trek 0.1.25 → 0.1.27

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 71867750da0cef4ae1928a4245e69742d7d32c6614c54da4d107f992da5e0e23
4
- data.tar.gz: 71cb0d0b2ce4098030705245aaf92b50eefec11b4491bc0180e145eeb2f6a8e3
3
+ metadata.gz: 53eb1b618fd47d1aaba94f028d33ff91a4ae1361184149f0ac51a3530392d5db
4
+ data.tar.gz: 772ce6d84a6f4e05eec679089a7428049119b2c178f930a5e9934424d2465717
5
5
  SHA512:
6
- metadata.gz: 0e3a672cb3ebf8abee38d436832d92d3cc5c8bd5502f37344bda47275d4bd090a7326920cd823ed84e30990cd9feb453dddc2e62bfc1d43967de230498fd8287
7
- data.tar.gz: aa4c5e9ee652804fc0361b8ac9e459863f67ff42441484e26fd8387312d8ba70517809b04d81fb68d9b9cab0ea6e6c7a27b943486c80c94b1544678841806fab
6
+ metadata.gz: 4f866c4a665ed0cdd1101385a86edf1264b07b5810e41c5e48399ede3bb25e95912f5b8a0c1153089361b61f4aa535bbced16f2f30d4724a53f78c75bf747faf
7
+ data.tar.gz: 6f9ad9c66a64db021d848dadaf8d6c485497d1e6b49683c01d09623a4c0640a46ce9b2493c5bf2864fd43ebea13f1cef12ce617b10268be516d63e670cd8716e
data/.node-version CHANGED
@@ -1 +1 @@
1
- 22.21.1
1
+ 24.18.0
data/.yarnrc.yml CHANGED
@@ -4,7 +4,7 @@ npmScopes:
4
4
  etaminstudio:
5
5
  npmAlwaysAuth: true
6
6
  npmAuthToken: "${NPM_AUTH_TOKEN-fallback}"
7
- npmPublishRegistry: "https://git.etaminstud.io/api/v4/projects/229/packages/npm/"
7
+ npmPublishRegistry: "https://git.etamin.studio/api/v4/projects/229/packages/npm/"
8
8
 
9
9
  plugins:
10
10
  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
data/AGENTS.md CHANGED
@@ -4,7 +4,7 @@ Guidance for AI coding agents working in this repository. Keep it accurate — u
4
4
 
5
5
  ## What is Trek
6
6
 
7
- Trek is a customizable CMS for Ruby on Rails, shipped as a **Ruby gem** (`trek`) plus a companion **NPM package** (`@etaminstudio/trek`). It's a Rails **engine** (`lib/trek/engine.rb`) that installs a back-office/admin into a host app. Installation and features are driven by Rails generators (`rails g trek:install`, `trek:scaffold`, `trek:admin:user`, …). Authored by Etamin Studio. Private gem hosted on self-hosted GitLab (`git.etaminstud.io`), not public RubyGems.
7
+ Trek is a customizable CMS for Ruby on Rails, shipped as a **Ruby gem** (`trek`) plus a companion **NPM package** (`@etaminstudio/trek`). It's a Rails **engine** (`lib/trek/engine.rb`) that installs a back-office/admin into a host app. Installation and features are driven by Rails generators (`rails g trek:install`, `trek:scaffold`, `trek:admin:user`, …). Authored by Etamin Studio. Private gem hosted on self-hosted GitLab (`git.etamin.studio`), not public RubyGems.
8
8
 
