ruby_cms 0.2.1.1 → 1.0.0

data/lib/generators/ruby_cms/templates/controllers/concerns/page_tracking.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+# Include in controllers to track page views via Ahoy.
+# Requires Ahoy to be installed (via RubyCMS install generator).
+#
+# Usage:
+#   class PagesController < ApplicationController
+#     include PageTracking
+#   end
+#
+# Sets @page_name to controller_name by default. Override in actions:
+#   @page_name = "custom_page_name"
+#
+module PageTracking
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :set_page_name
+    after_action :track_page_view
+  end
+
+  private
+
+  def set_page_name
+    @page_name = controller_name if @page_name.blank?
+  end
+
+  def track_page_view
+    return unless should_track_page_view?
+
+    ahoy.track "page_view",
+               page_name: @page_name,
+               request_path: request.path
+  rescue StandardError => e
+    Rails.logger.error "[RubyCMS] Failed to track page view: #{e.message}"
+  end
+
+  def should_track_page_view?
+    return false if @page_name.blank?
+    return false if request.path.start_with?("/admin")
+    return false if request.headers["Turbo-Frame"].present?
+
+    true
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/concerns/security_monitoring.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+module SecurityMonitoring
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :log_request_info, unless: -> { skip_security_monitoring? }
+  end
+
+  private
+
+  def skip_security_monitoring?
+    path = request.path
+    return true if [ "/", "/up" ].include?(path)
+    return true if path.start_with?("/assets", "/packs", "/favicon", "/robots.txt", "/service-worker", "/manifest", "/pwa", "/sitemap")
+    return true if path.match?(/\.(css|js|map|png|jpe?g|gif|svg|ico|webp|txt)\z/i)
+
+    false
+  end
+
+  def log_request_info
+    log_suspicious_user_agent if suspicious_user_agent?
+    log_unusual_request_pattern if unusual_request_pattern?
+  end
+
+  def suspicious_user_agent?
+    ua = request.user_agent.to_s.downcase
+    suspicious_patterns = %w[nikto sqlmap nmap burp crawler bot]
+    suspicious_patterns.any? { |p| ua.include?(p) }
+  end
+
+  def unusual_request_pattern?
+    path = request.path.to_s.downcase
+    return false if path == "/"
+
+    query = request.query_string.to_s.downcase
+    suspicious_patterns = %w[wp-admin wp-login.php .php .env .git/HEAD /etc/passwd <script> union select]
+    suspicious_patterns.any? { |p| path.include?(p) || query.include?(p) }
+  end
+
+  def log_suspicious_user_agent
+    return if recently_logged?("suspicious_user_agent")
+    return if IpBlocklist.blocked?(request.remote_ip)
+
+    Rails.logger.warn "Suspicious User-Agent detected: #{request.user_agent} from IP: #{request.remote_ip}"
+
+    SecurityTracker.track(
+      "suspicious_user_agent",
+      description: "Suspicious user agent detected",
+      request: request
+    )
+  end
+
+  def log_unusual_request_pattern
+    return if recently_logged?("unusual_request_pattern")
+    return if IpBlocklist.blocked?(request.remote_ip)
+
+    Rails.logger.warn "Unusual request pattern detected: #{request.method} #{request.path} from IP: #{request.remote_ip}"
+
+    SecurityTracker.track(
+      "unusual_request_pattern",
+      description: "Unusual request pattern detected",
+      request: request
+    )
+  end
+
+  def log_security_event(event_type, description, user_id: nil)
+    user = user_id ? User.find_by(id: user_id) : nil
+    SecurityTracker.track(
+      event_type,
+      description:,
+      user:,
+      request:
+    )
+    AuditLog.record(
+      action: audit_action_for(event_type),
+      actor: user || :system,
+      target: "Session",
+      summary: description,
+      request: request,
+      meta: { event_type: }
+    )
+  end
+
+  def audit_action_for(event_type)
+    case event_type.to_s
+    when "successful_login"           then :login_success
+    when "failed_login"               then :login_failed
+    when "unauthorized_admin_attempt" then :login_failed_unauthorized
+    when "logout"                     then :login_logout
+    else                                   :"session_#{event_type}"
+    end
+  end
+
+  def recently_logged?(type, window: 5.minutes)
+    key = "secev:#{type}:#{request.remote_ip}"
+    return true if Rails.cache.exist?(key)
+
+    Rails.cache.write(key, true, expires_in: window)
+    false
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/concerns/sudo_mode.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+# Requires a recent authentication before sensitive actions such as managing passkeys.
+module SudoMode
+  extend ActiveSupport::Concern
+
+  # How long a fresh sign-in keeps sudo mode "active" before re-auth is required.
+  SUDO_WINDOW = 30.minutes
+
+  class_methods do
+    def require_recent_authentication(**options)
+      before_action :require_recent_authentication, **options
+    end
+  end
+
+  private
+
+  def require_recent_authentication
+    return if sudo_active?
+
+    session[:return_to_after_authenticating] = request.url
+    redirect_to new_session_path, alert: "Confirm your password to continue."
+  end
+
+  def sudo_active?
+    authenticated_at = Current.session&.try(:authenticated_at)
