studio-engine 0.56.4 → 0.57.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 216b05af34191f532de7327a210aad3314e6e85d5b846bb1b4480ac353978c51
-  data.tar.gz: 370fb4b8ab9149ac386a46c512f942bc3d64771310c80524206e178d8aab5294
+  metadata.gz: b736782effbce6816b1b46cd6acf958593f96cc2f78e524eb23f5e655ab0bdd5
+  data.tar.gz: 57b8207ab820e9abac08a9ac3ef304fe3718682921f8bc255941238824aa3c52
 SHA512:
-  metadata.gz: a27cd3a883a74ce065b463acc8d2fa3ac1054981c5d588460f7cdc179ef0612c5f36fc96afd6eeb249c1820f3e8353d1387c1e765638868c1bd8485de5f7adde
-  data.tar.gz: 4791c90ffd8d9601a7583ced8a85417cbcba52f71b942e4fc45c0bbf4578bdcc0fdc1cbd58da8d7ce6fe8bbe3ca14a9835cd6176097075d96e0a574edc2d3c89
+  metadata.gz: 5152ec72b244a9935955a2e7eeaf7cb86adc7530a4000f5a98f44feed966023609ef94f5fd2f7c6a19c18f48b944493b69904adc96535cd7646040fe522b2492
+  data.tar.gz: 52f1f4aee6d4dec1bd9df6e5baaf2e76cef0f75d8587a55819f287fca354fc0d0e5f5cff884241f6b1b3d11cac61feb393ed6ec06d3811d26b6b4d562955972f

data/CHANGELOG.md

@@ -1,11 +1,66 @@
 # Changelog
 
-The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) — `MAJOR.MINOR.PATCH`. Consumer Rails apps install the released RubyGems package with `gem "studio-engine", "~> 0.6"`; bumping the gem version and updating consumer lockfiles is a release.
+The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) — `MAJOR.MINOR.PATCH`. Consumer Rails apps install the released RubyGems package and pin the floor each one needs — the pins differ on purpose, and every consumer records why beside its own. Bumping the gem version and updating consumer lockfiles is a release; `bin/release prepare` allocates the version and does both (see [`docs/RELEASE.md`](./docs/RELEASE.md)).
 