9
9
  ## Tech stack
10
10
 
data/CHANGELOG.md CHANGED
@@ -1,5 +1,32 @@
1
1
  ## [Unreleased]
2
2
 
3
+ ## [0.1.27] - 2026-08-18
4
+
5
+ ### Added
6
+
7
+ - `trek:upgrade:v2` generator: upgrades a host app to Trek 2.0 by switching it from the private GitLab packages to the public ones — the [`trek` gem on RubyGems](https://rubygems.org/gems/trek) and the unscoped [`trek` npm package](https://www.npmjs.com/package/trek). It rewrites the Gemfile (`git:` source → `gem "trek", "~> 2.0"`), drops the `git.etamin.studio` Bundler credentials, swaps the `@etaminstudio/trek` npm dependency and imports for `trek`, cleans the GitLab registry/scope out of `.yarnrc.yml`, and lists the CI credentials to remove manually. (#198) **Upgrade note:** this ships in 0.1.27 — the last version published to the private GitLab sources — so upgrade to it, then run `rails g trek:upgrade:v2` to move to Trek 2.0 and stop depending on the private GitLab sources and their deploy token.
8
+
9
+ ### Changed
10
+
11
+ - `trek:install:ruby` now pins **Ruby 4.0.6** (was 4.0.5), and the CI images (repo + generated `.gitlab-ci.yml` template) use the matching `4.0.6` tag. **Upgrade note:** existing apps can set `4.0.6` in `.ruby-version` and bump the `ci-ruby` image tag in `.gitlab-ci.yml`.
12
+
13
+ ## [0.1.26] - 2026-07-02
14
+
15
+ ### Changed
16
+
17
+ - `Trek::Localization` now resolves the request locale through an overridable `locale_for_request` method (still `params` → `current_user` → `headers` by default). Apps that need another source can override it and fall back to the default chain with `super` instead of forking the whole concern — e.g. `def locale_for_request = Current.event&.locale.presence || super`. No behavior change for existing consumers.
18
+ - `trek:install:authentication` no longer injects `generates_token_for` declarations into the generated `User`: `:password_reset` (15 min) is provided automatically by Rails' `has_secure_password`, and `:invite` (1 week) now lives in the `Trek::Users::Invitable` concern (which owns the rest of the invite behaviour). **Upgrade note:** existing apps can delete both `generates_token_for` blocks from their `User` — Rails and the concern provide them; customise the reset window via `has_secure_password reset_token: { expires_in: … }` if needed.
19
+ - `trek:install:ruby` now pins **Ruby 4.0.5** (was 4.0.0), and the CI images (repo + generated `.gitlab-ci.yml` template) use the matching `4.0.5` tag. **Upgrade note:** existing apps can set `4.0.5` in `.ruby-version` and bump the `ci-ruby` image tag in `.gitlab-ci.yml`.
20
+ - `trek:install:yarn` now installs **Yarn 4.17.0** (was 3.8.7) and no longer imports the `interactive-tools` plugin, whose `upgrade-interactive` command is built into Yarn 4. Yarn 4 is also what supports the minimal-age-gate exception below. **Upgrade note:** existing apps can upgrade with `yarn set version 4.17.0` followed by `yarn install`, and drop the now-redundant `interactive-tools` plugin.
21
+ - Bumped **Node to 24.18.0** (was 22.21.1) in `.node-version` and the CI images (repo + generated `.gitlab-ci.yml` template, now `ci-ruby/node-24`). **Upgrade note:** existing apps can set `24.18.0` in `.node-version` and bump the `ci-ruby/node-*` image in `.gitlab-ci.yml`.
22
+ - CI now runs `i18n-tasks missing -t diff` (config in `config/i18n-tasks.yml`) so a base-locale key with no translation in another locale fails the build. (Full `health` isn't used: as an engine, Trek's keys are consumed by host apps and many components/templates use relative keys that only resolve there.)
23
+
24
+ ### Fixed
25
+
26
+ - Added the missing French translations that fell back to English: `admin.dialog_component.{title,text}` (the confirmation dialog shown on every destroy action) and `admin.{pages,fragments}.{show.intro,reorder.success,search.alert}`. Also added the English `admin.section`/`admin.sections` flash messages that previously existed only in French. (#194)
27
+ - `trek:install:yarn` now exempts the `@etaminstudio` scope from Yarn's minimal-age gate (`npmMinimalAgeGate: 0` under `npmScopes.etaminstudio` in the generated `.yarnrc.yml`), so a freshly published `@etaminstudio/trek` release installs without being quarantined; the gate still applies to public packages. **Upgrade note:** existing apps can add `npmMinimalAgeGate: 0` under `npmScopes.etaminstudio` in their `.yarnrc.yml`.
28
+ - `trek:install:locales` no longer generates an invalid `config/initializers/locales.rb` (`I18n.available_locales = [:]` / `I18n.default_locale = :`) when passed no or blank locales. A blank option/env now falls back to the default (`en, fr`), blank entries are dropped, and the list can never end up empty. (#169)
29
+
3
30
  ## [0.1.25] - 2026-07-01
4
31
 
5
32
  ### Added
@@ -20,6 +47,12 @@
20
47
  - `trek:install` now adds a `!/.env.example` exception to `.gitignore` so the generated `.env.example` template stays tracked (Rails ignores all `/.env*` files by default).
21
48
  - `trek:install:postmark` now matches the production.rb SMTP comment with or without the `bin/` prefix, so the Postmark config is injected on Rails 8.0 as well as 8.1 (previously the injection silently did nothing when the anchor did not match).
22
49
 
50
+ ## [0.1.8] - 2025-09-03
51
+
52
+ ### Fixed
53
+
54
+ - _(documented retroactively, 2026-07-27)_ Removed the dead `option :items` from `Trek::ListComponent`, which collided with its `renders_many :items` slot. This turned out to fix a serious incompatibility: since view_component **3.15.0**, slot readers are defined in an included module, so the dry-initializer option reader (defaulting to `[]`) shadows the slot reader — `items` always returns `[]` and **every `ListComponent` list renders its empty state**, i.e. all admin index pages look empty regardless of data or permissions (tree-based indexes like pages are unaffected). With view_component ≤ 3.14 the slot reader happened to overwrite the option reader, masking the collision. **Upgrade note:** apps pinned to Trek < 0.1.8 that bump view_component to ≥ 3.15 (e.g. for its security fixes) hit this immediately; until they can upgrade Trek, they can restore the slot reader with an initializer: `Rails.application.config.to_prepare { Trek::ListComponent.class_eval { def items = get_slot(:items) } }`.
55
+
23
56
  ## [0.0.1] - 2023-01-24
24
57
 
