trek 2.2.0 → 2.3.0

data/lib/generators/trek/templates/controllers/concerns/appsignal_context.rb

@@ -0,0 +1,37 @@
+# Tags every AppSignal transaction with the area it belongs to and the acting user,
+# so errors and slow requests can be filtered per namespace and per actor.
+#
+# Included in ApplicationController (front-office and Admin::BaseController through
+# it) and, from config/initializers/appsignal_context.rb, in Trek::BaseController.
+#
+# Free of charge when AppSignal is inactive (no push API key, i.e. every environment
+# but production): each Appsignal call below returns early.
+module AppsignalContext
+  extend ActiveSupport::Concern
+
+  ADMIN_CONTROLLER_PATHS = ["admin/", "trek/"].freeze
+
+  included do
+    before_action :set_appsignal_context
+  end
+
+  private
+
+  def set_appsignal_context
+    Appsignal.set_namespace(appsignal_namespace)
+    Appsignal.add_tags(user_id: appsignal_user_id) if appsignal_user_id
+  end
+
+  def appsignal_namespace
+    controller_path.start_with?(*ADMIN_CONTROLLER_PATHS) ? "admin" : "web"
+  end
+
+  def appsignal_user_id
+    # Trek::Authentication resolves the session in its own before_action, which may
+    # run after this one, so resume it explicitly. Front-office controllers don't
+    # include the concern and have no session to resume.
+    resume_session if respond_to?(:resume_session, true) && Current.session.nil?
+
+    Current.user&.id
+  end
+end

data/lib/generators/trek/templates/db/seeds/setup/fragments.rb

@@ -0,0 +1,3 @@
+# Makes `fragments` available to seeds and specs: Oaken only defines a model's method once a seed
+# file has used it.
+register Fragment

data/lib/generators/trek/templates/db/seeds/setup/users.rb

@@ -0,0 +1,6 @@
+# Defaults for `users.create` and `users.new` (see https://github.com/kaspth/oaken): a unique email and
+# a password passing Trek's validations, so a seed or a spec only sets what it cares about. Specs
+# sign in with `users.password`.
+def users.password = "correct horse battery staple"
+
+users.defaults email: -> { "user-#{SecureRandom.hex(4)}@example.com" }, password: users.password

data/lib/generators/trek/templates/db/seeds/test/cases/page_tree.rb

@@ -0,0 +1,5 @@
+# A small page tree for specs, loaded with `seed "cases/page_tree"`: the home page (the tree's root,
+# which has no slug), a section, and a page inside it.
+home = pages.create :home, key: "root", title: "Home"
+company = pages.create :company, title: "Company", parent: home
+pages.create :team, title: "Our team", parent: company

data/lib/generators/trek/templates/initializers/appsignal_context.rb

@@ -0,0 +1,5 @@
+# Trek::BaseController is an engine class, so the concern is mixed in on every code
+# reload rather than from a class body the application owns.
+Rails.application.config.to_prepare do
+  Trek::BaseController.include(AppsignalContext)
+end

data/lib/generators/trek/templates/locales/scaffold/model.en.yml.tt

@@ -8,5 +8,5 @@ en:
     attributes:
       <%= file_path %>:
 <%- attributes.each do |attr| -%>
-        <%= attr.name %>: <%= attr.name.humanize -%>
+        <%= attr.name %>: <%= attr.name.humanize %>
 <%- end -%>

data/lib/generators/trek/templates/migrations/fragments.rb.erb

@@ -5,7 +5,7 @@ class TrekFragments < <%= migration_class_name %>
       t.string :namespace, index: true
       t.integer :position, null: false
       t.jsonb :title, default: {}
-      t.jsonb :content
+      t.jsonb :content, default: {}
 
       t.timestamps
 

data/lib/generators/trek/templates/migrations/menu_nodes.rb.erb

@@ -18,4 +18,3 @@ class TrekMenuNodes < <%= migration_class_name %>
     end
   end
 end
-

data/lib/generators/trek/templates/migrations/tag_categories.rb.erb

@@ -1,6 +1,6 @@
 class TrekTagCategories < <%= migration_class_name %>
   def change
-   create_table "tag_categories" do |t|
+    create_table "tag_categories" do |t|
       t.string :key, index: { unique: true }
       t.string :name
       t.integer :position, null: false

data/lib/generators/trek/templates/migrations/taggings.rb.erb

@@ -1,6 +1,6 @@
 class TrekTaggings < <%= migration_class_name %>
   def change
-   create_table :taggings do |t|
+    create_table :taggings do |t|
       t.references :taggable, null: false, polymorphic: true
       t.references :tag, null: false, foreign_key: true
 