 ## Unreleased
 
 ### Added
 
+- **Geo — validation for every app, locking for the apps that need it.**
+  Turf Monster's geo stack, lifted into the engine and generalised from
+  US-states-only to country + subdivision. Full guide:
+  [`docs/GEO.md`](docs/GEO.md).
+
+  What ships:
+
+  - **`Studio::Geo`** — the pure half: normalization, the region-token
+    vocabulary, country flag glyphs, the freshness policy, and `blocked?`, the
+    whole blocking decision in one Rails-free method.
+  - **`Studio::GeoDetection`** — one `include` in `ApplicationController` gives
+    an app IP → region detection with a session cache, the `geo_country` /
+    `geo_state` / `geo_region_token` / `geo_blocked?` / `geo_override_active?`
+    helpers, and `require_geo_allowed`, the before_action an app hangs on
+    whatever it must not serve from a blocked location.
+  - **`Studio::GeoSetting`** (`studio_geo_settings`) — the operator's stored
+    policy: the kill switch, blocked countries, blocked regions. Install with
+    `bin/rails studio_engine:install:migrations && bin/rails db:migrate`.
+  - **`/admin/geo` + `/geo/check`** — the manager and the public detection probe.
+    Three cards: what the server thinks of you, a summary of what this app blocks
+    (flag chips plus the kill switch), and two editors behind a tab — the home
+    country's regions and all 249 countries, every square carrying its flag. It
+    answers a click immediately: squares paint from their own checkbox, the
+    summary follows the editor, and ticking your OWN region repaints the navbar
+    badge and the verdict tile before anything is saved. A simulator pins your
+    session to a blocked region so the blocked experience can be walked without
+    a VPN. **Opt-in** via `Studio.draw_geo_routes = true`: turf-monster owns all
+    four helper names today, and a duplicate route name raises while that app's
+    `routes.rb` loads, taking its whole route set down.
+  - **`components/_geo_badge` + the 52 US subdivision flags** (states + DC + PR,
+    ~10 MB under `app/assets/images/state-flags/`), so an app gets the complete
+    badge from an empty repository. Non-US visitors render an emoji country
+    flag — shipping ~250 country SVGs for a 16px badge is not a trade worth
+    making.
+  - **Geocoder configured on boot** for every app that has the gem: ipinfo over
+    **HTTPS** (without which every lookup silently returns nothing and every geo
+    gate fails closed), a 3s timeout, and a `Rails.cache`-backed IP cache
+    (without which a shared-egress rate limit blanks every visitor). An app that
+    already configured Geocoder itself is **left alone** — the host wins, so a
+    gem bump cannot change a shipped app's IP provider. Opt out entirely with
+    `Studio.configure_geocoder = false`; `geocoder` is now a gem dependency.
+
+  Two rules worth reading before adopting:
+
+  **The region token.** `CA` is California *and* Canada, so the ban list stores
+  `US-WA`, never `WA`. Bare codes are accepted on input and normalized against
+  `Studio.geo_home_country`, so a checkbox grid and a legacy US-only list both
+  keep working.
+
+  **Fail closed.** An unplaceable *home-country* visitor is blocked — a blank
+  region could be any blocked region behind a VPN. Narrower than "block every
+  blank" on purpose: it fires only when subdivision rules for the home country
+  exist, and a *resolved foreign* country with no region stays allowed. Opt out
+  with `Studio.geo_fail_closed = false`.
+
 - **The hold-to-confirm button, with its fizz — a new ACTION family in
   `engine-motion.css`.** A press-and-hold CTA for an action a host does not want
   taken by accident, ported from Turf Monster where it confirms a contest entry.

data/README.md

@@ -8,12 +8,24 @@ Shared Rails engine for McRitchie apps. Provides authentication, error handling,
 
 ```ruby
 # Gemfile — install from RubyGems (recommended)
-gem "studio-engine", "~> 0.6"
+gem "studio-engine", "~> 0.56"   # EXAMPLE — pin the floor YOUR app needs
 ```
 
-Then `bundle install`. The current release is **v0.6.1**; see [`CHANGELOG.md`](./CHANGELOG.md) for the history.
+Then `bundle install`. That number is an example, not a statement about the
+current release: this README deliberately makes no such claim, because a
+hand-written one rots silently — it read `v0.6.1` for fifty minors. For what is
+live, see [RubyGems](https://rubygems.org/gems/studio-engine); for what changed,
+[`CHANGELOG.md`](./CHANGELOG.md).
 
-> Published to RubyGems as of v0.4.0 (2026-05-17). New installs should use the RubyGems form, which the consumer Rails apps (`mcritchie-studio`, `turf-monster`) already use.
+Pin the floor your app actually needs rather than copying the example. Each
+consumer pins its own and records WHY beside it, and they differ on purpose. A
+two-segment `~>` admits everything under `1.0`, so the pin documents the floor
+rather than constraining the resolve — read the `Gemfile.lock` for what really
+resolved.
+
+> Published to RubyGems as of v0.4.0 (2026-05-17). New installs should use the
+> RubyGems form, which all three consumer Rails apps (`mcritchie-studio`,
+> `turf-monster`, `mcritchie-industries`) already use.
 