25
58
  - Initial release
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- trek (0.1.25)
4
+ trek (0.1.27)
5
5
  action_policy (~> 0.6)
6
6
  actioncable
7
7
  acts_as_list (~> 1.1)
@@ -39,29 +39,29 @@ GEM
39
39
  ruby-next-core (>= 1.0)
40
40
  action_text-trix (2.1.18)
41
41
  railties
42
- actioncable (8.1.3)
43
- actionpack (= 8.1.3)
44
- activesupport (= 8.1.3)
42
+ actioncable (8.1.3.1)
43
+ actionpack (= 8.1.3.1)
44
+ activesupport (= 8.1.3.1)
45
45
  nio4r (~> 2.0)
46
46
  websocket-driver (>= 0.6.1)
47
47
  zeitwerk (~> 2.6)
48
- actionmailbox (8.1.3)
49
- actionpack (= 8.1.3)
50
- activejob (= 8.1.3)
51
- activerecord (= 8.1.3)
52
- activestorage (= 8.1.3)
53
- activesupport (= 8.1.3)
48
+ actionmailbox (8.1.3.1)
49
+ actionpack (= 8.1.3.1)
50
+ activejob (= 8.1.3.1)
51
+ activerecord (= 8.1.3.1)
52
+ activestorage (= 8.1.3.1)
53
+ activesupport (= 8.1.3.1)
54
54
  mail (>= 2.8.0)
55
- actionmailer (8.1.3)
56
- actionpack (= 8.1.3)
57
- actionview (= 8.1.3)
58
- activejob (= 8.1.3)
59
- activesupport (= 8.1.3)
55
+ actionmailer (8.1.3.1)
56
+ actionpack (= 8.1.3.1)
57
+ actionview (= 8.1.3.1)
58
+ activejob (= 8.1.3.1)
59
+ activesupport (= 8.1.3.1)
60
60
  mail (>= 2.8.0)
61
61
  rails-dom-testing (~> 2.2)
62
- actionpack (8.1.3)
63
- actionview (= 8.1.3)
64
- activesupport (= 8.1.3)
62
+ actionpack (8.1.3.1)
63
+ actionview (= 8.1.3.1)
64
+ activesupport (= 8.1.3.1)
65
65
  nokogiri (>= 1.8.5)
66
66
  rack (>= 2.2.4)
67
67
  rack-session (>= 1.0.1)
@@ -69,36 +69,36 @@ GEM
69
69
  rails-dom-testing (~> 2.2)
70
70
  rails-html-sanitizer (~> 1.6)
71
71
  useragent (~> 0.16)
72
- actiontext (8.1.3)
72
+ actiontext (8.1.3.1)
73
73
  action_text-trix (~> 2.1.15)
74
- actionpack (= 8.1.3)
75
- activerecord (= 8.1.3)
76
- activestorage (= 8.1.3)
77
- activesupport (= 8.1.3)
74
+ actionpack (= 8.1.3.1)
75
+ activerecord (= 8.1.3.1)
76
+ activestorage (= 8.1.3.1)
77
+ activesupport (= 8.1.3.1)
78
78
  globalid (>= 0.6.0)
79
79
  nokogiri (>= 1.8.5)
80
- actionview (8.1.3)
81
- activesupport (= 8.1.3)
80
+ actionview (8.1.3.1)
81
+ activesupport (= 8.1.3.1)
82
82
  builder (~> 3.1)
83
83
  erubi (~> 1.11)
84
84
  rails-dom-testing (~> 2.2)
85
85
  rails-html-sanitizer (~> 1.6)
86
- activejob (8.1.3)
87
- activesupport (= 8.1.3)
86
+ activejob (8.1.3.1)
87
+ activesupport (= 8.1.3.1)
88
88
  globalid (>= 0.3.6)
89
- activemodel (8.1.3)
90
- activesupport (= 8.1.3)
91
- activerecord (8.1.3)
92
- activemodel (= 8.1.3)
93
- activesupport (= 8.1.3)
89
+ activemodel (8.1.3.1)
90
+ activesupport (= 8.1.3.1)
91
+ activerecord (8.1.3.1)
92
+ activemodel (= 8.1.3.1)
93
+ activesupport (= 8.1.3.1)
94
94
  timeout (>= 0.4.0)
95
- activestorage (8.1.3)
96
- actionpack (= 8.1.3)
97
- activejob (= 8.1.3)
98
- activerecord (= 8.1.3)
99
- activesupport (= 8.1.3)
95
+ activestorage (8.1.3.1)
96
+ actionpack (= 8.1.3.1)
97
+ activejob (= 8.1.3.1)
98
+ activerecord (= 8.1.3.1)
99
+ activesupport (= 8.1.3.1)
100
100
  marcel (~> 1.0)
101
- activesupport (8.1.3)
101
+ activesupport (8.1.3.1)
102
102
  base64
103
103
  bigdecimal
104
104
  concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -158,7 +158,7 @@ GEM
158
158
  activerecord (>= 7.2.0)
159
159
  with_advisory_lock (>= 7.0.0)
160
160
  zeitwerk (~> 2.7)
161
- concurrent-ruby (1.3.7)
161
+ concurrent-ruby (1.3.8)
162
162
  connection_pool (3.0.2)
163
163
  content_disposition (1.0.0)
164
164
  crass (1.0.7)
@@ -213,7 +213,7 @@ GEM
213
213
  htmlbeautifier (1.4.3)
214
214
  htmlentities (4.3.4)
215
215
  http_accept_language (2.1.1)
216
- i18n (1.14.8)
216
+ i18n (1.15.2)
217
217
  concurrent-ruby (~> 1.0)
218
218
  i18n-tasks (1.1.2)
219
219
  activesupport (>= 4.0.2)
@@ -237,7 +237,7 @@ GEM
237
237
  rdoc (>= 4.0.0)
238
238
  reline (>= 0.4.2)
239
239
  jmespath (1.6.2)
240
- json (2.19.5)
240
+ json (2.21.2)
241
241
  kaminari (1.2.2)
242
242
  activesupport (>= 4.1.0)
243
243
  kaminari-actionview (= 1.2.2)
@@ -256,7 +256,7 @@ GEM
256
256
  rb-fsevent (~> 0.10, >= 0.10.3)
257
257
  rb-inotify (~> 0.9, >= 0.9.10)
258
258
  logger (1.7.0)
259
- loofah (2.25.1)
259
+ loofah (2.25.2)
260
260
  crass (~> 1.0.2)
261
261
  nokogiri (>= 1.12.0)
262
262
  lookbook (2.3.14)
@@ -271,7 +271,7 @@ GEM
271
271
  view_component (>= 2.0)
272
272
  yard (~> 0.9)
273
273
  zeitwerk (~> 2.5)
274
- mail (2.9.0)
274
+ mail (2.9.1)
275
275
  logger
276
276
  mini_mime (>= 0.1.1)
277
277
  net-imap
@@ -331,20 +331,20 @@ GEM
331
331
  rack (>= 1.3)
332
332
  rackup (2.3.1)
333
333
  rack (>= 3)
334
- rails (8.1.3)
335
- actioncable (= 8.1.3)
336
- actionmailbox (= 8.1.3)
337
- actionmailer (= 8.1.3)
338
- actionpack (= 8.1.3)
339
- actiontext (= 8.1.3)
340
- actionview (= 8.1.3)
341
- activejob (= 8.1.3)
342
- activemodel (= 8.1.3)
343
- activerecord (= 8.1.3)
344
- activestorage (= 8.1.3)
345
- activesupport (= 8.1.3)
334
+ rails (8.1.3.1)
335
+ actioncable (= 8.1.3.1)
336
+ actionmailbox (= 8.1.3.1)
337
+ actionmailer (= 8.1.3.1)
338
+ actionpack (= 8.1.3.1)
339
+ actiontext (= 8.1.3.1)
340
+ actionview (= 8.1.3.1)
341
+ activejob (= 8.1.3.1)
342
+ activemodel (= 8.1.3.1)
343
+ activerecord (= 8.1.3.1)
344
+ activestorage (= 8.1.3.1)
345
+ activesupport (= 8.1.3.1)
346
346
  bundler (>= 1.15.0)
347
- railties (= 8.1.3)
347
+ railties (= 8.1.3.1)
348
348
  rails-dom-testing (2.3.0)
349
349
  activesupport (>= 5.0.0)
350
350
  minitest
@@ -352,15 +352,15 @@ GEM
352
352
  rails-healthcheck (1.4.0)
353
353
  actionpack
354
354
  railties
355
- rails-html-sanitizer (1.7.0)
356
- loofah (~> 2.25)
355
+ rails-html-sanitizer (1.7.1)
356
+ loofah (~> 2.25, >= 2.25.2)
357
357
  nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
358
358
  rails-i18n (8.1.0)
359
359
  i18n (>= 0.7, < 2)
360
360
  railties (>= 8.0.0, < 9)
361
- railties (8.1.3)
362
- actionpack (= 8.1.3)
363
- activesupport (= 8.1.3)
361
+ railties (8.1.3.1)
362
+ actionpack (= 8.1.3.1)
363
+ activesupport (= 8.1.3.1)
364
364
  irb (~> 1.13)
365
365
  rackup (>= 1.0.0)
366
366
  rake (>= 12.2)
@@ -498,7 +498,7 @@ GEM
498
498
  unicode-emoji (4.2.0)
499
499
  uri (1.1.1)
500
500
  useragent (0.16.11)
501
- view_component (4.10.0)
501
+ view_component (4.12.0)
502
502
  actionview (>= 7.1.0)
503
503
  activesupport (>= 7.1.0)
504
504
  concurrent-ruby (~> 1)
@@ -507,7 +507,7 @@ GEM
507
507
  activesupport (>= 7.2.0, < 8.2)
508
508
  view_component (>= 2.34.0, < 5.0)
509
509
  zeitwerk (~> 2.5)
510
- websocket-driver (0.8.0)
510
+ websocket-driver (0.8.2)
511
511
  base64
512
512
  websocket-extensions (>= 0.1.0)
513
513
  websocket-extensions (0.1.5)
@@ -520,6 +520,7 @@ GEM
520
520
  zeitwerk (2.7.5)
521
521
 