data/lib/generators/trek/templates/migrations/users.rb.erb

@@ -4,7 +4,8 @@ class TrekUsers < <%= migration_class_name %>
     add_column :<%= tableized_model_class %>, :theme, :integer, default: 0, null: false
     add_column :<%= tableized_model_class %>, :locale, :string
     add_column :<%= tableized_model_class %>, :role, :integer, default: 1, null: false
-    add_column :<%= tableized_model_class %>, :password_digest, :string, null: false
+    # The table is created empty by the trek_create_users migration, so no default is needed.
+    add_column :<%= tableized_model_class %>, :password_digest, :string, null: false # rubocop:disable Rails/NotNullColumn
     add_column :<%= tableized_model_class %>, :last_activity_at, :datetime
   end
 end

data/lib/generators/trek/templates/models/tag.rb

@@ -6,7 +6,6 @@ class Tag < ApplicationRecord
     optional: true
 
   has_many :taggings, dependent: :destroy
-  has_many :taggables, through: :taggings
 
   validates :name, :key, presence: true
   validates :key, uniqueness: { scope: :category }
@@ -19,6 +18,12 @@ class Tag < ApplicationRecord
   scope :in_categories, ->(keys) { TagCategory.where(key: keys).ordered.map(&:tags).reduce(:+) }
   scope :in_category, ->(key) { TagCategory.find_by(key:)&.tags }
 
+  # The tagged records, of any model. Not a `has_many :through`: Rails can't go through the
+  # polymorphic `Tagging#taggable`.
+  def taggables
+    taggings.includes(:taggable).map(&:taggable)
+  end
+
   def to_s
     name
   end

data/lib/generators/trek/templates/policies/admin/tag_policy.rb

@@ -13,7 +13,7 @@ module Admin
     end
 
     def destroy?
-      user.privileged? && record.taggables.empty?
+      user.privileged? && record.taggings.empty?
     end
 
     def reorder?

data/lib/generators/trek/templates/policies/external_link_policy.rb

@@ -16,7 +16,7 @@ module Admin
     relation_scope do |relation|
       next relation if user.privileged?
 
-      relation.where(user:)
+      relation.none
     end
   end
 end

data/lib/generators/trek/templates/spec/models/page_spec.rb

@@ -0,0 +1,24 @@
+require "rails_helper"
+
+RSpec.describe Page do
+  before { seed "cases/page_tree" }
+
+  it "slugs the title" do
+    expect(pages.team.slug).to eq("our-team")
+  end
+
+  it "builds the full path from the slugs of its ancestors, root excluded" do
+    expect(pages.team.full_path).to eq("company/our-team")
+  end
+
+  it "is found at its full path" do
+    expect(described_class.find_at_full_path("company/our-team")).to eq(pages.team)
+  end
+
+  it "keeps its former path when moved, so old URLs can be redirected" do
+    team = pages.team
+    team.update!(parent: pages.home)
+
+    expect(team.reload.paths.map(&:path)).to eq(["our-team", "company/our-team"])
+  end
+end

data/lib/generators/trek/templates/spec/models/user_spec.rb

@@ -0,0 +1,76 @@
+require "rails_helper"
+
+RSpec.describe User do
+  subject(:user) { users.new }
+
+  it "is valid with an email and a password" do
+    expect(user).to be_valid
+  end
+
+  describe "validations" do
+    it "requires an email" do
+      user.email = nil
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a well-formed email" do
+      user.email = "not an email"
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a unique email" do
+      users.create(email: user.email)
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a password of at least 8 characters on creation" do
+      user.password = "short"
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a password of at least 8 characters when changing it" do
+      user = users.create
+      user.password = "short"
+
+      expect(user).to be_invalid
+    end
+
+    it "does not require the password when changing something else" do
+      user = described_class.find(users.create.id)
+      user.name = "Ada"
+
+      expect(user).to be_valid
+    end
+  end
+
+  describe "roles" do
+    it "defaults to guest" do
+      expect(user.role).to eq("guest")
+    end
+
+    it "treats admins and editors as privileged" do
+      expect(%w[admin editor guest].map { |role| users.new(role:).privileged? }).to eq([true, true, false])
+    end
+
+    it "scopes privileged users" do
+      admin, editor = users.create(role: :admin), users.create(role: :editor)
+      users.create(role: :reader)
+
+      expect(described_class.privileged).to contain_exactly(admin, editor)
+    end
+  end
+
+  describe "#to_s" do
+    it "reads the name" do
+      expect(users.new(name: "Ada").to_s).to eq("Ada")
+    end
+
+    it "falls back to the email" do
+      expect(users.new(email: "ada@example.com").to_s).to eq("ada@example.com")
+    end
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/external_link_policy_spec.rb