+    authenticated_at.present? && authenticated_at > SUDO_WINDOW.ago
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/concerns/visitor_error_capture.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+# Include in ApplicationController to capture public-site errors to VisitorError.
+# Skips admin controllers (paths under /admin) and development environment by default.
+#
+# Usage in ApplicationController:
+#   include VisitorErrorCapture
+#   rescue_from StandardError, with: :handle_visitor_error
+#
+module VisitorErrorCapture
+  extend ActiveSupport::Concern
+
+  class_methods do
+    def install(controller_class)
+      controller_class.include VisitorErrorCapture
+      controller_class.rescue_from StandardError, with: :handle_visitor_error
+    end
+  end
+
+  private
+
+  def handle_visitor_error(exception)
+    return if skip_visitor_error_capture?
+
+    VisitorError.log_error(exception, request)
+  ensure
+    raise exception
+  end
+
+  def skip_visitor_error_capture?
+    return true if Rails.env.development?
+
+    false
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/errors_controller.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+# Handles 404 errors from catch-all routes.
+# Add this to the BOTTOM of your routes.rb to capture routing errors:
+#
+#   match "*path", to: "errors#not_found", via: :all,
+#         constraints: ->(req) { !req.path.start_with?("/rails/") }
+#
+class ErrorsController < ApplicationController
+  allow_unauthenticated_access only: :not_found
+  skip_before_action :verify_authenticity_token, only: :not_found
+
+  def not_found
+    # Log the routing error to VisitorError (skips in development)
+    VisitorError.log_routing_error(request)
+
+    respond_to do |format|
+      format.html do
+        render_html_not_found
+      end
+      format.json { render json: { error: "Not found" }, status: :not_found }
+      format.any { head :not_found }
+    end
+  end
+
+  private
+
+  def render_html_not_found
+    static_not_found = Rails.public_path.join("404.html")
+    if static_not_found.exist?
+      render file: static_not_found, status: :not_found, layout: false
+    else
+      render :not_found, status: :not_found, layout: false
+    end
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/passkey_sessions_controller.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+class PasskeySessionsController < ApplicationController
+  allow_unauthenticated_access only: %i[new create]
+  # Never let a proxy/browser/service-worker cache the challenge options or result.
+  before_action { response.headers["Cache-Control"] = "no-store" }
+
+  # POST /passkey_sessions/new — issue usernameless (discoverable) request options.
+  def new
+    get_options = WebAuthn::Credential.options_for_get(user_verification: "preferred")
+    session[:passkey_authentication_challenge] = get_options.challenge
+    render json: get_options
+  end
+
+  # POST /passkey_sessions — verify the assertion and start a session.
+  def create
+    raw = params.to_unsafe_h[:credential]
+    return render(json: { error: "Missing credential" }, status: :bad_request) if raw.blank?
+
+    webauthn_credential = WebAuthn::Credential.from_get(raw)
+    stored = PasskeyCredential.find_by!(external_id: webauthn_credential.id)
+    challenge = session.delete(:passkey_authentication_challenge)
+
+    verify_assertion(webauthn_credential, stored, challenge)
+    apply_sign_count(webauthn_credential, stored)
+    stored.update!(last_used_at: Time.current)
+
+    start_new_session_for(stored.user)
+    render json: { ok: true, redirect: after_authentication_url }
+  rescue ActiveRecord::RecordNotFound, ActiveRecord::RecordInvalid, WebAuthn::Error, ArgumentError, TypeError => e
+    Rails.logger.warn("[passkey] authentication failed: #{e.class}: #{e.message}")
+    render json: { error: "Authentication failed" }, status: :unprocessable_entity
+  end
+
+  private
+
+  def verify_assertion(webauthn_credential, stored, challenge)
+    webauthn_credential.verify(
+      challenge,
+      public_key: stored.public_key,
+      sign_count: stored.sign_count
+    )
+  rescue WebAuthn::SignCountVerificationError
+    # Signature already verified before the count check. Synced passkeys can report a
+    # non-increasing counter — log/alert but do NOT block. apply_sign_count handles it.
+    Rails.logger.warn("[passkey] sign_count not increasing for credential #{stored.id}")
+  end
+
+  # Lenient sign_count policy (see spec). Never raises.
+  def apply_sign_count(webauthn_credential, stored)
+    new_count = webauthn_credential.sign_count
+    if new_count > stored.sign_count
+      stored.update!(sign_count: new_count)
+    elsif new_count.zero? && stored.sign_count.zero?
+      # authenticator does not implement counters — nothing to do
+    else
+      notify_suspicious_sign_count(stored, new_count)
+    end
+  end
+
+  def notify_suspicious_sign_count(stored, new_count)
+    Rails.logger.warn(
+      "[passkey] suspicious sign_count for user=#{stored.user_id} " \
+      "credential=#{stored.id} stored=#{stored.sign_count} got=#{new_count}"
+    )
+    # Surface via the existing Noticed pipeline without blocking login.
+    # (Logging is the guaranteed minimum.)
+  end
+end

