trek 2.2.0 → 2.3.1

data/lib/generators/trek/templates/spec/policies/admin/fragment_policy_spec.rb

@@ -0,0 +1,33 @@
+require "rails_helper"
+
+RSpec.describe Admin::FragmentPolicy do
+  def policy(role, record = Fragment)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create, edit and delete fragments" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from fragments" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users edit a fragment" do
+    expect(policy("editor").permitted_attributes).to contain_exactly(:content, :key, :namespace, :title)
+  end
+
+  it "lets other roles edit nothing" do
+    expect(policy("reader").permitted_attributes).to be_empty
+  end
+
+  it "shows other roles no fragment" do
+    Fragment.create!(key: "footer", namespace: "layout", title: "Footer")
+
+    expect(policy("reader").apply_scope(Fragment.all, type: :active_record_relation)).to be_empty
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/page_policy_spec.rb

@@ -0,0 +1,39 @@
+require "rails_helper"
+
+RSpec.describe Admin::PagePolicy do
+  def policy(role, record = Page)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create, edit and delete pages" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from pages" do
+      expect(%i[index? create? update? destroy?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users edit a page's content" do
+    expect(policy("editor").permitted_attributes).to include(:title, :slug, :description, :content)
+  end
+
+  it "lets other roles edit nothing" do
+    expect(policy("reader").permitted_attributes).to be_empty
+  end
+
+  it "shows privileged users every page" do
+    seed "cases/page_tree"
+
+    expect(policy("editor").apply_scope(Page.all, type: :active_record_relation)).to match_array(Page.all)
+  end
+
+  it "shows other roles no page" do
+    seed "cases/page_tree"
+
+    expect(policy("reader").apply_scope(Page.all, type: :active_record_relation)).to be_empty
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/preview_policy_spec.rb

@@ -0,0 +1,9 @@
+require "rails_helper"
+
+RSpec.describe Admin::PreviewPolicy do
+  %w[admin editor user reader guest].each do |role|
+    it "lets #{role}s preview the home page" do
+      expect(described_class.new(user: users.new(role:)).apply(:home?)).to be(true)
+    end
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/tag_category_policy_spec.rb

@@ -0,0 +1,31 @@
+require "rails_helper"
+
+RSpec.describe Admin::TagCategoryPolicy do
+  let(:category) { TagCategory.create!(name: "Topics", key: "topics") }
+
+  def policy(role, record = TagCategory)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create and edit tag categories" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from tag categories" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users delete an empty category" do
+    expect(policy("editor", category).apply(:destroy?)).to be(true)
+  end
+
+  it "keeps a category with tags from being deleted" do
+    Tag.create!(name: "News", key: "news", category:)
+
+    expect(policy("admin", category.reload).apply(:destroy?)).to be(false)
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/tag_policy_spec.rb

@@ -0,0 +1,31 @@
+require "rails_helper"
+
+RSpec.describe Admin::TagPolicy do
+  let(:tag) { Tag.create!(name: "News", key: "news") }
+
+  def policy(role, record = Tag)
+    described_class.new(record, user: users.new(role:))
+  end
+
+  %w[admin editor].each do |role|
+    it "lets #{role}s list, create and edit tags" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(true))
+    end
+  end
+
+  %w[user reader guest].each do |role|
+    it "keeps #{role}s away from tags" do
+      expect(%i[index? create? update?].map { |rule| policy(role).apply(rule) }).to all(be(false))
+    end
+  end
+
+  it "lets privileged users delete an unused tag" do
+    expect(policy("editor", tag).apply(:destroy?)).to be(true)
+  end
+
+  it "keeps a tag in use from being deleted" do
+    allow(tag).to receive(:taggings).and_return([Tagging.new])
+
+    expect(policy("admin", tag).apply(:destroy?)).to be(false)
+  end
+end