@@ -0,0 +1,17 @@
+require "rails_helper"
+
+RSpec.describe Admin::ExternalLinkPolicy do
+  before { ExternalLink.create!(url: "https://example.com") }
+
+  it "shows privileged users every external link" do
+    policy = described_class.new(user: users.new(role: :editor))
+
+    expect(policy.apply_scope(ExternalLink.all, type: :active_record_relation)).to match_array(ExternalLink.all)
+  end
+
+  it "shows other roles no external link" do
+    policy = described_class.new(user: users.new(role: :reader))
+
+    expect(policy.apply_scope(ExternalLink.all, type: :active_record_relation)).to be_empty
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/fragment_policy_spec.rb

@@ -0,0 +1,33 @@
+require "rails_helper"
+
+RSpec.describe Admin::FragmentPolicy do
+  def policy(role, record = Fragment)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create, edit and delete fragments" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from fragments" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users edit a fragment" do
+    expect(policy("editor").permitted_attributes).to contain_exactly(:content, :key, :namespace, :title)
+  end
+
+  it "lets other roles edit nothing" do
+    expect(policy("reader").permitted_attributes).to be_empty
+  end
+
+  it "shows other roles no fragment" do
+    Fragment.create!(key: "footer", namespace: "layout", title: "Footer")
+
+    expect(policy("reader").apply_scope(Fragment.all, type: :active_record_relation)).to be_empty
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/page_policy_spec.rb

@@ -0,0 +1,39 @@
+require "rails_helper"
+
+RSpec.describe Admin::PagePolicy do
+  def policy(role, record = Page)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create, edit and delete pages" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from pages" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users edit a page's content" do
+    expect(policy("editor").permitted_attributes).to include(:title, :slug, :description, :content)
+  end
+
+  it "lets other roles edit nothing" do
+    expect(policy("reader").permitted_attributes).to be_empty
+  end
+
+  it "shows privileged users every page" do
+    seed "cases/page_tree"
+
+    expect(policy("editor").apply_scope(Page.all, type: :active_record_relation)).to match_array(Page.all)
+  end
+
+  it "shows other roles no page" do
+    seed "cases/page_tree"
+
+    expect(policy("reader").apply_scope(Page.all, type: :active_record_relation)).to be_empty
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/preview_policy_spec.rb

@@ -0,0 +1,9 @@
+require "rails_helper"
+
+RSpec.describe Admin::PreviewPolicy do
+  %w[admin editor user reader guest].each do |role|
+    it "lets #{role}s preview the home page" do
+      expect(described_class.new(user: users.new(role:)).apply(:home?)).to be(true)
+    end
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/tag_category_policy_spec.rb

@@ -0,0 +1,31 @@
+require "rails_helper"
+
+RSpec.describe Admin::TagCategoryPolicy do
+  let(:category) { TagCategory.create!(name: "Topics", key: "topics") }
+
+  def policy(role, record = TagCategory)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create and edit tag categories" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from tag categories" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users delete an empty category" do
+    expect(policy("editor", category).apply(:destroy?)).to be(true)
+  end
+
+  it "keeps a category with tags from being deleted" do
+    Tag.create!(name: "News", key: "news", category:)
+
+    expect(policy("admin", category.reload).apply(:destroy?)).to be(false)
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/tag_policy_spec.rb

@@ -0,0 +1,31 @@
+require "rails_helper"
+
+RSpec.describe Admin::TagPolicy do
+  let(:tag) { Tag.create!(name: "News", key: "news") }
+
+  def policy(role, record = Tag)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create and edit tags" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from tags" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users delete an unused tag" do
+    expect(policy("editor", tag).apply(:destroy?)).to be(true)
+  end
+
+  it "keeps a tag in use from being deleted" do
+    allow(tag).to receive(:taggings).and_return([Tagging.new])
+
+    expect(policy("admin", tag).apply(:destroy?)).to be(false)
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/user_policy_spec.rb