data/lib/generators/ruby_cms/templates/db/migrate/20251121085414_create_email_blocklists.rb

@@ -0,0 +1,12 @@
+class CreateEmailBlocklists < ActiveRecord::Migration[8.1]
+  def change
+    create_table :email_blocklists, if_not_exists: true do |t|
+      t.string :email, null: false
+      t.text :note
+
+      t.timestamps
+    end
+
+    add_index :email_blocklists, :email, unique: true, if_not_exists: true
+  end
+end

data/lib/generators/ruby_cms/templates/db/migrate/20251121161828_create_ip_blocklists.rb

@@ -0,0 +1,12 @@
+class CreateIpBlocklists < ActiveRecord::Migration[8.1]
+  def change
+    create_table :ip_blocklists, if_not_exists: true do |t|
+      t.string :ip_address, null: false
+      t.text :note
+
+      t.timestamps
+    end
+
+    add_index :ip_blocklists, :ip_address, unique: true, if_not_exists: true
+  end
+end

data/lib/generators/ruby_cms/templates/db/migrate/20251205120000_add_analytics_indices.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+class AddAnalyticsIndices < ActiveRecord::Migration[8.0]
+  def change
+    # Ahoy visits indices for analytics queries
+    add_index :ahoy_visits, :started_at, if_not_exists: true
+    add_index :ahoy_visits, :ip, if_not_exists: true
+    add_index :ahoy_visits, :referrer, if_not_exists: true
+
+    # Ahoy events indices
+    add_index :ahoy_events, :time, if_not_exists: true
+
+    # Convert properties column from text to jsonb for better PostgreSQL performance
+    # This enables GIN indexing and native JSON queries
+    # Modern Ahoy (5.x) already creates `properties` as jsonb; only convert when an
+    # older schema left it as text, otherwise the `= ''` comparison fails on jsonb.
+    reversible do |dir|
+      dir.up do
+        properties_col = columns(:ahoy_events).find { |c| c.name == "properties" }
+        if properties_col && properties_col.sql_type == "text"
+          execute <<-SQL
+            ALTER TABLE ahoy_events
+            ALTER COLUMN properties TYPE jsonb
+            USING CASE
+              WHEN properties IS NULL THEN NULL
+              WHEN properties = '' THEN '{}'::jsonb
+              ELSE properties::jsonb
+            END
+          SQL
+        end
+      end
+
+      dir.down do
+        properties_col = columns(:ahoy_events).find { |c| c.name == "properties" }
+        if properties_col && properties_col.sql_type == "jsonb"
+          execute <<-SQL
+            ALTER TABLE ahoy_events
+            ALTER COLUMN properties TYPE text
+            USING properties::text
+          SQL
+        end
+      end
+    end
+
+    # GIN index for JSONB properties (PostgreSQL specific)
+    add_index :ahoy_events, :properties, using: :gin, if_not_exists: true
+  end
+end

data/lib/generators/ruby_cms/templates/db/migrate/20251216064753_backfill_security_fields_in_ahoy_events.rb