522
522
  PLATFORMS
523
+ arm64-darwin-23
523
524
  arm64-darwin-24
524
525
  x86_64-darwin-21
525
526
  x86_64-darwin-22
data/Makefile CHANGED
@@ -1,4 +1,4 @@
1
- .PHONY: all
1
+ .PHONY: *
2
2
 
3
3
  release:
4
4
  @read -p "New version (current: $$(sed -n 's/.*VERSION = "\(.*\)"/\1/p' lib/trek/version.rb)): " version; \
@@ -11,3 +11,25 @@ release:
11
11
  git commit -m "Version $$version"; \
12
12
  bundle exec rake release; \
13
13
  yarn npm publish
14
+
15
+ audit-fix:
16
+ @out=$$(bundle exec bundle-audit check --update 2>&1); \
17
+ echo "$$out"; echo; \
18
+ gems=$$(echo "$$out" | awk '/^Name: /{print $$2}' | sort -u); \
19
+ if [ -z "$$gems" ]; then \
20
+ echo "No vulnerable gems 🎉"; \
21
+ else \
22
+ echo "Vulnerable gems: $$gems"; \
23
+ bundle update --conservative $$gems; \
24
+ if ! bundle exec bundle-audit check; then \
25
+ echo "Still vulnerable after update — the resolver may have picked an old version; add a version floor in the Gemfile (e.g. gem \"foo\", \">= x.y\") and retry"; \
26
+ git checkout Gemfile.lock; \
27
+ exit 1; \
28
+ elif git diff --quiet Gemfile.lock; then \
29
+ echo "Gemfile.lock unchanged — a version cap may be blocking the fix; try adding the capping gem to 'bundle update'"; \
30
+ else \
31
+ git add Gemfile.lock && \
32
+ git commit -m "Upgrade $$(echo $$gems | sed 's/ /, /g') (CVE)" && \
33
+ git push; \
34
+ fi; \
35
+ fi
data/README.md CHANGED
@@ -52,7 +52,7 @@ Create your Rails project (replace `helloworld` with your own project name):
52
52
  rails new $TREK_PROJECT_NAME -j esbuild -d postgresql --skip-action-mailbox --skip-action-text --skip-action-cable --skip-active-storage --skip-jbuilder --skip-test --skip-system-test
53
53
  cd $TREK_PROJECT_NAME
54
54
 
55
- [Create a deploy token](https://git.etaminstud.io/etaminstudio/trek/-/settings/repository#js-deploy-tokens) associated to Trek project:
55
+ [Create a deploy token](https://git.etamin.studio/etaminstudio/trek/-/settings/repository#js-deploy-tokens) associated to Trek project:
56
56
 
57
57
  - Name: `helloworld` (replace with your project name)
58
58
  - Username: `helloworld` (replace with your project name)
@@ -66,11 +66,11 @@ Copy the generated token to an ENV variable (replace `XXXXXXXXXXX` with the toke
66
66
 