 ## What It Provides
 
@@ -24,6 +36,7 @@ Then `bundle install`. The current release is **v0.6.1**; see [`CHANGELOG.md`](.
 - **Operator tooling**: Shared `studio/banners/environment` banner with Dev Mode + email connector controls, `studio/banners/impersonation`, and an opt-in `Studio::Impersonation` concern for Act As session conventions.
 - **Sluggable concern**: `before_save :set_slug` with `to_param` for human-readable URLs
 - **ThemeSetting model**: Per-app DB overrides with fallback to config defaults
+- **Geo**: `Studio::GeoDetection` places every visitor (IP → country + subdivision, session-cached), `Studio::GeoSetting` stores the operator's blocked countries and regions, `require_geo_allowed` locks whichever surfaces an app chooses, and the shared badge + `/admin/geo` manager ship with it. See [`docs/GEO.md`](docs/GEO.md).
 - **Transactional emails**: `Studio::EmailCatalog` — every email an app sends, its type, a live preview, and its banner — plus the shared `/admin/emails` page. Every app inherits the standard emails and their artwork on day one, and can register its own workflows and upload its own banners. See [Transactional emails](#transactional-emails).
 
 ## Configuration
@@ -105,7 +118,7 @@ Rails.application.routes.draw do
 end
 ```
 
-This draws the enabled auth routes (`/login`, `/signup`, `/logout`, `POST /magic_link` to request a link, `GET`/`POST /l/:token` for the link itself, Solana routes), OAuth callbacks, optional SSO routes, `/error_logs`, and `/admin/theme`. Magic-link emails point at the inert `GET /l/:token` confirmation page; the single-use token is burned only by the CSRF-protected `POST` to `link_consume_path`.
+This draws the enabled auth routes (`/login`, `/signup`, `/logout`, `POST /magic_link` to request a link, `GET`/`POST /l/:token` for the link itself, Solana routes), OAuth callbacks, optional SSO routes, `/error_logs`, and `/admin/theme`. Set `Studio.draw_geo_routes = true` to add the geo manager (`/admin/geo`) and its public probe (`/geo/check`) — off by default because turf-monster owns those helper names until its adoption lands. Magic-link emails point at the inert `GET /l/:token` confirmation page; the single-use token is burned only by the CSRF-protected `POST` to `link_consume_path`.
 
 **Magic links need the `studio_links` table.** Install it with `bin/rails studio_engine:install:migrations && bin/rails db:migrate` (install all of them) before enabling `:magic_link` — never by hand-copying the migration, which collides with the task's own copy on `class CreateStudioLinks`. Without the table, the first sign-in raises `Studio::Link::MissingTable`.
 
@@ -612,11 +625,13 @@ that touches that file. Update [`CHANGELOG.md`](./CHANGELOG.md) under
 `Unreleased` (that is *not* gated), run `bin/release-check --build`, and open
 your PR into `accepted`. That is the whole of your part.
 
-**Conducting the release?** Commit the computed version — with `Gemfile.lock`,
-which pins the engine's own path-gem version — directly onto `accepted`, then
-run `bin/release prepare` from mcritchie-studio; it publishes, tags, and bumps
-each consumer's lock. Details and the exact commands are in
-[`docs/RELEASE.md`](./docs/RELEASE.md).
+**Conducting the release?** Run `bin/release prepare` from mcritchie-studio and
+let it allocate the version — it derives the bump, commits `lib/studio/version.rb`
+with its `Gemfile.lock` onto **`origin/release`**, then publishes, tags, and bumps
+each consumer's lock. **Do not set the version by hand.** A hand-set number makes
+the allocation read the current version as already past the last tag and skip, so