@@ -0,0 +1,49 @@
+class BackfillSecurityFieldsInAhoyEvents < ActiveRecord::Migration[8.0]
+  def up
+    say_with_time "Backfilling Ahoy::Event columns from properties and clearing properties..." do
+      Ahoy::Event.find_in_batches(batch_size: 1_000) do |events|
+        events.each do |event|
+          props =
+            begin
+              case event.properties
+              when String
+                JSON.parse(event.properties)
+              when Hash
+                event.properties
+              else
+                {}
+              end
+            rescue JSON::ParserError
+              {}
+            end
+
+          updates = {}
+
+          # Universal mapping (works for both security + page_view events)
+          ip_from_props = props["ip_address"] || props["ip"]
+          ua_from_props = props["user_agent"]
+          path_from_props = props["request_path"] || props["path"]
+          desc_from_props = props["description"]
+          page_name_from_props = props["page_name"]
+
+          updates[:ip_address] = ip_from_props if event.ip_address.blank? && ip_from_props.present?
+          updates[:user_agent] = ua_from_props if event.user_agent.blank? && ua_from_props.present?
+          updates[:request_path] = path_from_props if event.request_path.blank? && path_from_props.present?
+
+          updates[:description] = desc_from_props if event.respond_to?(:description) && event.description.blank? && desc_from_props.present?
+          # Page views: copy page_name into its new column (if present)
+          updates[:page_name] = page_name_from_props if event.respond_to?(:page_name) && event.page_name.blank? && page_name_from_props.present?
+
+          # Stop using properties going forward: clear it once we’ve extracted whatever we can
+          updates[:properties] = nil if event.properties.present?
+
+          event.update_columns(updates) if updates.any?
+        end
+      end
+    end
+  end
+
+  def down
+    # no-op (we intentionally do not restore properties)
+  end
+end

data/{db → lib/generators/ruby_cms/templates/db}/migrate/20260125000001_create_ruby_cms_permissions.rb

@@ -2,13 +2,13 @@
 
 class CreateRubyCmsPermissions < ActiveRecord::Migration[7.1]
   def change
-    create_table :ruby_cms_permissions do |t|
+    create_table :ruby_cms_permissions, if_not_exists: true do |t|
       t.string :key, null: false
       t.string :name
 
       t.timestamps
     end
 
-    add_index :ruby_cms_permissions, :key, unique: true
+    add_index :ruby_cms_permissions, :key, unique: true, if_not_exists: true
   end
 end

data/{db → lib/generators/ruby_cms/templates/db}/migrate/20260125000002_create_ruby_cms_user_permissions.rb

@@ -2,13 +2,13 @@
 
 class CreateRubyCmsUserPermissions < ActiveRecord::Migration[7.1]
   def change
-    create_table :ruby_cms_user_permissions do |t|
+    create_table :ruby_cms_user_permissions, if_not_exists: true do |t|
       t.references :user, null: false, foreign_key: false
       t.references :permission, null: false, foreign_key: { to_table: :ruby_cms_permissions }
 
       t.timestamps
     end
 
-    add_index :ruby_cms_user_permissions, %i[user_id permission_id], unique: true
+    add_index :ruby_cms_user_permissions, %i[user_id permission_id], unique: true, if_not_exists: true
   end
 end

data/{db → lib/generators/ruby_cms/templates/db}/migrate/20260125000003_create_ruby_cms_content_blocks.rb

@@ -2,7 +2,7 @@
 
 class CreateRubyCmsContentBlocks < ActiveRecord::Migration[7.1]
   def change
-    create_table :ruby_cms_content_blocks do |t|
+    create_table :ruby_cms_content_blocks, if_not_exists: true do |t|
       t.string :key, null: false
       t.string :title
       t.text :content
@@ -13,7 +13,7 @@ class CreateRubyCmsContentBlocks < ActiveRecord::Migration[7.1]
       t.timestamps
     end
 
