trek 2.3.0 → 2.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c42696637827a5c00e5b85274ade2eda636f54cd975af5f781c5f0eb6090e4e9
-  data.tar.gz: 1860fefeba9c9a75a1c5caa7e1ec3b9a5907a914636f5c1e65be27ce9a5fe166
+  metadata.gz: 3749a9dc01b378419fbbaacdbf9e8251100d9bdd6281b308a9d44cf9dd18d182
+  data.tar.gz: d61b12a1f80494ebaf0c664bbfcfdf2d24b682632ef9c268117b4de23fb7e1b5
 SHA512:
-  metadata.gz: c6da73ed50866c320bb0a16b91d6acb77d2c6eb43ec3d9bc5fdcbd2000560dcc7789929d6a01674cce34f1c53ba4db94da5454d8302d841987d20fa48594c0f4
-  data.tar.gz: b5897444ef3f86a8f86f65b82180d20078e2220a5508cc8af5d87c36ff2c05cb43dc9f4b1ee30fea9afb43c3769754dfab4670127909a6a4788db213b276f9e8
+  metadata.gz: e9083e34869370a8b22b69a8c9aadb3f404e74f9d4b32097c48f51ad024d750aed71769a203112b78f19b74c7489ec46f512340bdd728dfebfef76f6bd37ec27
+  data.tar.gz: 9800e5d16a2639e2a51644ce67bb488bd1e4c34930867f08311b7df56992dd7dcf42b37a926d4097a5bd5f9a1a59bc476f5d2c70091b9eb2f54efc11ee14dcfc

data/AGENTS.md

@@ -60,6 +60,6 @@ Security: `bundle exec brakeman` · `bundle exec bundle-audit check --update`
 - **Slim** linted via slim_lint; **JS/CSS** via ESLint + Stylelint + Prettier 2.8.8
 - **i18n**: keep English + French locales in sync (`config/locales/trek.*.yml`); DeepL auto-translation via `DEEPL_AUTH_KEY`
 - **Versioning**: version lives in both `lib/trek/version.rb` and `package.json` — keep in sync via `make release`
-- **CHANGELOG.md**: Keep-a-Changelog format. **Every MR must add an `[Unreleased]` entry.** When the change requires action in the host app on upgrade, end the entry with a bold `**Upgrade note:**` label followed by what to do. Use the same label when the change lets host apps remove or simplify existing patches or custom implementations (e.g. "**Upgrade note:** you can now drop your custom …") — never as an unlabelled trailing sentence.
+- **CHANGELOG.md**: Keep-a-Changelog format. **Every MR must add an `[Unreleased]` entry.** Keep entries short: one or two sentences on what changed for host apps, not how it was found or fixed — the MR description holds the details. When the change requires action in the host app on upgrade, end the entry with a bold `**Upgrade note:**` label followed by what to do. Use the same label when the change lets host apps remove or simplify existing patches or custom implementations (e.g. "**Upgrade note:** you can now drop your custom …") — never as an unlabelled trailing sentence.
 - **Public code**: Trek ships publicly (gem, npm, docs), so nothing committed may mention a client or project name, nor a client's domain models or business logic — not in code, comments, specs, templates, docs, CHANGELOG or commit messages. Use neutral examples (`Page`, `Shop::Product`, an engine's `Blog::Post`). Client context belongs in GitLab issues and MR descriptions only.
 - **CI**: GitLab CI (`.gitlab-ci.yml`), stages build → lint → security → test → deploy; docs deploy to Netlify; deps via Renovate

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 ## [Unreleased]
 
+## [2.3.2] - 2026-10-02
+
+### Fixed
+
+- **Security:** `Trek::Scopes#apply_scopes` called any name found in `params[:scopes]` that the relation answered to, not only the controller's `available_scopes`, which let a request run unintended methods on the listed records. Only the names in `available_scopes` are applied now; others are ignored. **Upgrade note:** update Trek as soon as possible. A controller passing `apply_scopes` a scope name it does not list in `available_scopes` must add it there.
+- The generated admin sign-in, password reset request and new password pages rendered their actions with the default aspect of `Trek::Form::ActionsComponent`, whose sticky action bar (top margin, padding, background) is meant for edit forms: inside those small cards, the button and the « forgotten password » link sat in a padded bar. They now use the `seamless` aspect. **Upgrade note:** in apps generated before this version, pass `aspect: :seamless` to `Trek::Form::ActionsComponent.new` in `app/views/admin/user_sessions/new.html.slim` and `app/views/admin/user_password_resets/{new,edit}.html.slim`.
+
+## [2.3.1] - 2026-10-02
+
+### Changed
+
+- `Trek::Filters` only filters on the columns a controller lists in its new `available_filters` (empty by default), read through strong params (`filter_params`): other keys of `params[:filters]`, and values that aren't a single value, are ignored. Until now any key became a `where` condition, so a request could filter an index on columns it was never meant to expose. **Upgrade note:** in each controller including `Trek::Filters`, define `available_filters` returning the filtered columns (e.g. `def available_filters = %i[country_code]`), or its filters stop applying.
+- `Trek::Users::Validations` stores emails stripped and in lower case (sign-in and password resets now ignore case), checks them with `email_validator`'s strict mode, and refuses a spaces-only password; the password reset form refuses an empty password instead of pretending to change it. **Upgrade note:** resolve users whose emails differ only by case (`User.group("lower(email)").having("count(*) > 1").count`), then downcase the rest (`User.find_each { |user| user.update_column(:email, user.email.strip.downcase) }`); in `Admin::UserPasswordResetsController#update`, redirect back with an error when `params[:password]` is blank (see Trek's template); re-run `rails g trek:install:model_specs` for the new specs.
+
+### Fixed
+
+- The header's theme switcher now hovers like the links next to it, and the whole pill is clickable, not just the icon. `Trek::DropdownComponent`'s trigger inherits its context's color, and a new `trigger_classnames:` option styles the trigger button. **Upgrade note:** if you reuse `Trek::DropdownComponent`, move trigger styling (padding, hover) from `classnames:` to `trigger_classnames:`.
+
 ## [2.3.0] - 2026-10-01
 
