete :bulk_delete
+    patch  :bulk_mark_as_resolved
+    patch  :bulk_mark_as_unresolved
+  end
+end
+
+resources :security, only: [:index] do
+  collection do
+    post   :ip_blocklist,         to: "security#create_ip_blocklist_entry",  as: :ip_blocklist
+    delete "ip_blocklist/:id",    to: "security#destroy_ip_blocklist_entry", as: :ip_blocklist_entry
+  end
+end