67
67
  Add this deploy token to your project local config:
68
68
 
69
- bundle config git.etaminstud.io $TREK_PROJECT_NAME:$TREK_DEPLOY_TOKEN
69
+ bundle config git.etamin.studio $TREK_PROJECT_NAME:$TREK_DEPLOY_TOKEN
70
70
 
71
71
  Install the gem and add it to the application's Gemfile by running:
72
72
 
73
- bundle add trek --git https://git.etaminstud.io/etaminstudio/trek.git --branch main
73
+ bundle add trek --git https://git.etamin.studio/etaminstudio/trek.git --branch main
74
74
 
75
75
  ### Install the NPM package
76
76
 
@@ -176,7 +176,7 @@ Let's use [Bundler `local` feature](https://bundler.io/v2.7/man/bundle-config.1.
176
176
 
177
177
  First, make sure you're pointing to Trek's git repo main branch in your `Gemfile`:
178
178
 
179
- gem "trek", git: "git@git.etaminstud.io:etaminstudio/trek.git", branch: :main
179
+ gem "trek", git: "git@git.etamin.studio:etaminstudio/trek.git", branch: :main
180
180
 
181
181
  Navigate to your project, then configure the local version of Trek:
182
182
 
@@ -229,4 +229,4 @@ This will:
229
229
  3. Run `bundle` to update the lockfile
230
230
  4. Commit all changes with message "Version X.Y.Z"
231
231
  5. Run `bundle exec rake release` (creates git tag, pushes commits/tag, pushes gem to [rubygems.org](https://rubygems.org))
232
- 6. Run `yarn npm publish` (publishes the npm package). This requires a [personal token](https://git.etaminstud.io/-/user_settings/personal_access_tokens) with the `api` scope to be present in `NPM_AUTH_TOKEN`,
232
+ 6. Run `yarn npm publish` (publishes the npm package). This requires a [personal token](https://git.etamin.studio/-/user_settings/personal_access_tokens) with the `api` scope to be present in `NPM_AUTH_TOKEN`,
@@ -10,13 +10,25 @@ module Trek
10
10
 
11
11
  def set_locale
12
12
  old_locale = I18n.locale
13
- I18n.locale = locale_from_params || locale_from_current_user || locale_from_headers
13
+ I18n.locale = locale_for_request
14
14
 
15
15
  yield
16
16
  ensure
17
17
  I18n.locale = old_locale
18
18
  end
19
19
 
20
+ # The locale a request is answered in. Overridable seam: an app can prepend
21
+ # its own source (e.g. the locale of the event a request belongs to) and
22
+ # fall back to this default chain with `super`, rather than forking the
23
+ # whole concern:
24
+ #
25
+ # def locale_for_request
26
+ # Current.event&.locale.presence || super
27
+ # end
28
+ def locale_for_request
29
+ locale_from_params || locale_from_current_user || locale_from_headers
30
+ end
31
+
20
32
  def locale_from_params
21
33
  params[:locale]
22
34
  end
@@ -9,6 +9,14 @@ module Trek
9
9
  attribute :send_invite, :boolean
10
10
 
11
11
  after_create :send_invite_email, if: :send_invite
12
+
13
+ # Invite links last a week and invalidate once the password is set
14
+ # (password_salt), so a used invite can't be replayed. A distinct,
15
+ # longer-lived purpose than :password_reset. Assumes the including model
16
+ # has has_secure_password.
17
+ generates_token_for :invite, expires_in: 1.week do
18
+ password_salt&.last(10)
19
+ end
12
20
  end
13
21
 
14
22
  private
@@ -0,0 +1,21 @@
1
+ # i18n-tasks config for the Trek engine.
2
+ #
3
+ # Trek ships translations for host apps, so the usual "unused key" and code
4
+ # scan checks don't apply here (keys are used by generated apps, and many
5
+ # components/templates use relative keys that only resolve in the host). What
6
+ # we do want to guard is locale parity: every key present in the base locale
7
+ # must be translated in the others. `i18n-tasks missing -t diff` enforces that.
8
+ base_locale: en
9
+ locales:
10
+ - en
11
+ - fr
12
+
13
+ data:
14
+ read:
15
+ - config/locales/trek.%{locale}.yml
16
+
17
+ # The gendered resource-label variants (f/m/m_alt) only exist in locales whose
18
+ # models declare a gender; English always resolves to `n` (see i18n_model_gender),
19
+ # so it intentionally omits them.
20
+ ignore_missing:
21
+ - "admin.actions.*_resource.{f,m,m_alt}"
@@ -155,6 +155,14 @@ en:
155
155
  search_component:
156
156
  search: Search
157
157
  search_user: Search for a user with an email
158
+ section:
159
+ destroy:
160
+ confirm: Are you sure you want to delete this section? This operation is irreversible.
161
+ sections:
162
+ create:
163
+ success: Section added
164
+ update:
165
+ success: Section updated
158
166
  seo: SEO
159
167
  settings: Settings
160
168
  user_password_resets:
@@ -86,6 +86,9 @@ fr:
86
86
  index:
87
87
  intro: Accès rapide aux fonctions-clés d'administration de votre appli
88
88
  title: Raccourcis
89
+ dialog_component:
90
+ text: Cette action est irréversible.
91
+ title: Êtes-vous sûr·e ?
89
92
  errors:
90
93
  message:
91
94
  one: 1 erreur détectée
@@ -106,6 +109,12 @@ fr:
106
109
  intro: Gestion des fragments de contenu utilisés sur le site
107
110
  new:
108
111
  intro: Ajout d'un fragment de contenu au site
112
+ reorder:
113
+ success: Fragments réorganisés
114
+ search:
115
+ alert: Fragment non trouvé avec ce titre
116
+ show:
117
+ intro: Fragment
109
118
  update:
110
119
  success: Fragment mis à jour
111
120
  navigation: Navigation
@@ -122,6 +131,12 @@ fr:
122
131
  intro: Gestion des pages du site
123
132
  new:
124
133
  intro: Ajout d'une page au site
134
+ reorder:
135
+ success: Pages réorganisées
136
+ search:
137
+ alert: Page non trouvée avec ce titre
138
+ show:
139
+ intro: Page
125
140
  update:
126
141
  success: Page mise à jour
127
142
  panels:
@@ -48,7 +48,7 @@ cd $TREK_PROJECT_NAME
48
48
 