data/lib/generators/trek/templates/spec/policies/admin/user_policy_spec.rb

@@ -0,0 +1,58 @@
+require "rails_helper"
+
+RSpec.describe Admin::UserPolicy do
+  let(:admin) { users.create(role: :admin) }
+  let(:editor) { users.create(role: :editor) }
+
+  def policy(user, record = User)
+    described_class.new(record, user:)
+  end
+
+  it "lets admins list, create and delete users" do
+    expect(%i[index? create? destroy?].map { |rule| policy(admin).apply(rule) }).to all(be(true))
+  end
+
+  it "lets admins edit any user" do
+    expect(policy(admin, editor).apply(:update?)).to be(true)
+  end
+
+  it "keeps editors away from the users list" do
+    expect(%i[index? create? destroy?].map { |rule| policy(editor).apply(rule) }).to all(be(false))
+  end
+
+  it "lets editors see and edit themselves" do
+    expect(%i[show? update?].map { |rule| policy(editor, editor).apply(rule) }).to all(be(true))
+  end
+
+  it "keeps editors away from other users" do
+    expect(%i[show? update?].map { |rule| policy(editor, admin).apply(rule) }).to all(be(false))
+  end
+
+  it "lets admins change a user's role" do
+    expect(policy(admin, editor).permitted_attributes).to include(:role)
+  end
+
+  it "lets admins invite the users they create" do
+    expect(policy(admin, User).permitted_attributes).to include(:send_invite)
+  end
+
+  it "lets editors change their own details but not their role" do
+    expect(policy(editor, editor).permitted_attributes).to contain_exactly(:name, :email, :locale, :theme)
+  end
+
+  it "lets editors change nothing on another user" do
+    expect(policy(editor, admin).permitted_attributes).to be_empty
+  end
+
+  it "shows admins the privileged users only" do
+    reader = users.create(role: :reader)
+
+    expect(described_class.new(user: admin).apply_scope(User.all, type: :active_record_relation)).not_to include(reader)
+  end
+
+  it "shows editors no user" do
+    admin
+
+    expect(described_class.new(user: editor).apply_scope(User.all, type: :active_record_relation)).to be_empty
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/fragments_spec.rb

@@ -0,0 +1,50 @@
+require "rails_helper"
+
+RSpec.describe "Admin fragments", type: :request do
+  let!(:footer) { fragments.create(key: "footer", namespace: "layout", title: "Footer") }
+
+  before do
+    editor = users.create(role: :editor)
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+  end
+
+  it "lists the fragments" do
+    get admin_fragments_path
+
+    expect(response.body).to include("footer")
+  end
+
+  it "renders the new fragment form" do
+    get new_admin_fragment_path
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "creates a fragment" do
+    params = { fragment: { key: "tagline", namespace: "home", title: "Tagline" } }
+
+    expect { post admin_fragments_path, params: }.to change(Fragment, :count).by(1)
+  end
+
+  it "refuses a key already used in the namespace" do
+    post admin_fragments_path, params: { fragment: { key: "footer", namespace: "layout", title: "Another footer" } }
+
+    expect(response).to have_http_status(:unprocessable_entity)
+  end
+
+  it "renders the edit form" do
+    get edit_admin_fragment_path(footer)
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "updates a fragment" do
+    patch admin_fragment_path(footer), params: { fragment: { title: "Site footer" } }
+
+    expect(footer.reload.title).to eq("Site footer")
+  end
+
+  it "deletes a fragment" do
+    expect { delete admin_fragment_path(footer) }.to change(Fragment, :count).by(-1)
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/pages_spec.rb

@@ -0,0 +1,47 @@
+require "rails_helper"
+
+RSpec.describe "Admin pages", type: :request do
+  before do
+    seed "cases/page_tree"
+    editor = users.create(role: :editor)
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+  end
+
+  it "lists the pages" do
+    get admin_pages_path
+
+    expect(response.body).to include("Company").and include("Our team")
+  end
+
+  it "renders the new page form" do
+    get new_admin_page_path
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "creates a page" do
+    expect { post admin_pages_path, params: { page: { title: "Contact" } } }.to change(Page, :count).by(1)
+  end
+
+  it "refuses a page without a title" do
+    post admin_pages_path, params: { page: { title: "" } }
+
+    expect(response).to have_http_status(:unprocessable_entity)
+  end
+
+  it "renders the edit form" do
+    get edit_admin_page_path(pages.team)
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "updates a page" do
+    patch admin_page_path(pages.team), params: { page: { title: "The team" } }
+
+    expect(pages.team.title).to eq("The team")
+  end
+
+  it "deletes a page" do
+    expect { delete admin_page_path(pages.team) }.to change(Page, :count).by(-1)
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/uploads_spec.rb