+the hand number silently wins over the derived one. Details and the exact commands
+are in [`docs/RELEASE.md`](./docs/RELEASE.md).
 
 **Semver guide** — the release *derives* the bump from its members (a `breaking`
 risk tag → major, a `feature` → minor, otherwise patch), so this is what those

data/app/assets/images/state-flags/ak.svg

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="1416" height="1000">
+<rect width="1416" height="1000" fill="#0F204B"/>
+<g id="bstar" transform="translate(1158,182) scale(52)" fill="#ffb612"><g id="cone">
+<polygon id="triangle" points="0,0 0,1 .5,1" transform="translate(0,-1) rotate(18)"/><use xlink:href="#triangle" transform="scale(-1,1)" id="use5"/></g>
+<use xlink:href="#cone" transform="rotate(72)" id="use1"/>
+<use xlink:href="#cone" transform="rotate(-72)" id="use2"/>
+<use xlink:href="#cone" transform="rotate(144)" id="use3"/>
+<use xlink:href="#cone" transform="rotate(-144)" id="use4"/></g>
+<g id="star" transform="translate (229,396) scale(31)" fill="#ffb612"><g id="cone">
+<polygon id="triangle" points="0,0 0,1 .5,1" transform="translate(0,-1) rotate(18)"/>
+<use xlink:href="#triangle" transform="scale(-1,1)" id="use5"/>
+</g>
+<use xlink:href="#cone" transform="rotate(72)" id="use1"/>
+<use xlink:href="#cone" transform="rotate(-72)" id="use2"/>
+<use xlink:href="#cone" transform="rotate(144)" id="use3"/>
+<use xlink:href="#cone" transform="rotate(-144)" id="use4"/></g>
+<use xlink:href="#star" transform="translate(167,62)"/>
+<use xlink:href="#star" transform="translate(250,151)"/>
+<use xlink:href="#star" transform="translate(334,244)"/>
+<use xlink:href="#star" transform="translate(584,333)"/>
+<use xlink:href="#star" transform="translate(323,375)"/>
+<use xlink:href="#star" transform="translate(511,437)"/></svg>

data/app/assets/images/state-flags/al.svg

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg
+ xmlns="http://www.w3.org/2000/svg" width="600" height="400">
+<rect width="600" height="400" fill="#fff"/>
+<path d="M0,0 600,400M0,400 600,0" stroke="#b10021" stroke-width="68"/>
+</svg>

data/app/assets/images/state-flags/ar.svg

@@ -0,0 +1,244 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+<svg
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:xlink="http://www.w3.org/1999/xlink"
+   version="1.0"
+   width="450"
+   height="300"
+   id="svg548">
+  <defs
+     id="defs550" />
+  <rect
+     width="450"
+     height="300"
+     x="0"
+     y="0"
+     id="rect552"
+     style="fill:#bf0a30" />
+  <path
+     d="M 37.49998,148.84088 L 224.22459,275 L 412.49999,148.59512 L 224.22459,24.999999 L 37.49998,148.84088 z"
+     id="path558"
+     style="fill:#002868" />
+  <path
+     d="M 83.99998,149.12834 L 224.41689,244 L 365.99999,148.94353 L 224.41689,56 L 83.99998,149.12834 z"
+     id="path2508"
+     style="fill:#fff" />
+  <path
+     d="M 148.17531,145.0139 L 156.01008,145.0139 L 157.37008,149.38954 L 162.1892,149.38954 L 154.70921,128.16175 L 149.59444,128.16175 L 142.02575,149.38954 L 146.69705,149.38954 L 148.17531,145.0139 z M 152.07791,132.9513 L 152.13705,132.9513 L 154.76834,141.34781 L 149.35792,141.34781 L 152.07791,132.9513 z M 165.04714,149.38954 L 169.39322,149.38954 L 169.39322,141.08173 L 173.97582,141.08173 C 175.5557,141.06819 176.54243,141.37616 176.93603,142.00564 C 177.32961,142.63514 177.49591,143.66745 177.43495,145.10259 C 177.43616,146.17556 177.47805,147.03788 177.5606,147.68954 C 177.64312,148.34121 177.75892,148.90788 177.90799,149.38954 L 182.81581,149.38954 L 182.81581,148.8278 C 182.36246,148.69045 182.08651,148.32951 181.98798,147.74498 C 181.88941,147.16045 181.84999,146.11212 181.86972,144.59998 