49
49
  ## Get access to Trek
50
50
 
51
- Trek is distributed as a gem and an NPM package from Etamin Studio's GitLab. [Create a deploy token](https://git.etaminstud.io/etaminstudio/trek/-/settings/repository#js-deploy-tokens) associated to the Trek project:
51
+ Trek is distributed as a gem and an NPM package from Etamin Studio's GitLab. [Create a deploy token](https://git.etamin.studio/etaminstudio/trek/-/settings/repository#js-deploy-tokens) associated to the Trek project:
52
52
 
53
53
  - **Name**: your project name (e.g. `helloworld`)
54
54
  - **Username**: your project name (e.g. `helloworld`)
@@ -65,13 +65,13 @@ export TREK_DEPLOY_TOKEN=XXXXXXXXXXX
65
65
  Add the deploy token to your project's local Bundler config:
66
66
 
67
67
  ```sh
68
- bundle config git.etaminstud.io $TREK_PROJECT_NAME:$TREK_DEPLOY_TOKEN
68
+ bundle config git.etamin.studio $TREK_PROJECT_NAME:$TREK_DEPLOY_TOKEN
69
69
  ```
70
70
 
71
71
  Install the gem and add it to your `Gemfile`:
72
72
 
73
73
  ```sh
74
- bundle add trek --git https://git.etaminstud.io/etaminstudio/trek.git --branch main
74
+ bundle add trek --git https://git.etamin.studio/etaminstudio/trek.git --branch main
75
75
  ```
76
76
 
77
77
  Prepare the NPM package installation:
@@ -66,18 +66,10 @@ module Trek
66
66
  def user_model_injection
67
67
  <<-RUBY
68
68
  has_secure_password
69
+ # Token purposes: :password_reset (15 min) comes from has_secure_password;
70
+ # :invite (1 week) comes from Trek::Users::Invitable.
69
71
  has_many :user_sessions, dependent: :destroy
70
72
 
71
- # Both tokens invalidate once the password changes (password_salt). Invites
72
- # get a longer window than a password reset, so they are a distinct purpose.
73
- generates_token_for :password_reset, expires_in: 15.minutes do
74
- password_salt&.last(10)
75
- end
76
-
77
- generates_token_for :invite, expires_in: 1.week do
78
- password_salt&.last(10)
79
- end
80
-
81
73
  scope :privileged, -> { where(role: Trek::Users::Roles::PRIVILEGED_ROLES) }
82
74
 
83
75
  RUBY
@@ -12,18 +12,24 @@ module Trek
12
12
 
13
13
  source_root File.expand_path("../templates", __dir__)
14
14
 
15
+ DEFAULT_LOCALES = "en, fr".freeze
16
+
15
17
  class_option :locales, type: :string,
16
- desc: "Comma-separated locales to enable, e.g. en,fr (default: en)"
18
+ desc: "Comma-separated locales to enable, e.g. en,fr (default: en, fr)"
17
19
 
18
20
  def set_locales
19
- raw = options[:locales] || ENV["TREK_LOCALES"] || "en"
20
- @locales = raw.split(",").map(&:strip)
21
+ # `.presence` so a blank option/env (e.g. an empty answer) falls back
22
+ # to the default instead of producing an empty, invalid initializer.
23
+ raw = options[:locales].presence || ENV["TREK_LOCALES"].presence || DEFAULT_LOCALES
24
+ @locales = raw.split(",").map(&:strip).reject(&:blank?)
21
25
 
22
26
  invalid = @locales.reject { |locale| valid_locales?(locale) }
23
- return if invalid.empty?
27
+ if invalid.any?
28
+ say "Ignoring unavailable locales: #{invalid.join(", ")}", :yellow
29
+ @locales -= invalid
30
+ end
24
31
 
25
- say "Ignoring unavailable locales: #{invalid.join(", ")}", :yellow
26
- @locales -= invalid
32
+ # Never leave the list empty — that would generate `[:]` / `:`.
27
33
  @locales = ["en"] if @locales.empty?
28
34
  end
29
35
 
@@ -5,7 +5,7 @@ module Trek
5
5
  module Generators
6
6
  module Install
7
7
  class RubyGenerator < Rails::Generators::Base
8
- RUBY_VERSION = "4.0.0"
8
+ RUBY_VERSION = "4.0.6"
9
9
 
10
10
  include Trek::Generators::Helpers
11
11
 
@@ -5,7 +5,7 @@ module Trek
5
5
  module Generators
6
6
  module Install
7
7
  class YarnGenerator < Rails::Generators::Base
8
- YARN_VERSION = "3.8.7"
8
+ YARN_VERSION = "4.17.0"
9
9
 
10
10
  include Trek::Generators::Helpers
11
11
 
@@ -41,10 +41,6 @@ module Trek
41
41
  end
42
42
  end
43
43
 
44
- def add_interactive_tools_plugin
45
- run "yarn plugin import interactive-tools"
46
- end
47
-
48
44
  # The default bin/setup (generated by `rails new -j esbuild`) runs
49
45
  # `yarn install --check-files`, but `--check-files` is not a valid flag
50
46
  # under Yarn berry (the version we pin above), so it breaks `bin/setup`
@@ -60,13 +56,16 @@ module Trek
60
56
  nodeLinker: node-modules
61
57
 
