trek 2.2.0 → 2.3.1

data/lib/generators/trek/install/appsignal_generator.rb

@@ -0,0 +1,102 @@
+require "rails/generators/actions"
+require "generators/trek/helpers"
+
+module Trek
+  module Generators
+    module Install
+      class AppsignalGenerator < Rails::Generators::Base
+        include Trek::Generators::Helpers
+
+        desc "Install AppSignal (error tracking and performance monitoring)."
+
+        source_root File.expand_path("../templates", __dir__)
+
+        def add_gem
+          return if in_gemfile?("appsignal")
+
+          gem "appsignal", comment: "Error tracking and performance monitoring [https://appsignal.com]"
+          bundle_install
+        end
+
+        # Like Postmark's API token: the secret lives in the Rails credentials, not in
+        # config/appsignal.rb (where `appsignal install` would write it in plain text).
+        def inject_appsignal_to_credentials
+          return if credentials_encrypted_file.read&.include?("appsignal:")
+
+          inject_into_credentials(
+            <<~YAML
+              appsignal:
+                push_api_key: #{ENV.fetch("APPSIGNAL_PUSH_API_KEY", "")}
+            YAML
+          )
+        end
+
+        def create_config
+          template "config/appsignal.rb", "config/appsignal.rb"
+        end
+
+        def add_app_env_to_env_example
+          return unless File.exist?(".env.example")
+          return if File.read(".env.example").include?("APPSIGNAL_APP_ENV")
+
+          append_to_file ".env.example", "APPSIGNAL_APP_ENV=\n"
+        end
+
+        # A broken initializer or a missing credential raises before Rails can report
+        # anything — the error reporter does not exist yet — so the boot is wrapped.
+        def report_boot_errors
+          return unless File.exist?("config.ru")
+          return if File.read("config.ru").include?("Appsignal.send_error")
+
+          gsub_file "config.ru",
+            %r{^require_relative ["']config/environment["']\n},
+            boot_error_reporting
+        end
+
+        def create_context_concern
+          copy_file "controllers/concerns/appsignal_context.rb",
+            "app/controllers/concerns/appsignal_context.rb"
+        end
+
+        def include_context_in_application_controller
+          return if File.read("app/controllers/application_controller.rb").include?("AppsignalContext")
+
+          inject_into_class "app/controllers/application_controller.rb",
+            "ApplicationController",
+            "  include AppsignalContext\n"
+          run "rubocop --autocorrect app/controllers/application_controller.rb", abort_on_failure: true
+        end
+
+        def include_context_in_trek_controllers
+          copy_file "initializers/appsignal_context.rb",
+            "config/initializers/appsignal_context.rb"
+        end
+
+        def final_instructions
+          say ""
+          say "AppSignal is configured for production. Check the setup with:"
+          say ""
+          say "    bundle exec appsignal diagnose"
+          say ""
+        end
+
+        private
+
+        def boot_error_reporting
+          <<~RUBY
+            begin
+              require_relative "config/environment"
+            rescue Exception => error # rubocop:disable Lint/RescueException
+              # Errors raised while booting (a broken initializer, a missing credential)
+              # happen before the Rails error reporter exists — report them directly.
+              # The gem itself is loaded by Bundler.require, so a failure earlier than
+              # that (config/boot.rb, the Gemfile) has no Appsignal to report with.
+              Appsignal.send_error(error) if defined?(Appsignal)
+              raise
+            end
+          RUBY
+        end
+      end
+    end
+  end
+end