@@ -0,0 +1,58 @@
+require "rails_helper"
+
+RSpec.describe Admin::UserPolicy do
+  let(:admin) { users.create(role: :admin) }
+  let(:editor) { users.create(role: :editor) }
+
+  def policy(user, record = User)
+    described_class.new(record, user:)
+  end
+
+  it "lets admins list, create and delete users" do
+    expect(%i[index? create? destroy?].map { |rule| policy(admin).apply(rule) }).to all(be(true))
+  end
+
+  it "lets admins edit any user" do
+    expect(policy(admin, editor).apply(:update?)).to be(true)
+  end
+
+  it "keeps editors away from the users list" do
+    expect(%i[index? create? destroy?].map { |rule| policy(editor).apply(rule) }).to all(be(false))
+  end
+
+  it "lets editors see and edit themselves" do
+    expect(%i[show? update?].map { |rule| policy(editor, editor).apply(rule) }).to all(be(true))
+  end
+
+  it "keeps editors away from other users" do
+    expect(%i[show? update?].map { |rule| policy(editor, admin).apply(rule) }).to all(be(false))
+  end
+
+  it "lets admins change a user's role" do
+    expect(policy(admin, editor).permitted_attributes).to include(:role)
+  end
+
+  it "lets admins invite the users they create" do
+    expect(policy(admin, User).permitted_attributes).to include(:send_invite)
+  end
+
+  it "lets editors change their own details but not their role" do
+    expect(policy(editor, editor).permitted_attributes).to contain_exactly(:name, :email, :locale, :theme)
+  end
+
+  it "lets editors change nothing on another user" do
+    expect(policy(editor, admin).permitted_attributes).to be_empty
+  end
+
+  it "shows admins the privileged users only" do
+    reader = users.create(role: :reader)
+
+    expect(described_class.new(user: admin).apply_scope(User.all, type: :active_record_relation)).not_to include(reader)
+  end
+
+  it "shows editors no user" do
+    admin
+
+    expect(described_class.new(user: editor).apply_scope(User.all, type: :active_record_relation)).to be_empty
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/fragments_spec.rb

@@ -0,0 +1,50 @@
+require "rails_helper"
+
+RSpec.describe "Admin fragments", type: :request do
+  let!(:footer) { fragments.create(key: "footer", namespace: "layout", title: "Footer") }
+
+  before do
+    editor = users.create(role: :editor)
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+  end
+
+  it "lists the fragments" do
+    get admin_fragments_path
+
+    expect(response.body).to include("footer")
+  end
+
+  it "renders the new fragment form" do
+    get new_admin_fragment_path
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "creates a fragment" do
+    params = { fragment: { key: "tagline", namespace: "home", title: "Tagline" } }
+
+    expect { post admin_fragments_path, params: }.to change(Fragment, :count).by(1)
+  end
+
+  it "refuses a key already used in the namespace" do
+    post admin_fragments_path, params: { fragment: { key: "footer", namespace: "layout", title: "Another footer" } }
+
+    expect(response).to have_http_status(:unprocessable_entity)
+  end
+
+  it "renders the edit form" do
+    get edit_admin_fragment_path(footer)
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "updates a fragment" do
+    patch admin_fragment_path(footer), params: { fragment: { title: "Site footer" } }
+
+    expect(footer.reload.title).to eq("Site footer")
+  end
+
+  it "deletes a fragment" do
+    expect { delete admin_fragment_path(footer) }.to change(Fragment, :count).by(-1)
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/pages_spec.rb

@@ -0,0 +1,47 @@
+require "rails_helper"
+
+RSpec.describe "Admin pages", type: :request do
+  before do
+    seed "cases/page_tree"
+    editor = users.create(role: :editor)
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+  end
+
+  it "lists the pages" do
+    get admin_pages_path
+
+    expect(response.body).to include("Company").and include("Our team")
+  end
+
+  it "renders the new page form" do
+    get new_admin_page_path
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "creates a page" do
+    expect { post admin_pages_path, params: { page: { title: "Contact" } } }.to change(Page, :count).by(1)
+  end
+
+  it "refuses a page without a title" do
+    post admin_pages_path, params: { page: { title: "" } }
+
+    expect(response).to have_http_status(:unprocessable_entity)
+  end
+
+  it "renders the edit form" do
+    get edit_admin_page_path(pages.team)
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "updates a page" do
+    patch admin_page_path(pages.team), params: { page: { title: "The team" } }
+
+    expect(pages.team.title).to eq("The team")
+  end
+
+  it "deletes a page" do
+    expect { delete admin_page_path(pages.team) }.to change(Page, :count).by(-1)
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/uploads_spec.rb

@@ -0,0 +1,22 @@
+require "rails_helper"
+
+# The endpoints the admin's image and sound fields upload to (`Trek::Form::ImageFieldComponent`,
+# `Trek::Form::SoundFieldComponent`).
+RSpec.describe "Admin uploads", type: :request do
+  before do
+    editor = users.create(role: :editor)
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+  end
+
+  it "stores an uploaded image in the cache and returns its data" do
+    post "/admin/upload/image", params: { file: fixture_file_upload("image.png", "image/png") }
+
+    expect(response.parsed_body["data"]).to include("id", "storage" => "cache")
+  end
+
+  it "stores an uploaded sound in the cache and returns its data" do
+    post "/admin/upload/audio", params: { file: fixture_file_upload("sound.mp3", "audio/mpeg") }
+
+    expect(response.parsed_body["data"]).to include("id", "storage" => "cache")
+  end
+end