C 181.86662,142.69057 181.63626,141.39463 181.17864,140.71216 C 180.72097,140.02971 180.05453,139.53203 179.17929,139.21912 C 180.23438,138.84403 181.04373,138.20468 181.60733,137.30108 C 182.1709,136.39751 182.45546,135.35164 182.46103,134.16348 C 182.48309,133.51233 182.32395,132.7221 181.9836,131.79279 C 181.64322,130.86351 180.98914,130.03605 180.02135,129.31041 C 179.05353,128.5848 177.63952,128.20192 175.7793,128.16175 L 165.04714,128.16175 L 165.04714,149.38954 z M 169.39322,137.50434 L 169.39322,131.82783 L 174.92191,131.82783 C 176.1895,131.87343 177.03211,132.19618 177.44973,132.79609 C 177.86732,133.39603 178.05949,133.99965 178.02625,134.60695 C 178.02747,135.64606 177.74413,136.39135 177.17625,136.84282 C 176.60834,137.29432 175.74849,137.51482 174.59669,137.50434 L 169.39322,137.50434 z M 191.17287,142.2052 L 193.24243,140.07651 L 199.8059,149.38954 L 205.51197,149.38954 L 196.34677,136.85391 L 205.00937,128.16175 L 199.27373,128.16175 L 191.17287,136.79478 L 191.17287,128.16175 L 186.73809,128.16175 L 186.73809,149.38954 L 191.17287,149.38954 L 191.17287,142.2052 z M 212.27251,145.0139 L 220.10729,145.0139 L 221.46728,149.38954 L 226.2864,149.38954 L 218.80641,128.16175 L 213.69164,128.16175 L 206.12296,149.38954 L 210.79425,149.38954 L 212.27251,145.0139 z M 216.17512,132.9513 L 216.23424,132.9513 L 218.86554,141.34781 L 213.45512,141.34781 L 216.17512,132.9513 z M 242.09388,142.94433 L 242.03476,142.94433 L 233.60868,128.16175 L 228.93739,128.16175 L 228.93739,149.38954 L 233.0765,149.38954 L 233.0765,134.25217 L 233.13563,134.25217 L 241.79824,149.38954 L 246.23301,149.38954 L 246.23301,128.16175 L 242.09388,128.16175 L 242.09388,142.94433 z M 249.41616,142.85564 C 249.38477,143.77162 249.59538,144.77464 250.04798,145.86472 C 250.50058,146.9548 251.38352,147.89869 252.6968,148.6964 C 254.01007,149.49411 255.94203,149.91241 258.49267,149.95128 C 259.18233,149.98377 260.18134,149.85638 261.4897,149.56912 C 262.79804,149.28187 264.00291,148.63983 265.10432,147.64301 C 266.20569,146.64619 266.79079,145.09968 266.85962,143.00346 C 266.80909,141.14148 266.24488,139.80243 265.16701,138.9863 C 264.08909,138.17018 262.80055,137.60722 261.30137,137.29739 L 256.12746,136.02608 C 255.64578,135.94664 255.16042,135.75816 254.67137,135.46065 C 254.18231,135.16316 253.91869,134.61251 253.88051,133.8087 C 253.92915,132.86201 254.33444,132.19803 255.09637,131.81674 C 255.85828,131.43549 256.68487,131.25194 257.57615,131.26609 C 259.44429,131.34002 260.63798,131.75393 261.15723,132.50783 C 261.67646,133.26175 261.93146,133.91219 261.92223,134.45913 L 266.17962,134.45913 C 266.18854,133.5554 265.95056,132.57719 265.46567,131.52451 C 264.98075,130.47186 264.13613,129.56374 262.93182,128.80013 C 261.72749,128.03657 260.05067,127.63653 257.90137,127.60001 C 255.63196,127.6369 253.90623,128.02635 252.72418,128.76838 C 251.54211,129.51045 250.74276,130.3839 250.32611,131.38873 C 249.90946,132.3936 249.71455,133.30866 249.74138,134.13391 C 249.80789,136.38765 250.50268,137.91149 251.82572,138.70543 C 253.14876,139.49938 254.70093,140.05496 256.48223,140.37216 L 258.75876,140.90434 C 259.90193,141.14333 260.82337,141.44145 261.5231,141.79868 C 262.2228,142.15594 262.5825,142.73492 262.60223,143.53564 C 262.54863,144.63325 262.07189,145.37238 261.17202,145.75303 C 260.27211,146.13368 259.27059,146.31107 258.16745,146.2852 C 256.2876,146.21622 255.05818,145.79245 254.4792,145.0139 C 253.90021,144.23535 253.63166,143.51593 253.67355,142.85564 L 249.41616,142.85564 z M 274.75285,145.0139 L 282.58762,145.0139 L 283.94762,149.38954 L 288.76674,149.38954 L 281.28675,128.16175 L 276.17197,128.16175 L 