data/lib/generators/trek/install/model_specs_generator.rb

@@ -0,0 +1,64 @@
+require "rails/generators/actions"
+require "generators/trek/helpers"
+
+module Trek
+  module Generators
+    module Install
+      class ModelSpecsGenerator < Rails::Generators::Base
+        include Trek::Generators::Helpers
+
+        desc "Add specs for the models Trek installs (Page, User…), with their Oaken seeds."
+
+        source_root File.expand_path("../templates", __dir__)
+
+        # In every group: `db/seeds.rb` calls Oaken, and `db:seed` runs in every environment.
+        def add_gem
+          return if in_gemfile?("oaken")
+
+          gem "oaken", "~> 1.0"
+          bundle_install
+        end
+
+        def load_oaken_in_seeds
+          seeds = File.join(destination_root, "db/seeds.rb")
+          return if File.exist?(seeds) && File.read(seeds).include?("Oaken.seed")
+
+          create_file "db/seeds.rb" unless File.exist?(seeds)
+          append_to_file "db/seeds.rb", <<~RUBY
+
+            # Oaken (https://github.com/kaspth/oaken) loads db/seeds/setup (defaults and helpers) first.
+            # Pass directories to seed them too, e.g. `Oaken.seed :data`; specs load their own cases with
+            # `seed "cases/…"`.
+            Oaken.seed
+          RUBY
+        end
+
+        def load_oaken_in_specs
+          rails_helper = File.join(destination_root, "spec/rails_helper.rb")
+          return unless File.exist?(rails_helper)
+          return if File.read(rails_helper).include?("oaken/rspec_setup")
+
+          # After rspec-rails, which Oaken's setup configures (transactional examples, seeding the
+          # database before the suite).
+          inject_into_file "spec/rails_helper.rb",
+            "require \"oaken/rspec_setup\"\n",
+            after: %r{^require ["']rspec/rails["'].*\n}
+        end
+
+        # Every file under the templates' db/seeds, spec/models and spec/requests is installed, so a new
+        # template needs no change here.
+        def copy_seeds
+          directory "db/seeds", "db/seeds"
+        end
+
+        def copy_specs
+          directory "spec/models", "spec/models"
+          directory "spec/requests", "spec/requests"
+          directory "spec/fixtures", "spec/fixtures"
+          # The tag policies' specs come with them, from `trek:taxonomies`.
+          directory "spec/policies", "spec/policies", exclude_pattern: /tag(_category)?_policy_spec/
+        end
+      end
+    end
+  end
+end

data/lib/generators/trek/install/postmark_generator.rb

@@ -58,6 +58,9 @@ module Trek
 
   def log_and_abort(error)
     Rails.logger.info(error)
+    # Reported as handled (the delivery is deliberately abandoned, not a failure) and
+    # through Rails.error, so the app code stays independent of the monitoring vendor.
+    Rails.error.report(error, handled: true)
   end
           RUBY
         end

data/lib/generators/trek/install/ruby_generator.rb

@@ -5,7 +5,7 @@ module Trek
   module Generators
     module Install
       class RubyGenerator < Rails::Generators::Base
-        RUBY_VERSION = "4.0.6"
+        RUBY_VERSION = "4.0.7"
 
         include Trek::Generators::Helpers
 

data/lib/generators/trek/install/scalingo_generator.rb

@@ -5,7 +5,7 @@ module Trek
   module Generators
     module Install
       class ScalingoGenerator < Rails::Generators::Base
-        BUILDPACK_URL = "https://github.com/etaminstudio/trek-buildpack#v0.1.0".freeze
+        BUILDPACK_URL = "https://github.com/etaminstudio/trek-buildpack/archive/refs/tags/v0.1.0.tar.gz".freeze
 
         include Trek::Generators::Helpers
 

data/lib/generators/trek/install/uploaders_generator.rb

@@ -19,6 +19,8 @@ module Trek
             "app/uploaders/model_image_uploader.rb"
           template "record_image_uploader.rb",
             "app/uploaders/record_image_uploader.rb"
+          template "audio_uploader.rb",
+            "app/uploaders/audio_uploader.rb"
         end
 
         def uncomment_route

data/lib/generators/trek/install_generator.rb

@@ -76,6 +76,10 @@ module Trek
         generate "trek:install:mailer"
       end
 
+      def install_monitoring
+        generate "trek:install:appsignal"
+      end
+
       def install_user
         generate "trek:install:user"
       end
@@ -111,6 +115,7 @@ module Trek
         generate "trek:install:fragment"
         generate "trek:install:menu_node"
         generate "trek:install:external_link"
+        generate "trek:install:model_specs"
       end
 
       def install_ci

data/lib/generators/trek/taxonomies_generator.rb

@@ -44,6 +44,13 @@ module Trek
           "app/policies/admin/tag_category_policy.rb"
       end
 
+      def copy_policy_specs
+        template "spec/policies/admin/tag_policy_spec.rb",
+          "spec/policies/admin/tag_policy_spec.rb"
+        template "spec/policies/admin/tag_category_policy_spec.rb",
+          "spec/policies/admin/tag_category_policy_spec.rb"
+      end
+
       def generate_crud
         generate("trek:scaffold", "TagCategory name:string key:string")
         generate("trek:scaffold", "Tag name:string key:string category:references")

data/lib/generators/trek/templates/.gitlab-ci.yml

@@ -20,7 +20,7 @@ stages:
 
