trek 2.1.0 → 2.3.0

data/lib/generators/trek/install/postmark_generator.rb

@@ -58,6 +58,9 @@ module Trek
 
   def log_and_abort(error)
     Rails.logger.info(error)
+    # Reported as handled (the delivery is deliberately abandoned, not a failure) and
+    # through Rails.error, so the app code stays independent of the monitoring vendor.
+    Rails.error.report(error, handled: true)
   end
           RUBY
         end

data/lib/generators/trek/install/ruby_generator.rb

@@ -5,7 +5,7 @@ module Trek
   module Generators
     module Install
       class RubyGenerator < Rails::Generators::Base
-        RUBY_VERSION = "4.0.6"
+        RUBY_VERSION = "4.0.7"
 
         include Trek::Generators::Helpers
 

data/lib/generators/trek/install/scalingo_generator.rb

@@ -5,7 +5,7 @@ module Trek
   module Generators
     module Install
       class ScalingoGenerator < Rails::Generators::Base
-        BUILDPACK_URL = "https://github.com/etaminstudio/trek-buildpack#v0.1.0".freeze
+        BUILDPACK_URL = "https://github.com/etaminstudio/trek-buildpack/archive/refs/tags/v0.1.0.tar.gz".freeze
 
         include Trek::Generators::Helpers
 

data/lib/generators/trek/install/uploaders_generator.rb

@@ -19,6 +19,8 @@ module Trek
             "app/uploaders/model_image_uploader.rb"
           template "record_image_uploader.rb",
             "app/uploaders/record_image_uploader.rb"
+          template "audio_uploader.rb",
+            "app/uploaders/audio_uploader.rb"
         end
 
         def uncomment_route

data/lib/generators/trek/install_generator.rb

@@ -76,6 +76,10 @@ module Trek
         generate "trek:install:mailer"
       end
 
+      def install_monitoring
+        generate "trek:install:appsignal"
+      end
+
       def install_user
         generate "trek:install:user"
       end
@@ -111,6 +115,7 @@ module Trek
         generate "trek:install:fragment"
         generate "trek:install:menu_node"
         generate "trek:install:external_link"
+        generate "trek:install:model_specs"
       end
 
       def install_ci

data/lib/generators/trek/taxonomies_generator.rb

@@ -44,6 +44,13 @@ module Trek
           "app/policies/admin/tag_category_policy.rb"
       end
 
+      def copy_policy_specs
+        template "spec/policies/admin/tag_policy_spec.rb",
+          "spec/policies/admin/tag_policy_spec.rb"
+        template "spec/policies/admin/tag_category_policy_spec.rb",
+          "spec/policies/admin/tag_category_policy_spec.rb"
+      end
+
       def generate_crud
         generate("trek:scaffold", "TagCategory name:string key:string")
         generate("trek:scaffold", "Tag name:string key:string category:references")

data/lib/generators/trek/templates/.gitlab-ci.yml

@@ -20,7 +20,7 @@ stages:
 
 # Defaults
 default:
-  image: registry.git.etamin.studio/devops/ci-ruby/node-24:4.0.6
+  image: registry.git.etamin.studio/devops/ci-ruby/node-24:4.0.7
 
   services:
     - postgres:16

data/lib/generators/trek/templates/config/appsignal.rb.tt

@@ -0,0 +1,25 @@
+# AppSignal's Ruby config file, loaded by the gem's Railtie (not a Rails initializer).
+#
+# The push API key lives in the Rails credentials (the installer injects it from
+# APPSIGNAL_PUSH_API_KEY). APPSIGNAL_* environment variables are read before this
+# block runs, so they keep precedence: the credentials only fill in what is unset,
+# which leaves per-environment overrides (e.g. APPSIGNAL_APP_ENV) possible.
+Appsignal.configure do |config|
+  config.name = "<%= application_name.dasherize %>"
+
+  config.push_api_key = Rails.application.credentials.dig(:appsignal, :push_api_key) if config.push_api_key.blank?
+
+  # The agent activates itself only when APPSIGNAL_PUSH_API_KEY is set in the
+  # environment; with the key in the credentials, activation has to be explicit.
+  # Production is monitored as soon as a key exists, the other environments never are.
+  config.active = config.push_api_key.present? if Rails.env.production?
+
+  # The slug is read-only on Scalingo, as on any host with a read-only filesystem, so
+  # the agent cannot write its own diagnostic log to log/: it falls back to /tmp on its
+  # own and announces it on every boot and every one-off container. Say it upfront.
+  config.log_path = "/tmp" if Rails.env.production?
+
+  # Trek mounts rails-healthcheck at /healthcheck — the platform polls it constantly
+  # and it would dominate the throughput graphs. (Rails' own /up is ignored by default.)
+  config.ignore_actions += ["Healthcheck::HealthchecksController#check"]
+end