268.60329,149.38954 L 273.27459,149.38954 L 274.75285,145.0139 z M 278.65545,132.9513 L 278.71458,132.9513 L 281.34588,141.34781 L 275.93545,141.34781 L 278.65545,132.9513 z M 290.53076,142.85564 C 290.49937,143.77162 290.70998,144.77464 291.16258,145.86472 C 291.61518,146.9548 292.49812,147.89869 293.8114,148.6964 C 295.12467,149.49411 297.05663,149.91241 299.60727,149.95128 C 300.29693,149.98377 301.29594,149.85638 302.6043,149.56912 C 303.91264,149.28187 305.11751,148.63983 306.21892,147.64301 C 307.32029,146.64619 307.90539,145.09968 307.97422,143.00346 C 307.92369,141.14148 307.35949,139.80243 306.28161,138.9863 C 305.20369,138.17018 303.91515,137.60722 302.41597,137.29739 L 297.24206,136.02608 C 296.76038,135.94664 296.27502,135.75816 295.78597,135.46065 C 295.29691,135.16316 295.03329,134.61251 294.99511,133.8087 C 295.04375,132.86201 295.44904,132.19803 296.21097,131.81674 C 296.97288,131.43549 297.79947,131.25194 298.69075,131.26609 C 300.55889,131.34002 301.75258,131.75393 302.27183,132.50783 C 302.79106,133.26175 303.04606,133.91219 303.03683,134.45913 L 307.29422,134.45913 C 307.30314,133.5554 307.06516,132.57719 306.58027,131.52451 C 306.09535,130.47186 305.25073,129.56374 304.04642,128.80013 C 302.84209,128.03657 301.16527,127.63653 299.01597,127.60001 C 296.74656,127.6369 295.02083,128.02635 293.83878,128.76838 C 292.65671,129.51045 291.85736,130.3839 291.44071,131.38873 C 291.02406,132.3936 290.82915,133.30866 290.85598,134.13391 C 290.92249,136.38765 291.61728,137.91149 292.94032,138.70543 C 294.26336,139.49938 295.81553,140.05496 297.59683,140.37216 L 299.87336,140.90434 C 301.01653,141.14333 301.93798,141.44145 302.6377,141.79868 C 303.3374,142.15594 303.6971,142.73492 303.71683,143.53564 C 303.66323,144.63325 303.18649,145.37238 302.28662,145.75303 C 301.38672,146.13368 300.38519,146.31107 299.28205,146.2852 C 297.4022,146.21622 296.17278,145.79245 295.5938,145.0139 C 295.01481,144.23535 294.74626,143.51593 294.78815,142.85564 L 290.53076,142.85564 z"
+     id="flowRoot2413"
+     style="font-size:28px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;fill:#002868;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Helvetica LT Std;-inkscape-font-specification:Helvetica LT Std Bold" />
+  <path
+     d="M 229.48396,49.981066 L 223.96299,45.981502 L 218.45203,50 L 220.54659,43.508953 L 215.02499,39.505124 L 221.84047,39.493001 L 223.9389,33 L 226.0565,39.483554 L 232.87499,39.474488 L 227.36831,43.49367 L 229.48396,49.981066 z"
+     id="polygon560"
+     style="fill:#fff" />
+  <path
+     d="M 234.96407,190 L 224.99958,197.08113 L 215.02363,190.00635 L 218.8335,201.45872 L 208.86785,208.54737 L 221.18701,208.5442 L 225.00387,220 L 228.80753,208.54568 L 241.13212,208.53711 L 231.16391,201.46111 L 234.96407,190 z"
+     id="path2417"
+     style="fill:#002868" />
+  <path
+     d="M 202.6998,190 L 192.73531,182.91888 L 182.75936,189.99365 L 186.56923,178.54129 L 176.60358,171.45265 L 188.92274,171.4558 L 192.7396,160 L 196.54326,171.45432 L 208.86785,171.46291 L 198.89964,178.5389 L 202.6998,190 z"
+     id="path2421"
+     style="fill:#002868" />
+  <path
+     d="M 215.98107,243.54103 L 211.9815,249.062 L 216,254.57296 L 209.50896,252.4784 L 205.50513,258 L 205.49301,251.18452 L 199,249.0861 L 205.48356,246.96849 L 205.47449,240.15 L 209.49367,245.65668 L 215.98107,243.54103 z"
+     id="path3655"
+     style="fill:#fff" />
+  <path
+     d="M 233.01893,243.54103 L 237.0185,249.062 L 233,254.57296 L 239.49104,252.4784 L 243.49487,258 L 243.50699,251.18452 L 250,249.0861 L 243.51644,246.96849 L 243.52551,240.15 L 239.50633,245.65668 L 233.01893,243.54103 z"