 # Defaults
 default:
-  image: registry.git.etamin.studio/devops/ci-ruby/node-24:4.0.6
+  image: registry.git.etamin.studio/devops/ci-ruby/node-24:4.0.7
 
   services:
     - postgres:16

data/lib/generators/trek/templates/config/appsignal.rb.tt

@@ -0,0 +1,25 @@
+# AppSignal's Ruby config file, loaded by the gem's Railtie (not a Rails initializer).
+#
+# The push API key lives in the Rails credentials (the installer injects it from
+# APPSIGNAL_PUSH_API_KEY). APPSIGNAL_* environment variables are read before this
+# block runs, so they keep precedence: the credentials only fill in what is unset,
+# which leaves per-environment overrides (e.g. APPSIGNAL_APP_ENV) possible.
+Appsignal.configure do |config|
+  config.name = "<%= application_name.dasherize %>"
+
+  config.push_api_key = Rails.application.credentials.dig(:appsignal, :push_api_key) if config.push_api_key.blank?
+
+  # The agent activates itself only when APPSIGNAL_PUSH_API_KEY is set in the
+  # environment; with the key in the credentials, activation has to be explicit.
+  # Production is monitored as soon as a key exists, the other environments never are.
+  config.active = config.push_api_key.present? if Rails.env.production?
+
+  # The slug is read-only on Scalingo, as on any host with a read-only filesystem, so
+  # the agent cannot write its own diagnostic log to log/: it falls back to /tmp on its
+  # own and announces it on every boot and every one-off container. Say it upfront.
+  config.log_path = "/tmp" if Rails.env.production?
+
+  # Trek mounts rails-healthcheck at /healthcheck — the platform polls it constantly
+  # and it would dominate the throughput graphs. (Rails' own /up is ignored by default.)
+  config.ignore_actions += ["Healthcheck::HealthchecksController#check"]
+end

data/lib/generators/trek/templates/controllers/admin/uploads_controller.rb

@@ -9,6 +9,10 @@ module Admin
       set_rack_response ImageUploader.upload_response(:cache, request.env)
     end
 
+    def audio
+      set_rack_response AudioUploader.upload_response(:cache, request.env)
+    end
+
     private
 
     def set_rack_response((status, headers, body))

data/lib/generators/trek/templates/controllers/admin/user_password_resets_controller.rb

@@ -29,6 +29,13 @@ module Admin
     end
 
     def update
+      # has_secure_password ignores a blank password: refuse it, rather than report a change that
+      # didn't happen.
+      if params[:password].blank?
+        @user.errors.add(:password, :blank)
+        return redirect_to edit_admin_user_password_reset_path(@token), alert: @user.errors.full_messages.join(", ")
+      end
+
       @user.update!(params.permit(:password))
       @user.user_sessions.destroy_all
       redirect_to new_admin_user_session_path, notice: t(".success")

data/lib/generators/trek/templates/controllers/admin/users_controller.rb

@@ -15,7 +15,10 @@ module Admin
     def theme
       value = params[:theme].to_s
       Current.user.update!(theme: value) if User.themes.key?(value)
-      head :no_content
+      respond_to do |format|
+        format.turbo_stream
+        format.html { head :no_content }
+      end
     end
 
     private

data/lib/generators/trek/templates/controllers/concerns/appsignal_context.rb

@@ -0,0 +1,37 @@
+# Tags every AppSignal transaction with the area it belongs to and the acting user,
+# so errors and slow requests can be filtered per namespace and per actor.
+#
+# Included in ApplicationController (front-office and Admin::BaseController through
+# it) and, from config/initializers/appsignal_context.rb, in Trek::BaseController.
+#
+# Free of charge when AppSignal is inactive (no push API key, i.e. every environment
+# but production): each Appsignal call below returns early.
+module AppsignalContext
+  extend ActiveSupport::Concern
+
+  ADMIN_CONTROLLER_PATHS = ["admin/", "trek/"].freeze
+
+  included do
+    before_action :set_appsignal_context
+  end
+
+  private
+
+  def set_appsignal_context
+    Appsignal.set_namespace(appsignal_namespace)
+    Appsignal.add_tags(user_id: appsignal_user_id) if appsignal_user_id
+  end
+
+  def appsignal_namespace
+    controller_path.start_with?(*ADMIN_CONTROLLER_PATHS) ? "admin" : "web"
+  end
+
+  def appsignal_user_id
+    # Trek::Authentication resolves the session in its own before_action, which may
+    # run after this one, so resume it explicitly. Front-office controllers don't
+    # include the concern and have no session to resume.
+    resume_session if respond_to?(:resume_session, true) && Current.session.nil?
+
+    Current.user&.id
+  end
+end

data/lib/generators/trek/templates/db/seeds/setup/fragments.rb

@@ -0,0 +1,3 @@
+# Makes `fragments` available to seeds and specs: Oaken only defines a model's method once a seed
+# file has used it.
+register Fragment