 ### Added

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    trek (2.3.0)
+    trek (2.3.2)
       action_policy (~> 0.6)
       actioncable
       acts_as_list (~> 1.1)
@@ -10,6 +10,7 @@ PATH
       closure_tree (~> 9.0)
       deepl-rb (~> 3.0)
       dry-initializer (~> 3.1)
+      email_validator (~> 2.2)
       fastimage (~> 2.2)
       http_accept_language (~> 2.1)
       i18n-tasks (~> 1.0)
@@ -205,6 +206,8 @@ GEM
       dry-inflector (~> 1.0)
       dry-logic (~> 1.4)
       zeitwerk (~> 2.6)
+    email_validator (2.2.4)
+      activemodel
     erb (6.0.4)
     erubi (1.13.1)
     fastimage (2.4.0)

data/app/components/trek/dropdown_component/dropdown_component.css

@@ -5,13 +5,16 @@
   position: relative;
 }
 
+/* Inherits its context's color and font, so it reads as part of the surrounding text or link (and
+   follows its hover color). Style the trigger itself, not the root, with `trigger_classnames:`. */
 .trigger {
   align-items: center;
   background: none;
   border: none;
-  color: var(--slate-12);
+  color: inherit;
   cursor: pointer;
   display: inline-flex;
+  font: inherit;
   gap: 0.4rem;
 }
 

data/app/components/trek/dropdown_component/dropdown_component.html.slim

@@ -1,7 +1,7 @@
 div(class=classes data-controller=identifier)
   button(
     type="button"
-    class=class_for("trigger")
+    class=trigger_classes
     aria-haspopup="true"
     aria-expanded="false"
     aria-controls=menu_id

data/app/components/trek/dropdown_component.rb

@@ -2,6 +2,7 @@ module Trek
   class DropdownComponent < Trek::Component
     option :label, optional: true       # accessible name (aria-label on trigger + menu)
     option :classnames, optional: true  # extra classes on root
+    option :trigger_classnames, optional: true # extra classes on the trigger button, the clickable element
     option :hide_chevron, default: proc { false }
 
     renders_one :trigger                 # inner content of the trigger button (e.g. an icon)
@@ -11,6 +12,10 @@ module Trek
       class_names_for(root_class, classnames)
     end
 
+    def trigger_classes
+      class_names_for(class_for("trigger"), trigger_classnames)
+    end
+
     def menu_id
       @menu_id ||= "#{identifier}-menu-#{SecureRandom.hex(4)}"
     end

data/app/components/trek/header_component/header_component.css

@@ -66,13 +66,12 @@
   text-overflow: ellipsis;
 }
 
-/* Theme Dropdown */
-.nav-item-link:global(.c-trek--dropdown-root) {
-  padding: 0.8rem 1.6rem;
-}
-
-.nav-item-link:global(.c-trek--dropdown-root .c-trek--icon-root) {
+/* The theme dropdown's trigger: a nav item button (the button itself, so the whole pill is clickable),
+   with a larger icon and less vertical padding. */
+.nav-theme-trigger {
   --icon-size: 2rem;
+
+  padding: 0.8rem 1.6rem;
 }
 
 /* Media queries */

data/app/components/trek/header_component/header_component.html.slim

@@ -35,7 +35,7 @@ div(class=classes data-controller=identifier \
         li(class=class_for("nav-item"))
           = render Trek::DropdownComponent.new( \
               label: User.human_attribute_name(:theme),
-              classnames: class_for("nav-item-link"),
+              trigger_classnames: theme_trigger_classes,
               hide_chevron: true,
             ) do |dropdown|
             - dropdown.with_trigger do

data/app/components/trek/header_component.rb

@@ -29,6 +29,10 @@ module Trek
       ) && preview_path.present?
     end
 
+    def theme_trigger_classes
+      class_names_for("nav-item-button", "nav-theme-trigger", map_args: true)
+    end
+
     def theme_item_data(theme)
       { action: stimulus_action("click", "setTheme"), theme: }
     end

data/app/controllers/concerns/trek/filters.rb

@@ -25,8 +25,13 @@ module Trek
     def apply_filters(scope, filters)
       return scope if filters.blank?
 