+     id="path3694"
+     style="fill:#fff" />
+  <use
+     transform="translate(64.52842,0)"
+     id="use2413"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#path2421" />
+  <use
+     transform="translate(-32.26415,-85)"
+     id="use2415"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2413" />
+  <use
+     transform="translate(151.47776,-119)"
+     id="use2414"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#path3655" />
+  <use
+     transform="translate(-27,-18)"
+     id="use2416"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2414" />
+  <use
+     transform="translate(-27,-18)"
+     id="use2418"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2416" />
+  <use
+     transform="translate(-27,-17)"
+     id="use2420"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2418" />
+  <use
+     transform="translate(-27,-18)"
+     id="use2422"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2420" />
+  <use
+     transform="translate(-163.47776,108)"
+     id="use2424"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2422" />
+  <use
+     transform="translate(24,16)"
+     id="use2426"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2424" />
+  <use
+     transform="translate(24,16)"
+     id="use2428"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2426" />
+  <use
+     transform="translate(24,17)"
+     id="use2430"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2428" />
+  <use
+     transform="translate(24,16)"
+     id="use2432"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2430" />
+  <use
+     transform="translate(-144,-99.075)"
+     id="use2434"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#path3655" />
+  <use
+     transform="translate(-151,-119)"
+     id="use2460"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#path3694" />
+  <use
+     transform="translate(26.999998,-18)"
+     id="use2462"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2460" />
+  <use
+     transform="translate(27,-18)"
+     id="use2464"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2462" />
+  <use
+     transform="translate(27,-17)"
+     id="use2466"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2464" />
+  <use
+     transform="translate(27,-18)"
+     id="use2468"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2466" />
+  <use
+     transform="translate(187,90.925)"
+     id="use2470"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2468" />
+  <use
+     transform="translate(-24,17.075)"
+     id="use2472"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2470" />
+  <use
+     transform="translate(-24,16)"
+     id="use2474"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2472" />
+  <use
+     transform="translate(-24,16)"
+     id="use2476"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2474" />
+  <use
+     transform="translate(-24,17)"
+     id="use2478"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2476" />
+  <use
+     transform="translate(-24,16)"
+     id="use2480"
+     x="0"
+     y="0"
+     width="450"
+     height="300"
+     xlink:href="#use2478" />
+</svg>

data/app/assets/images/state-flags/az.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="900" height="600" viewBox="-288 -192 576 384" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<path fill="#002868" d="M-288-192h576v384h-576z"/>
+<path fill="#bf0a30" d="M-288-192h576v192h-576z"/>
+<path id="a" d="M288-147v80L0 0zM139-192h83L0 0zM27-192h48L0 0z" fill="#fed700"/>
+<use xlink:href="#a" transform="scale(-1 1)"/>
+<path d="M0-96 62.384582 96-100.689662-23.424331H100.689662L-62.384582 96z" fill="#ce5c17"/>
+</svg>