data/lib/generators/trek/templates/controllers/admin/uploads_controller.rb

@@ -9,6 +9,10 @@ module Admin
       set_rack_response ImageUploader.upload_response(:cache, request.env)
     end
 
+    def audio
+      set_rack_response AudioUploader.upload_response(:cache, request.env)
+    end
+
     private
 
     def set_rack_response((status, headers, body))

data/lib/generators/trek/templates/controllers/admin/users_controller.rb

@@ -15,7 +15,10 @@ module Admin
     def theme
       value = params[:theme].to_s
       Current.user.update!(theme: value) if User.themes.key?(value)
-      head :no_content
+      respond_to do |format|
+        format.turbo_stream
+        format.html { head :no_content }
+      end
     end
 
     private

data/lib/generators/trek/templates/controllers/concerns/appsignal_context.rb

@@ -0,0 +1,37 @@
+# Tags every AppSignal transaction with the area it belongs to and the acting user,
+# so errors and slow requests can be filtered per namespace and per actor.
+#
+# Included in ApplicationController (front-office and Admin::BaseController through
+# it) and, from config/initializers/appsignal_context.rb, in Trek::BaseController.
+#
+# Free of charge when AppSignal is inactive (no push API key, i.e. every environment
+# but production): each Appsignal call below returns early.
+module AppsignalContext
+  extend ActiveSupport::Concern
+
+  ADMIN_CONTROLLER_PATHS = ["admin/", "trek/"].freeze
+
+  included do
+    before_action :set_appsignal_context
+  end
+
+  private
+
+  def set_appsignal_context
+    Appsignal.set_namespace(appsignal_namespace)
+    Appsignal.add_tags(user_id: appsignal_user_id) if appsignal_user_id
+  end
+
+  def appsignal_namespace
+    controller_path.start_with?(*ADMIN_CONTROLLER_PATHS) ? "admin" : "web"
+  end
+
+  def appsignal_user_id
+    # Trek::Authentication resolves the session in its own before_action, which may
+    # run after this one, so resume it explicitly. Front-office controllers don't
+    # include the concern and have no session to resume.
+    resume_session if respond_to?(:resume_session, true) && Current.session.nil?
+
+    Current.user&.id
+  end
+end

data/lib/generators/trek/templates/db/seeds/setup/fragments.rb

@@ -0,0 +1,3 @@
+# Makes `fragments` available to seeds and specs: Oaken only defines a model's method once a seed
+# file has used it.
+register Fragment

data/lib/generators/trek/templates/db/seeds/setup/users.rb

@@ -0,0 +1,6 @@
+# Defaults for `users.create` and `users.new` (see https://github.com/kaspth/oaken): a unique email and
+# a password passing Trek's validations, so a seed or a spec only sets what it cares about. Specs
+# sign in with `users.password`.
+def users.password = "correct horse battery staple"
+
+users.defaults email: -> { "user-#{SecureRandom.hex(4)}@example.com" }, password: users.password

data/lib/generators/trek/templates/db/seeds/test/cases/page_tree.rb

@@ -0,0 +1,5 @@
+# A small page tree for specs, loaded with `seed "cases/page_tree"`: the home page (the tree's root,
+# which has no slug), a section, and a page inside it.
+home = pages.create :home, key: "root", title: "Home"
+company = pages.create :company, title: "Company", parent: home
+pages.create :team, title: "Our team", parent: company