data/lib/generators/trek/templates/db/seeds/setup/users.rb

@@ -0,0 +1,6 @@
+# Defaults for `users.create` and `users.new` (see https://github.com/kaspth/oaken): a unique email and
+# a password passing Trek's validations, so a seed or a spec only sets what it cares about. Specs
+# sign in with `users.password`.
+def users.password = "correct horse battery staple"
+
+users.defaults email: -> { "user-#{SecureRandom.hex(4)}@example.com" }, password: users.password

data/lib/generators/trek/templates/db/seeds/test/cases/page_tree.rb

@@ -0,0 +1,5 @@
+# A small page tree for specs, loaded with `seed "cases/page_tree"`: the home page (the tree's root,
+# which has no slug), a section, and a page inside it.
+home = pages.create :home, key: "root", title: "Home"
+company = pages.create :company, title: "Company", parent: home
+pages.create :team, title: "Our team", parent: company

data/lib/generators/trek/templates/initializers/appsignal_context.rb

@@ -0,0 +1,5 @@
+# Trek::BaseController is an engine class, so the concern is mixed in on every code
+# reload rather than from a class body the application owns.
+Rails.application.config.to_prepare do
+  Trek::BaseController.include(AppsignalContext)
+end

data/lib/generators/trek/templates/locales/scaffold/model.en.yml.tt

@@ -8,5 +8,5 @@ en:
     attributes:
       <%= file_path %>:
 <%- attributes.each do |attr| -%>
-        <%= attr.name %>: <%= attr.name.humanize -%>
+        <%= attr.name %>: <%= attr.name.humanize %>
 <%- end -%>

data/lib/generators/trek/templates/migrations/fragments.rb.erb

@@ -5,7 +5,7 @@ class TrekFragments < <%= migration_class_name %>
       t.string :namespace, index: true
       t.integer :position, null: false
       t.jsonb :title, default: {}
-      t.jsonb :content
+      t.jsonb :content, default: {}
 
       t.timestamps
 

data/lib/generators/trek/templates/migrations/menu_nodes.rb.erb

@@ -18,4 +18,3 @@ class TrekMenuNodes < <%= migration_class_name %>
     end
   end
 end
-

data/lib/generators/trek/templates/migrations/tag_categories.rb.erb

@@ -1,6 +1,6 @@
 class TrekTagCategories < <%= migration_class_name %>
   def change
-   create_table "tag_categories" do |t|
+    create_table "tag_categories" do |t|
       t.string :key, index: { unique: true }
       t.string :name
       t.integer :position, null: false

data/lib/generators/trek/templates/migrations/taggings.rb.erb

@@ -1,6 +1,6 @@
 class TrekTaggings < <%= migration_class_name %>
   def change
-   create_table :taggings do |t|
+    create_table :taggings do |t|
       t.references :taggable, null: false, polymorphic: true
       t.references :tag, null: false, foreign_key: true
 

data/lib/generators/trek/templates/migrations/users.rb.erb

@@ -4,7 +4,8 @@ class TrekUsers < <%= migration_class_name %>
     add_column :<%= tableized_model_class %>, :theme, :integer, default: 0, null: false
     add_column :<%= tableized_model_class %>, :locale, :string
     add_column :<%= tableized_model_class %>, :role, :integer, default: 1, null: false
-    add_column :<%= tableized_model_class %>, :password_digest, :string, null: false
+    # The table is created empty by the trek_create_users migration, so no default is needed.
+    add_column :<%= tableized_model_class %>, :password_digest, :string, null: false # rubocop:disable Rails/NotNullColumn
     add_column :<%= tableized_model_class %>, :last_activity_at, :datetime
   end
 end

data/lib/generators/trek/templates/models/tag.rb

@@ -6,7 +6,6 @@ class Tag < ApplicationRecord
     optional: true
 
   has_many :taggings, dependent: :destroy
-  has_many :taggables, through: :taggings
 
   validates :name, :key, presence: true
   validates :key, uniqueness: { scope: :category }
@@ -19,6 +18,12 @@ class Tag < ApplicationRecord
   scope :in_categories, ->(keys) { TagCategory.where(key: keys).ordered.map(&:tags).reduce(:+) }
   scope :in_category, ->(key) { TagCategory.find_by(key:)&.tags }
 
+  # The tagged records, of any model. Not a `has_many :through`: Rails can't go through the
+  # polymorphic `Tagging#taggable`.
+  def taggables
+    taggings.includes(:taggable).map(&:taggable)
+  end
+
   def to_s
     name
   end

data/lib/generators/trek/templates/policies/admin/tag_policy.rb

@@ -13,7 +13,7 @@ module Admin
     end
 
     def destroy?
-      user.privileged? && record.taggables.empty?
+      user.privileged? && record.taggings.empty?
     end
 
     def reorder?

data/lib/generators/trek/templates/policies/external_link_policy.rb

@@ -16,7 +16,7 @@ module Admin
     relation_scope do |relation|
       next relation if user.privileged?
 