@@ -0,0 +1,22 @@
+require "rails_helper"
+
+# The endpoints the admin's image and sound fields upload to (`Trek::Form::ImageFieldComponent`,
+# `Trek::Form::SoundFieldComponent`).
+RSpec.describe "Admin uploads", type: :request do
+  before do
+    editor = users.create(role: :editor)
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+  end
+
+  it "stores an uploaded image in the cache and returns its data" do
+    post "/admin/upload/image", params: { file: fixture_file_upload("image.png", "image/png") }
+
+    expect(response.parsed_body["data"]).to include("id", "storage" => "cache")
+  end
+
+  it "stores an uploaded sound in the cache and returns its data" do
+    post "/admin/upload/audio", params: { file: fixture_file_upload("sound.mp3", "audio/mpeg") }
+
+    expect(response.parsed_body["data"]).to include("id", "storage" => "cache")
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/user_password_resets_spec.rb

@@ -0,0 +1,78 @@
+require "rails_helper"
+
+RSpec.describe "Admin password resets", type: :request do
+  let(:editor) { users.create(role: :editor) }
+
+  it "renders the reset request form" do
+    get new_admin_user_password_reset_path
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "emails a reset link to a privileged user" do
+    expect { post admin_user_password_resets_path, params: { email: editor.email } }
+      .to have_enqueued_mail(Admin::PasswordsMailer, :reset)
+  end
+
+  it "sends nothing for an unknown email" do
+    expect { post admin_user_password_resets_path, params: { email: "nobody@example.com" } }
+      .not_to have_enqueued_mail
+  end
+
+  it "answers an unknown email as a known one, so it can't be used to find accounts" do
+    post admin_user_password_resets_path, params: { email: "nobody@example.com" }
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "renders the new password form from a reset link" do
+    get edit_admin_user_password_reset_path(editor.password_reset_token)
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "renders the new password form from an invitation link" do
+    get edit_admin_user_password_reset_path(editor.generate_token_for(:invite))
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "sends an invalid link back to the reset request form" do
+    get edit_admin_user_password_reset_path("not-a-token")
+
+    expect(response).to redirect_to(new_admin_user_password_reset_path)
+  end
+
+  it "sets the new password" do
+    patch admin_user_password_reset_path(editor.password_reset_token), params: { password: "a brand new password" }
+
+    expect(editor.reload.authenticate("a brand new password")).to be_truthy
+  end
+
+  it "signs the user out everywhere" do
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+    patch admin_user_password_reset_path(editor.password_reset_token), params: { password: "a brand new password" }
+
+    expect(editor.user_sessions).to be_empty
+  end
+
+  it "sends an empty password back to the form rather than pretending to change it" do
+    token = editor.password_reset_token
+    patch admin_user_password_reset_path(token), params: { password: "" }
+
+    expect(response).to redirect_to(edit_admin_user_password_reset_path(token))
+  end
+
+  it "sends a password shorter than 8 characters back to the form" do
+    token = editor.password_reset_token
+    patch admin_user_password_reset_path(token), params: { password: "short" }
+
+    expect(response).to redirect_to(edit_admin_user_password_reset_path(token))
+  end
+
+  it "keeps the old password when the new one is too short" do
+    patch admin_user_password_reset_path(editor.password_reset_token), params: { password: "short" }
+
+    expect(editor.reload.authenticate(users.password)).to be_truthy
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/user_sessions_spec.rb