data/lib/generators/trek/templates/initializers/appsignal_context.rb

@@ -0,0 +1,5 @@
+# Trek::BaseController is an engine class, so the concern is mixed in on every code
+# reload rather than from a class body the application owns.
+Rails.application.config.to_prepare do
+  Trek::BaseController.include(AppsignalContext)
+end

data/lib/generators/trek/templates/locales/scaffold/model.en.yml.tt

@@ -8,5 +8,5 @@ en:
     attributes:
       <%= file_path %>:
 <%- attributes.each do |attr| -%>
-        <%= attr.name %>: <%= attr.name.humanize -%>
+        <%= attr.name %>: <%= attr.name.humanize %>
 <%- end -%>

data/lib/generators/trek/templates/migrations/fragments.rb.erb

@@ -5,7 +5,7 @@ class TrekFragments < <%= migration_class_name %>
       t.string :namespace, index: true
       t.integer :position, null: false
       t.jsonb :title, default: {}
-      t.jsonb :content
+      t.jsonb :content, default: {}
 
       t.timestamps
 

data/lib/generators/trek/templates/migrations/menu_nodes.rb.erb

@@ -18,4 +18,3 @@ class TrekMenuNodes < <%= migration_class_name %>
     end
   end
 end
-

data/lib/generators/trek/templates/migrations/tag_categories.rb.erb

@@ -1,6 +1,6 @@
 class TrekTagCategories < <%= migration_class_name %>
   def change
-   create_table "tag_categories" do |t|
+    create_table "tag_categories" do |t|
       t.string :key, index: { unique: true }
       t.string :name
       t.integer :position, null: false

data/lib/generators/trek/templates/migrations/taggings.rb.erb

@@ -1,6 +1,6 @@
 class TrekTaggings < <%= migration_class_name %>
   def change
-   create_table :taggings do |t|
+    create_table :taggings do |t|
       t.references :taggable, null: false, polymorphic: true
       t.references :tag, null: false, foreign_key: true
 

data/lib/generators/trek/templates/migrations/users.rb.erb

@@ -4,7 +4,8 @@ class TrekUsers < <%= migration_class_name %>
     add_column :<%= tableized_model_class %>, :theme, :integer, default: 0, null: false
     add_column :<%= tableized_model_class %>, :locale, :string
     add_column :<%= tableized_model_class %>, :role, :integer, default: 1, null: false
-    add_column :<%= tableized_model_class %>, :password_digest, :string, null: false
+    # The table is created empty by the trek_create_users migration, so no default is needed.
+    add_column :<%= tableized_model_class %>, :password_digest, :string, null: false # rubocop:disable Rails/NotNullColumn
     add_column :<%= tableized_model_class %>, :last_activity_at, :datetime
   end
 end

data/lib/generators/trek/templates/models/tag.rb

@@ -6,7 +6,6 @@ class Tag < ApplicationRecord
     optional: true
 
   has_many :taggings, dependent: :destroy
-  has_many :taggables, through: :taggings
 
   validates :name, :key, presence: true
   validates :key, uniqueness: { scope: :category }
@@ -19,6 +18,12 @@ class Tag < ApplicationRecord
   scope :in_categories, ->(keys) { TagCategory.where(key: keys).ordered.map(&:tags).reduce(:+) }
   scope :in_category, ->(key) { TagCategory.find_by(key:)&.tags }
 
+  # The tagged records, of any model. Not a `has_many :through`: Rails can't go through the
+  # polymorphic `Tagging#taggable`.
+  def taggables
+    taggings.includes(:taggable).map(&:taggable)
+  end
+
   def to_s
     name
   end

data/lib/generators/trek/templates/policies/admin/tag_policy.rb

@@ -13,7 +13,7 @@ module Admin
     end
 
     def destroy?
-      user.privileged? && record.taggables.empty?
+      user.privileged? && record.taggings.empty?
     end
 
     def reorder?

data/lib/generators/trek/templates/policies/external_link_policy.rb

@@ -16,7 +16,7 @@ module Admin
     relation_scope do |relation|
       next relation if user.privileged?
 