-    add_index :ruby_cms_content_blocks, :key, unique: true
-    add_index :ruby_cms_content_blocks, %i[published content_type]
+    add_index :ruby_cms_content_blocks, :key, unique: true, if_not_exists: true
+    add_index :ruby_cms_content_blocks, %i[published content_type], if_not_exists: true
   end
 end

data/{db → lib/generators/ruby_cms/templates/db}/migrate/20260125000010_add_indexes_to_ruby_cms_tables.rb

@@ -4,6 +4,6 @@ class AddIndexesToRubyCmsTables < ActiveRecord::Migration[7.1]
   def change
     return if index_exists?(:ruby_cms_content_blocks, :updated_by_id)
 
-    add_index :ruby_cms_content_blocks, :updated_by_id
+    add_index :ruby_cms_content_blocks, :updated_by_id, if_not_exists: true
   end
 end

data/{db → lib/generators/ruby_cms/templates/db}/migrate/20260127000001_add_locale_to_ruby_cms_content_blocks.rb

@@ -2,20 +2,22 @@
 
 class AddLocaleToRubyCmsContentBlocks < ActiveRecord::Migration[7.1]
   def change
-    add_column :ruby_cms_content_blocks, :locale, :string, default: "en", null: false
+    return unless table_exists?(:ruby_cms_content_blocks)
+
+    unless column_exists?(:ruby_cms_content_blocks, :locale)
+      add_column :ruby_cms_content_blocks, :locale, :string, default: "en", null: false
+    end
 
     # Remove old unique index on key
     remove_index :ruby_cms_content_blocks, :key if index_exists?(:ruby_cms_content_blocks, :key)
 
     # Add new composite unique index on key + locale
-    add_index :ruby_cms_content_blocks, %i[key locale], unique: true
+    add_index :ruby_cms_content_blocks, %i[key locale], unique: true, if_not_exists: true
 
     # Add index for locale queries
-    add_index :ruby_cms_content_blocks, :locale
+    add_index :ruby_cms_content_blocks, :locale, if_not_exists: true
 
-    # Migrate existing records to default locale
-    # This ensures existing content blocks get the default locale
-    # Use execute to avoid model loading issues during migration
+    # Migrate existing records to default locale (idempotent — only touches blanks)
     reversible do |dir|
       dir.up do
         default_locale = begin

data/{db → lib/generators/ruby_cms/templates/db}/migrate/20260129000001_create_ruby_cms_visitor_errors.rb

@@ -2,7 +2,7 @@
 
 class CreateRubyCmsVisitorErrors < ActiveRecord::Migration[7.1]
   def change
-    create_table :ruby_cms_visitor_errors do |t|
+    create_table :ruby_cms_visitor_errors, if_not_exists: true do |t|
       t.string :error_class, null: false
       t.text :error_message, null: false
       t.string :request_path, null: false
@@ -17,8 +17,8 @@ class CreateRubyCmsVisitorErrors < ActiveRecord::Migration[7.1]
       t.timestamps
     end
 
-    add_index :ruby_cms_visitor_errors, :created_at
-    add_index :ruby_cms_visitor_errors, :request_path
-    add_index :ruby_cms_visitor_errors, :resolved
+    add_index :ruby_cms_visitor_errors, :created_at, if_not_exists: true
+    add_index :ruby_cms_visitor_errors, :request_path, if_not_exists: true
+    add_index :ruby_cms_visitor_errors, :resolved, if_not_exists: true
   end
 end

data/lib/generators/ruby_cms/templates/db/migrate/20260130000001_add_referer_and_query_to_ruby_cms_visitor_errors.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class AddRefererAndQueryToRubyCmsVisitorErrors < ActiveRecord::Migration[7.1]
+  def change
+    return unless table_exists?(:ruby_cms_visitor_errors)
+
+    add_column :ruby_cms_visitor_errors, :referer, :string unless column_exists?(:ruby_cms_visitor_errors, :referer)
+    add_column :ruby_cms_visitor_errors, :query_string, :string unless column_exists?(:ruby_cms_visitor_errors, :query_string)
+  end
+end

data/{db → lib/generators/ruby_cms/templates/db}/migrate/20260130000002_create_ruby_cms_preferences.rb