62
58
  npmRegistries:
63
- //git.etaminstud.io/api/v4/packages/npm:
59
+ //git.etamin.studio/api/v4/packages/npm:
64
60
  npmAlwaysAuth: true
65
61
  npmAuthToken: "${NPM_AUTH_TOKEN-fallback}"
66
62
 
67
63
  npmScopes:
68
64
  etaminstudio:
69
- npmRegistryServer: "https://git.etaminstud.io/api/v4/packages/npm"
65
+ npmRegistryServer: "https://git.etamin.studio/api/v4/packages/npm"
66
+ # Our own registry — skip Yarn's minimal-age gate so a freshly
67
+ # published Trek release installs without the quarantine delay.
68
+ npmMinimalAgeGate: 0
70
69
  YAML
71
70
  end
72
71
 
@@ -20,7 +20,7 @@ stages:
20
20
 
21
21
  # Defaults
22
22
  default:
23
- image: registry.git.etaminstud.io/devops/ci-ruby/node-22:4.0.0
23
+ image: registry.git.etamin.studio/devops/ci-ruby/node-24:4.0.6
24
24
 
25
25
  services:
26
26
  - postgres:16
@@ -30,6 +30,28 @@ scan:
30
30
  bundle exec brakeman
31
31
  bundle exec bundle-audit check --update
32
32
 
33
+ audit-fix:
34
+ @out=$$(bundle exec bundle-audit check --update 2>&1); \
35
+ echo "$$out"; echo; \
36
+ gems=$$(echo "$$out" | awk '/^Name: /{print $$2}' | sort -u); \
37
+ if [ -z "$$gems" ]; then \
38
+ echo "No vulnerable gems 🎉"; \
39
+ else \
40
+ echo "Vulnerable gems: $$gems"; \
41
+ bundle update --conservative $$gems; \
42
+ if ! bundle exec bundle-audit check; then \
43
+ echo "Still vulnerable after update — the resolver may have picked an old version; add a version floor in the Gemfile (e.g. gem \"foo\", \">= x.y\") and retry"; \
44
+ git checkout Gemfile.lock; \
45
+ exit 1; \
46
+ elif git diff --quiet Gemfile.lock; then \
47
+ echo "Gemfile.lock unchanged — a version cap may be blocking the fix; try adding the capping gem to 'bundle update'"; \
48
+ else \
49
+ git add Gemfile.lock && \
50
+ git commit -m "Upgrade $$(echo $$gems | sed 's/ /, /g') (CVE)" && \
51
+ git push; \
52
+ fi; \
53
+ fi
54
+
33
55
  test:
34
56
  overmind run bundle exec rails spec
35
57
  spec: test
@@ -0,0 +1,87 @@
1
+ require "rails/generators/actions"
2
+ require "generators/trek/helpers"
3
+ require "yaml"
4
+
5
+ module Trek
6
+ module Generators
7
+ module Upgrade
8
+ # The Trek 2.0 upgrade: switches a host app from the private GitLab packages (git-sourced gem +
9
+ # @etaminstudio/trek on the GitLab npm registry) to the public ones: the
10
+ # trek gem on RubyGems and the unscoped trek package on npmjs.com.
11
+ class V2Generator < Rails::Generators::Base
12
+ # 2.0.0 is the first version published to RubyGems + npmjs.com (the
13
+ # public npm "trek" name starts there — see the 2.0.0 changelog entry),
14
+ # hence a hardcoded floor rather than Trek::VERSION.
15
+ GEM_REQUIREMENT = "~> 2.0"
16
+ NPM_REQUIREMENT = "^2.0.0"
17
+
18
+ include Trek::Generators::Helpers
19
+
20
+ desc "Upgrade to Trek 2.0: switch the trek gem and npm package from the private GitLab sources to RubyGems and npmjs.com."
21
+
22
+ def switch_gemfile_to_rubygems
23
+ gsub_file "Gemfile", /^gem ["']trek["'],.*$/, %(gem "trek", "#{GEM_REQUIREMENT}")
24
+ end
25
+
26
+ def remove_bundler_credentials
27
+ run "bundle config unset git.etamin.studio"
28
+ end
29
+
30
+ def install_gems
31
+ bundle_install
32
+ end
33
+
34
+ def rename_npm_dependency
35
+ gsub_file "package.json", %r{"@etaminstudio/trek":}, '"trek":'
36
+ end
37
+
38
+ def rewrite_imports
39
+ Dir.glob("app/javascript/**/*.js").each do |file|
40
+ next unless File.read(file).include?("@etaminstudio/trek")
41
+
42
+ gsub_file file, %r{(["'])@etaminstudio/trek(["'/])}, '\1trek\2'
43
+ end
44
+ end
45
+
46
+ def clean_yarnrc
47
+ return unless File.exist?(".yarnrc.yml")
48
+
49
+ # Drop the etaminstudio scope and the git.etamin.studio registry
50
+ # entries (registry server, auth token, minimal-age-gate exemption).
51
+ # Text-based so the rest of the file keeps its comments and layout,
52
+ # but YAML-checked: parent keys are only removed once a parse proves
53
+ # they are empty, and nothing is written if the result doesn't parse.
54
+ content = File.read(".yarnrc.yml")
55
+ .gsub(%r{ "?//git\.etamin\.studio[^\n]*:\n(?: [^\n]*\n)*}, "")
56
+ .gsub(/ etaminstudio:\n(?: [^\n]*\n)*/, "")
57
+
58
+ %w[npmRegistries npmScopes].each do |key|
59
+ content.sub!(/^#{key}:\n/, "") if YAML.safe_load(content)&.fetch(key, :absent).nil?
60
+ end
61
+ content.gsub!(/\n{3,}/, "\n\n")
62
+
63
+ create_file ".yarnrc.yml", content, force: true
64
+ rescue Psych::Exception
65
+ say "Could not safely edit .yarnrc.yml — remove the git.etamin.studio registry " \
66
+ "and the etaminstudio scope manually.", :yellow
67
+ end
68
+
69
+ def install_npm_package
70
+ install_npm_dependencies({ "trek" => NPM_REQUIREMENT })
71
+ end
72
+
73
+ def summary
74
+ say <<~SUMMARY
75
+
76
+ The trek gem now comes from RubyGems and the trek npm package from npmjs.com.
77
+
78
+ Manual follow-ups:
79
+ * Remove the NPM_AUTH_TOKEN variable and the Bundler credentials for
80
+ git.etamin.studio (BUNDLE_GIT__ETAMIN__STUDIO) from your CI settings.
81
+ * Once every app is migrated, revoke the Trek deploy token on GitLab.
82
+ SUMMARY
83
+ end
84
+ end
85
+ end
86
+ end
87
+ end
data/lib/trek/version.rb CHANGED
@@ -1,5 +1,5 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module Trek
4
- VERSION = "0.1.25"
4
+ VERSION = "0.1.27"
5
5
  end
data/package.json CHANGED
@@ -1,11 +1,11 @@
1
1
  {
2
2
  "name": "@etaminstudio/trek",
3
- "version": "0.1.25",
3
+ "version": "0.1.27",
4
4
  "description": "A modern CMS for Ruby on Rails",
5
5
  "main": "app/javascript/trek.js",
6
6
  "repository": {
7
7
  "type": "git",
8
- "url": "git@git.etaminstud.io:etaminstudio/trek.git"
8
+ "url": "git@git.etamin.studio:etaminstudio/trek.git"
9
9
  },
10
10
  "author": "Etamin Studio",
11
11
  "dependencies": {
data/yarn.lock CHANGED
@@ -4693,12 +4693,12 @@ __metadata:
4693
4693
  languageName: node
4694
4694
  linkType: hard
4695
4695
 