-      relation.where(user:)
+      relation.none
     end
   end
 end

data/lib/generators/trek/templates/spec/models/page_spec.rb

@@ -0,0 +1,24 @@
+require "rails_helper"
+
+RSpec.describe Page do
+  before { seed "cases/page_tree" }
+
+  it "slugs the title" do
+    expect(pages.team.slug).to eq("our-team")
+  end
+
+  it "builds the full path from the slugs of its ancestors, root excluded" do
+    expect(pages.team.full_path).to eq("company/our-team")
+  end
+
+  it "is found at its full path" do
+    expect(described_class.find_at_full_path("company/our-team")).to eq(pages.team)
+  end
+
+  it "keeps its former path when moved, so old URLs can be redirected" do
+    team = pages.team
+    team.update!(parent: pages.home)
+
+    expect(team.reload.paths.map(&:path)).to eq(["our-team", "company/our-team"])
+  end
+end

data/lib/generators/trek/templates/spec/models/user_spec.rb

@@ -0,0 +1,76 @@
+require "rails_helper"
+
+RSpec.describe User do
+  subject(:user) { users.new }
+
+  it "is valid with an email and a password" do
+    expect(user).to be_valid
+  end
+
+  describe "validations" do
+    it "requires an email" do
+      user.email = nil
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a well-formed email" do
+      user.email = "not an email"
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a unique email" do
+      users.create(email: user.email)
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a password of at least 8 characters on creation" do
+      user.password = "short"
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a password of at least 8 characters when changing it" do
+      user = users.create
+      user.password = "short"
+
+      expect(user).to be_invalid
+    end
+
+    it "does not require the password when changing something else" do
+      user = described_class.find(users.create.id)
+      user.name = "Ada"
+
+      expect(user).to be_valid
+    end
+  end
+
+  describe "roles" do
+    it "defaults to guest" do
+      expect(user.role).to eq("guest")
+    end
+
+    it "treats admins and editors as privileged" do
+      expect(%w[admin editor guest].map { |role| users.new(role:).privileged? }).to eq([true, true, false])
+    end
+
+    it "scopes privileged users" do
+      admin, editor = users.create(role: :admin), users.create(role: :editor)
+      users.create(role: :reader)
+
+      expect(described_class.privileged).to contain_exactly(admin, editor)
+    end
+  end
+
+  describe "#to_s" do
+    it "reads the name" do
+      expect(users.new(name: "Ada").to_s).to eq("Ada")
+    end
+
+    it "falls back to the email" do
+      expect(users.new(email: "ada@example.com").to_s).to eq("ada@example.com")
+    end
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/external_link_policy_spec.rb

@@ -0,0 +1,17 @@
+require "rails_helper"
+
+RSpec.describe Admin::ExternalLinkPolicy do
+  before { ExternalLink.create!(url: "https://example.com") }
+
+  it "shows privileged users every external link" do
+    policy = described_class.new(user: users.new(role: :editor))
+
+    expect(policy.apply_scope(ExternalLink.all, type: :active_record_relation)).to match_array(ExternalLink.all)
+  end
+
+  it "shows other roles no external link" do
+    policy = described_class.new(user: users.new(role: :reader))
+
+    expect(policy.apply_scope(ExternalLink.all, type: :active_record_relation)).to be_empty
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/fragment_policy_spec.rb

@@ -0,0 +1,33 @@
+require "rails_helper"
+
+RSpec.describe Admin::FragmentPolicy do
+  def policy(role, record = Fragment)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create, edit and delete fragments" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from fragments" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users edit a fragment" do
+    expect(policy("editor").permitted_attributes).to contain_exactly(:content, :key, :namespace, :title)
+  end
+
+  it "lets other roles edit nothing" do
+    expect(policy("reader").permitted_attributes).to be_empty
+  end
+
+  it "shows other roles no fragment" do
+    Fragment.create!(key: "footer", namespace: "layout", title: "Footer")
+
+    expect(policy("reader").apply_scope(Fragment.all, type: :active_record_relation)).to be_empty
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/page_policy_spec.rb