@@ -0,0 +1,51 @@
+require "rails_helper"
+
+RSpec.describe "Admin sign-in", type: :request do
+  let(:editor) { users.create(role: :editor) }
+
+  it "renders the sign-in form" do
+    get new_admin_user_session_path
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "signs a privileged user in and opens the dashboard" do
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+    follow_redirect!
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "signs in whatever the case of the email" do
+    post admin_user_session_path, params: { email: editor.email.upcase, password: users.password }
+
+    expect(response).to redirect_to(admin_root_url)
+  end
+
+  it "refuses a wrong password" do
+    post admin_user_session_path, params: { email: editor.email, password: "not the password" }
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "refuses a user who is not privileged" do
+    reader = users.create(role: :reader)
+    post admin_user_session_path, params: { email: reader.email, password: users.password }
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "sends a signed-out visitor to the sign-in form" do
+    get admin_root_path
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "signs out" do
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+    delete admin_user_session_path
+    get admin_root_path
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/users_spec.rb

@@ -0,0 +1,99 @@
+require "rails_helper"
+
+RSpec.describe "Admin users", type: :request do
+  let(:admin) { users.create(role: :admin, name: "Ada") }
+  let(:editor) { users.create(role: :editor, name: "Grace") }
+
+  def sign_in(user)
+    post admin_user_session_path, params: { email: user.email, password: users.password }
+  end
+
+  context "when signed in as an admin" do
+    before { sign_in(admin) }
+
+    it "lists the privileged users" do
+      editor
+      get admin_users_path
+
+      expect(response.body).to include("Grace")
+    end
+
+    it "leaves the other users out" do
+      users.create(role: :reader, name: "Linus")
+      get admin_users_path
+
+      expect(response.body).not_to include("Linus")
+    end
+
+    it "renders the new user form" do
+      get new_admin_user_path
+
+      expect(response).to have_http_status(:ok)
+    end
+
+    it "creates a user and sends them an invitation" do
+      params = { user: { email: "new@example.com", role: "editor", send_invite: "1" } }
+
+      expect { post admin_users_path, params: }
+        .to change(User, :count).by(1).and have_enqueued_mail(AdminMailer, :invite)
+    end
+
+    it "changes a user's role" do
+      patch admin_user_path(editor), params: { user: { role: "admin" } }
+
+      expect(editor.reload.role).to eq("admin")
+    end
+
+    it "deletes a user" do
+      editor
+
+      expect { delete admin_user_path(editor) }.to change(User, :count).by(-1)
+    end
+  end
+
+  context "when signed in as an editor" do
+    before { sign_in(editor) }
+
+    it "is sent back to the dashboard from the users list" do
+      get admin_users_path
+
+      expect(response).to redirect_to(admin_root_path)
+    end
+
+    it "is sent back to the dashboard from another user's profile" do
+      get admin_user_path(admin)
+
+      expect(response).to redirect_to(admin_root_path)
+    end
+
+    it "is told why they were sent back" do
+      get admin_users_path
+
+      expect(flash[:alert]).to eq(I18n.t!("notices.unauthorized"))
+    end
+
+    it "gets a 403 for a JSON request they aren't allowed" do
+      get admin_users_path(format: :json)
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it "edits their own profile" do
+      patch admin_user_path(editor), params: { user: { name: "Grace H." } }
+
+      expect(editor.reload.name).to eq("Grace H.")
+    end
+
+    it "cannot change their own role" do
+      patch admin_user_path(editor), params: { user: { role: "admin" } }
+
+      expect(editor.reload.role).to eq("editor")
+    end
+
+    it "switches their admin theme" do
+      patch theme_admin_users_path(format: :turbo_stream), params: { theme: "dark" }
+
+      expect(editor.reload.theme).to eq("dark")
+    end
+  end
+end

data/lib/generators/trek/templates/views/admin/user_password_resets/edit.html.slim

@@ -1,6 +1,6 @@
 = render Trek::GateComponent.new
   = form_with url: admin_user_password_reset_path(@token), method: :put do |f|
-    = f.group :password
+    = f.group :password, model_name: User.model_name
       = f.password_field :password,
           required: true,
           autocomplete: "new-password",

data/lib/generators/trek/templates/views/admin/user_password_resets/new.html.slim