4696
- "nanoid@npm:^3.3.12":
4697
- version: 3.3.12
4698
- resolution: "nanoid@npm:3.3.12"
4696
+ "nanoid@npm:^3.3.16":
4697
+ version: 3.3.16
4698
+ resolution: "nanoid@npm:3.3.16"
4699
4699
  bin:
4700
4700
  nanoid: bin/nanoid.cjs
4701
- checksum: 38699257447dc59e21e73e0510d0dfb16b7a610d9ca80633d5c3a68f9b4298c990513d30404ca8f163c2d03225ee01695ff8898bea6179183f38f0477b7635ac
4701
+ checksum: 2489d8f87f02178a15b901d7d06e490838383a2acdf01ec2b4e4343c02325ab648965a539eba8bdb821560a33e4c34be506b9e1c7c1bb5cb750e894f500fce92
4702
4702
  languageName: node
4703
4703
  linkType: hard
4704
4704
 
@@ -5567,13 +5567,13 @@ __metadata:
5567
5567
  linkType: hard
5568
5568
 
5569
5569
  "postcss@npm:^8.4.28, postcss@npm:^8.4.30, postcss@npm:^8.4.31, postcss@npm:^8.4.32, postcss@npm:^8.4.43, postcss@npm:^8.5.15":
5570
- version: 8.5.15
5571
- resolution: "postcss@npm:8.5.15"
5570
+ version: 8.5.23
5571
+ resolution: "postcss@npm:8.5.23"
5572
5572
  dependencies:
5573
- nanoid: ^3.3.12
5573
+ nanoid: ^3.3.16
5574
5574
  picocolors: ^1.1.1
5575
5575
  source-map-js: ^1.2.1
5576
- checksum: 82e046d5bd0c537e7bcae1b97ec366968cac4ebdbd38773b69a2a4ad437f26641643a48f120317dd167199ac718ff8a0ab7dd102258430e4c919daaef0e57904
5576
+ checksum: 02fe0aac9de34914104566b3fe3a29903dc7bae4a3fffffdca1331dc51e14aa62c48e8373fc4d107ef99f8f5cae98199d9a89fbcbf43371693b22a397ff5cc34
5577
5577
  languageName: node
5578
5578
  linkType: hard
5579
5579
 
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: trek
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.25
4
+ version: 0.1.27
5
5
  platform: ruby
6
6
  authors:
7
7
  - Mohamed Bengrich
@@ -730,6 +730,7 @@ files:
730
730
  - app/views/trek/shared/_resource_heading.html.slim
731
731
  - app/views/trek/shared/_resource_index_heading.html.slim
732
732
  - config/brakeman.ignore
733
+ - config/i18n-tasks.yml
733
734
  - config/locales/trek.en.yml
734
735
  - config/locales/trek.fr.yml
735
736
  - docs/.vitepress/config.mjs
@@ -937,6 +938,7 @@ files:
937
938
  - lib/generators/trek/templates/views/admin_mailer/invite.en.text.erb
938
939
  - lib/generators/trek/templates/views/admin_mailer/invite.fr.html.slim
939
940
  - lib/generators/trek/templates/views/admin_mailer/invite.fr.text.erb
941
+ - lib/generators/trek/upgrade/v2_generator.rb
940
942
  - lib/trek.rb
941
943
  - lib/trek/engine.rb
942
944
  - lib/trek/i18n_keys_resolver.rb
@@ -967,7 +969,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
967
969
  - !ruby/object:Gem::Version
968
970
  version: '0'
969
971
  requirements: []
970
- rubygems_version: 4.0.10
972
+ rubygems_version: 4.0.16
971
973
  specification_version: 4
972
974
  summary: A modern CMS for Ruby on Rails
973
975
  test_files: []