@@ -0,0 +1,39 @@
+require "rails_helper"
+
+RSpec.describe Admin::PagePolicy do
+  def policy(role, record = Page)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create, edit and delete pages" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from pages" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users edit a page's content" do
+    expect(policy("editor").permitted_attributes).to include(:title, :slug, :description, :content)
+  end
+
+  it "lets other roles edit nothing" do
+    expect(policy("reader").permitted_attributes).to be_empty
+  end
+
+  it "shows privileged users every page" do
+    seed "cases/page_tree"
+
+    expect(policy("editor").apply_scope(Page.all, type: :active_record_relation)).to match_array(Page.all)
+  end
+
+  it "shows other roles no page" do
+    seed "cases/page_tree"
+
+    expect(policy("reader").apply_scope(Page.all, type: :active_record_relation)).to be_empty
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/preview_policy_spec.rb

@@ -0,0 +1,9 @@
+require "rails_helper"
+
+RSpec.describe Admin::PreviewPolicy do
+  %w[admin editor user reader guest].each do |role|
+    it "lets #{role}s preview the home page" do
+      expect(described_class.new(user: users.new(role:)).apply(:home?)).to be(true)
+    end
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/tag_category_policy_spec.rb

@@ -0,0 +1,31 @@
+require "rails_helper"
+
+RSpec.describe Admin::TagCategoryPolicy do
+  let(:category) { TagCategory.create!(name: "Topics", key: "topics") }
+
+  def policy(role, record = TagCategory)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create and edit tag categories" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from tag categories" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users delete an empty category" do
+    expect(policy("editor", category).apply(:destroy?)).to be(true)
+  end
+
+  it "keeps a category with tags from being deleted" do
+    Tag.create!(name: "News", key: "news", category:)
+
+    expect(policy("admin", category.reload).apply(:destroy?)).to be(false)
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/tag_policy_spec.rb

@@ -0,0 +1,31 @@
+require "rails_helper"
+
+RSpec.describe Admin::TagPolicy do
+  let(:tag) { Tag.create!(name: "News", key: "news") }
+
+  def policy(role, record = Tag)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create and edit tags" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from tags" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users delete an unused tag" do
+    expect(policy("editor", tag).apply(:destroy?)).to be(true)
+  end
+
+  it "keeps a tag in use from being deleted" do
+    allow(tag).to receive(:taggings).and_return([Tagging.new])
+
+    expect(policy("admin", tag).apply(:destroy?)).to be(false)
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/user_policy_spec.rb

@@ -0,0 +1,58 @@
+require "rails_helper"
+
+RSpec.describe Admin::UserPolicy do
+  let(:admin) { users.create(role: :admin) }
+  let(:editor) { users.create(role: :editor) }
+
+  def policy(user, record = User)
+    described_class.new(record, user:)
+  end
+
+  it "lets admins list, create and delete users" do
+    expect(%i[index? create? destroy?].map { |rule| policy(admin).apply(rule) }).to all(be(true))
+  end
+
+  it "lets admins edit any user" do
+    expect(policy(admin, editor).apply(:update?)).to be(true)
+  end
+
+  it "keeps editors away from the users list" do
+    expect(%i[index? create? destroy?].map { |rule| policy(editor).apply(rule) }).to all(be(false))
+  end
+
+  it "lets editors see and edit themselves" do
+    expect(%i[show? update?].map { |rule| policy(editor, editor).apply(rule) }).to all(be(true))
+  end
+
+  it "keeps editors away from other users" do
+    expect(%i[show? update?].map { |rule| policy(editor, admin).apply(rule) }).to all(be(false))
+  end
+
+  it "lets admins change a user's role" do
+    expect(policy(admin, editor).permitted_attributes).to include(:role)
+  end
+
+  it "lets admins invite the users they create" do
+    expect(policy(admin, User).permitted_attributes).to include(:send_invite)
+  end
+
+  it "lets editors change their own details but not their role" do
+    expect(policy(editor, editor).permitted_attributes).to contain_exactly(:name, :email, :locale, :theme)
+  end
+
+  it "lets editors change nothing on another user" do
+    expect(policy(editor, admin).permitted_attributes).to be_empty
+  end
+
+  it "shows admins the privileged users only" do
+    reader = users.create(role: :reader)
+
+    expect(described_class.new(user: admin).apply_scope(User.all, type: :active_record_relation)).not_to include(reader)
+  end
+
+  it "shows editors no user" do
+    admin
+
+    expect(described_class.new(user: editor).apply_scope(User.all, type: :active_record_relation)).to be_empty
+  end
+end