@@ -1,6 +1,6 @@
 = render Trek::GateComponent.new
   = form_with url: admin_user_password_resets_path do |f|
-    = f.group :email
+    = f.group :email, model_name: User.model_name
       = f.email_field :email,
           required: true,
           autofocus: true,

data/lib/generators/trek/templates/views/admin/user_sessions/new.html.slim

@@ -1,13 +1,13 @@
 = render Trek::GateComponent.new
   = form_with url: admin_user_session_path do |f|
-    = f.group :email
+    = f.group :email, model_name: User.model_name
       = f.email_field :email,
           required: true,
           autofocus: @email.nil?,
           autocomplete: "username",
           value: @email
 
-    = f.group :password
+    = f.group :password, model_name: User.model_name
       = f.password_field :password,
           required: true,
           autofocus: @email.present?,

data/lib/generators/trek/templates/views/admin/users/theme.turbo_stream.slim

@@ -0,0 +1,2 @@
+= turbo_stream.replace Trek::ThemeHelper::THEME_ICON_ID do
+  = theme_icon(Current.user.theme)

data/lib/generators/trek/upgrade/v2_generator.rb

@@ -60,6 +60,9 @@ module Trek
             content.sub!(/^#{key}:\n/, "") if YAML.safe_load(content)&.fetch(key, :absent).nil?
           end
           content.gsub!(/\n{3,}/, "\n\n")
+          # No blank line left at the end where a removed block was: `preapprove_npm_package` appends
+          # its own, and a second run would otherwise collapse the double blank line it makes.
+          content.sub!(/\n+\z/, "\n")
 
           create_file ".yarnrc.yml", content, force: true
         rescue Psych::Exception

data/lib/tasks/trek/attachments.rake

@@ -0,0 +1,18 @@
+namespace :trek do
+  namespace :attachments do
+    desc "Promote Shrine attachments left in the cache storage (DRY_RUN=1 only lists them)"
+    task promote_cached: :environment do
+      # Loads every model, so that all attachments are found
+      Rails.application.eager_load!
+
+      statuses = Hash.new(0)
+
+      Trek::CachedAttachments.new.promote(dry_run: ENV["DRY_RUN"].present?) do |entry|
+        statuses[entry.status] += 1
+        puts [entry.status, "#{entry.record.class.name}##{entry.record.id}.#{entry.name}", entry.file.id].join("\t")
+      end
+
+      puts statuses.empty? ? "No attachment left in the cache storage." : statuses.map { "#{_2} #{_1}" }.join(", ")
+    end
+  end
+end

data/lib/trek/cached_attachments.rb

@@ -0,0 +1,53 @@
+module Trek
+  # Finds the records whose Shrine attachments still point to the temporary cache storage —
+  # files whose promotion was skipped — and promotes those whose cached file still exists.
+  class CachedAttachments
+    Entry = Struct.new(:record, :name, :file, :status, keyword_init: true)
+
+    def self.default_models
+      ActiveRecord::Base.descendants.select do |model|
+        !model.abstract_class? && model == model.base_class && model.table_exists?
+      end
+    end
+
+    def initialize(models = self.class.default_models)
+      @models = models
+    end
+
+    # Yields an Entry per cached attachment, whose status is :promoted, :promotable (dry run),
+    # :missing (the cached file is gone) or :changed (the record changed during promotion).
+    def promote(dry_run: false)
+      return enum_for(:promote, dry_run:) unless block_given?
+
+      each_cached_attachment do |record, name|
+        attacher = record.public_send(:"#{name}_attacher")
+
+        yield Entry.new(record:, name:, file: attacher.file, status: promote_attacher(attacher, dry_run:))
+      end
+    end
+
+    private
+
+    def promote_attacher(attacher, dry_run:)
+      return :missing unless attacher.file.exists?
+      return :promotable if dry_run
+
+      attacher.atomic_promote
+      :promoted
+    rescue Shrine::AttachmentChanged
+      :changed
+    end
+
+    def each_cached_attachment(&)
+      @models.each do |model|
+        model.ancestors.grep(Shrine::Attachment).each do |attachment|
+          name = attachment.attachment_name
+          column = model.connection.quote_column_name(:"#{name}_data")
+          cache_key = attachment.options.fetch(:cache, :cache).to_s
+
+          model.where("#{column}::jsonb ->> 'storage' = ?", cache_key).find_each { |record| yield record, name }
+        end
+      end
+    end
+  end
+end