-      relation.where(user:)
+      relation.none
     end
   end
 end

data/lib/generators/trek/templates/spec/models/page_spec.rb

@@ -0,0 +1,24 @@
+require "rails_helper"
+
+RSpec.describe Page do
+  before { seed "cases/page_tree" }
+
+  it "slugs the title" do
+    expect(pages.team.slug).to eq("our-team")
+  end
+
+  it "builds the full path from the slugs of its ancestors, root excluded" do
+    expect(pages.team.full_path).to eq("company/our-team")
+  end
+
+  it "is found at its full path" do
+    expect(described_class.find_at_full_path("company/our-team")).to eq(pages.team)
+  end
+
+  it "keeps its former path when moved, so old URLs can be redirected" do
+    team = pages.team
+    team.update!(parent: pages.home)
+
+    expect(team.reload.paths.map(&:path)).to eq(["our-team", "company/our-team"])
+  end
+end

data/lib/generators/trek/templates/spec/models/user_spec.rb

@@ -0,0 +1,109 @@
+require "rails_helper"
+
+RSpec.describe User do
+  subject(:user) { users.new }
+
+  it "is valid with an email and a password" do
+    expect(user).to be_valid
+  end
+
+  describe "validations" do
+    it "requires an email" do
+      user.email = nil
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a well-formed email" do
+      user.email = "not an email"
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a unique email" do
+      users.create(email: user.email)
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a unique email whatever its case" do
+      users.create(email: "ada@example.com")
+      user.email = "Ada@Example.com"
+
+      expect(user).to be_invalid
+    end
+
+    %w[ada..lovelace@example.com .ada@example.com ada.@example.com ada@example..com ada@example].each do |email|
+      it "refuses an email mail providers would reject: #{email}" do
+        user.email = email
+
+        expect(user).to be_invalid
+      end
+    end
+
+    it "refuses a password made of spaces only" do
+      user.password = " " * 8
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a password of at least 8 characters on creation" do
+      user.password = "short"
+
+      expect(user).to be_invalid
+    end
+
+    it "requires a password of at least 8 characters when changing it" do
+      user = users.create
+      user.password = "short"
+
+      expect(user).to be_invalid
+    end
+
+    it "does not require the password when changing something else" do
+      user = described_class.find(users.create.id)
+      user.name = "Ada"
+
+      expect(user).to be_valid
+    end
+  end
+
+  describe "email" do
+    it "is stored in lower case, without surrounding spaces" do
+      expect(users.create(email: " Ada@Example.com ").email).to eq("ada@example.com")
+    end
+
+    it "finds the user whatever its case" do
+      ada = users.create(email: "ada@example.com")
+
+      expect(described_class.find_by(email: "ADA@example.com")).to eq(ada)
+    end
+  end
+
+  describe "roles" do
+    it "defaults to guest" do
+      expect(user.role).to eq("guest")
+    end
+
+    it "treats admins and editors as privileged" do
+      expect(%w[admin editor guest].map { |role| users.new(role:).privileged? }).to eq([true, true, false])
+    end
+
+    it "scopes privileged users" do
+      admin, editor = users.create(role: :admin), users.create(role: :editor)
+      users.create(role: :reader)
+
+      expect(described_class.privileged).to contain_exactly(admin, editor)
+    end
+  end
+
+  describe "#to_s" do
+    it "reads the name" do
+      expect(users.new(name: "Ada").to_s).to eq("Ada")
+    end
+
+    it "falls back to the email" do
+      expect(users.new(email: "ada@example.com").to_s).to eq("ada@example.com")
+    end
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/external_link_policy_spec.rb

@@ -0,0 +1,17 @@
+require "rails_helper"
+
+RSpec.describe Admin::ExternalLinkPolicy do
+  before { ExternalLink.create!(url: "https://example.com") }
+
+  it "shows privileged users every external link" do
+    policy = described_class.new(user: users.new(role: :editor))
+
+    expect(policy.apply_scope(ExternalLink.all, type: :active_record_relation)).to match_array(ExternalLink.all)
+  end
+
+  it "shows other roles no external link" do
+    policy = described_class.new(user: users.new(role: :reader))
+
+    expect(policy.apply_scope(ExternalLink.all, type: :active_record_relation)).to be_empty
+  end
+end