@@ -2,7 +2,7 @@
 
 class CreateRubyCmsPreferences < ActiveRecord::Migration[7.1]
   def change
-    create_table :ruby_cms_preferences do |t|
+    create_table :ruby_cms_preferences, if_not_exists: true do |t|
       t.string :key, null: false
       t.text :value
       t.string :value_type, default: "string", null: false
@@ -11,6 +11,6 @@ class CreateRubyCmsPreferences < ActiveRecord::Migration[7.1]
       t.timestamps
     end
 
-    add_index :ruby_cms_preferences, :key, unique: true
+    add_index :ruby_cms_preferences, :key, unique: true, if_not_exists: true
   end
 end

data/lib/generators/ruby_cms/templates/db/migrate/20260130000003_add_category_to_ruby_cms_preferences.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class AddCategoryToRubyCmsPreferences < ActiveRecord::Migration[7.1]
+  def change
+    return unless table_exists?(:ruby_cms_preferences)
+
+    add_column :ruby_cms_preferences, :category, :string, default: "general" unless column_exists?(:ruby_cms_preferences, :category)
+    add_index :ruby_cms_preferences, :category, if_not_exists: true
+  end
+end

data/{db → lib/generators/ruby_cms/templates/db}/migrate/20260328000001_create_content_block_versions.rb

@@ -2,7 +2,7 @@
 
 class CreateContentBlockVersions < ActiveRecord::Migration[7.1]
   def change
-    create_table :content_block_versions do |t|
+    create_table :content_block_versions, if_not_exists: true do |t|
       t.references :content_block, null: false, foreign_key: true, index: true
       t.references :user, null: true, foreign_key: true
       t.integer :version_number, null: false
@@ -17,6 +17,6 @@ class CreateContentBlockVersions < ActiveRecord::Migration[7.1]
     end
 
     add_index :content_block_versions, %i[content_block_id version_number],
-              unique: true, name: "idx_cb_versions_on_block_and_number"
+              unique: true, name: "idx_cb_versions_on_block_and_number", if_not_exists: true
   end
 end

data/lib/generators/ruby_cms/templates/db/migrate/20260525120000_create_audit_log_entries.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class CreateAuditLogEntries < ActiveRecord::Migration[8.0]
+  def change
+    create_table :audit_log_entries, if_not_exists: true do |t|
+      t.string  :actor_email
+      t.bigint  :actor_id
+      t.string  :action, null: false
+      t.string  :target_type
+      t.bigint  :target_id
+      t.string  :target_label
+      t.string  :summary,      limit: 500
+      t.string  :ip,           limit: 64
+      t.string  :user_agent,   limit: 500
+      t.jsonb   :metadata,     null: false, default: {}
+      t.datetime :created_at,  null: false
+    end
+
+    add_index :audit_log_entries, :created_at, order: { created_at: :desc }, if_not_exists: true
+    add_index :audit_log_entries, %i[actor_email created_at], if_not_exists: true
+    add_index :audit_log_entries, :action, if_not_exists: true
+    add_index :audit_log_entries, %i[target_type target_id], if_not_exists: true
+  end
+end

data/lib/generators/ruby_cms/templates/db/migrate/20260525130000_create_redirects.rb

@@ -0,0 +1,28 @@
+class CreateRedirects < ActiveRecord::Migration[8.1]
+  def change
+    # citext gives us case-insensitive uniqueness on source_path without
+    # juggling functional indexes in app code.
+    enable_extension "citext" unless extension_enabled?("citext")
+
+    create_table :redirects, if_not_exists: true do |t|
+      t.citext   :source_path, null: false
+      t.string   :target_path
+      t.integer  :status_code, null: false, default: 301
+      t.boolean  :enabled,     null: false, default: true
+      t.string   :note
+      t.bigint   :hits, null: false, default: 0
+      t.datetime :last_hit_at
+
+      t.timestamps
+    end
+
+    add_index :redirects, :source_path, unique: true, if_not_exists: true
+    add_index :redirects, :enabled, if_not_exists: true
+    add_index :redirects, :last_hit_at, if_not_exists: true
+    add_index :redirects, :hits, if_not_exists: true
+
+    add_check_constraint :redirects,
+                         "status_code IN (301, 302, 410)",
+                         name: "redirects_status_code_check"
+  end
+end