+      # Only the controller's own filters: the keys come from the request and become column names
+      allowed = available_filters.map(&:to_s)
+
       filters.each do |filter, value|
         next if value.blank?
+        next unless allowed.include?(filter.to_s)
+
         value = nil if value == "nil"
 
         scope = scope.where(filter => value)
@@ -37,7 +42,19 @@ module Trek
 
     def apply_filters!
       @filters_applied = true
-      @objects = apply_filters(@objects, params[:filters])
+      @objects = apply_filters(@objects, filter_params)
+    end
+
+    # The requested filters, permitted to the available ones with scalar values only; nil when
+    # params[:filters] isn't a hash
+    def filter_params
+      filters = params[:filters]
+      filters.permit(*available_filters) if filters.respond_to?(:permit)
+    end
+
+    # The columns a request may filter on; override in the controller.
+    def available_filters
+      []
     end
 
     private

data/app/controllers/concerns/trek/scopes.rb

@@ -19,8 +19,13 @@ module Trek
     def apply_scopes(scope, filters)
       return scope if filters.blank?
 
+      # Only the controller's own scopes: the names come from the request, and a relation also
+      # answers to destroy_all, delete_all…
+      allowed = available_scopes.map(&:to_s)
+
       filters.each do |filter, value|
         next if value.blank?
+        next unless allowed.include?(filter.to_s)
 
         scope = scope.public_send(filter) if scope.respond_to?(filter)
       end
@@ -31,7 +36,7 @@ module Trek
     def apply_scopes!
       @scopes_applied = true
       @unscoped_objects = @objects
-      @objects = apply_scopes(@objects, params[:scopes])
+      @objects = apply_scopes(@objects, scope_params)
       scope_counts
     end
 
@@ -65,8 +70,10 @@ module Trek
       []
     end
 
+    # The requested scopes, permitted to the available ones; nil when params[:scopes] isn't a hash
     def scope_params
-      params[:scopes]&.permit(*available_scopes)
+      scopes = params[:scopes]
+      scopes.permit(*available_scopes) if scopes.respond_to?(:permit)
     end
 
     private def ensure_scopes_applied

data/app/models/concerns/trek/users/validations.rb

@@ -4,14 +4,23 @@ module Trek
       extend ActiveSupport::Concern
 
       included do
-        validates :password,
-          length: { minimum: 8 },
-          if: -> { new_record? || password_digest_changed? },
-          allow_blank: true
+        # Also applies to lookups (`find_by(email:)`, `authenticate_by`), so signing in and asking
+        # for a password reset work whatever the case typed.
+        normalizes :email, with: ->(email) { email.strip.downcase }
+
         validates :email,
           presence: true,
-          uniqueness: true,
-          format: { with: URI::MailTo::EMAIL_REGEXP }
+          uniqueness: { case_sensitive: false },
+          email: { mode: :strict }
+        # Only when a password was assigned: `password` is nil otherwise.
+        validates :password, length: { minimum: 8 }, allow_nil: true
+        validate :password_not_only_spaces
+      end
+
+      private
+
+      def password_not_only_spaces
+        errors.add(:password, :blank) if password&.strip&.empty?
       end
     end
   end

data/docs/.vitepress/config.mjs

@@ -1,5 +1,9 @@
 import { defineConfig } from 'vitepress'
 import llmstxt from 'vitepress-plugin-llms'
+import { readFileSync } from 'node:fs'
+
+// The released version: `make release` keeps package.json in sync with lib/trek/version.rb.
+const { version } = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8'))
 
 
 // https://vitepress.dev/reference/site-config
@@ -11,6 +15,13 @@ export default defineConfig({
   description: "A modern content management & back-office system for Ruby on Rails",
   lang: 'en-US',
   lastUpdated: true,
+  // The header logo doubles as the favicon (PNG versions for older browsers and iOS home screens,
+  // favicon.ico for clients that only request /favicon.ico).
+  head: [
+    ['link', { rel: 'icon', type: 'image/svg+xml', href: '/logo.svg' }],
+    ['link', { rel: 'icon', type: 'image/png', sizes: '32x32', href: '/favicon.png' }],
+    ['link', { rel: 'apple-touch-icon', href: '/apple-touch-icon.png' }],
+  ],
   themeConfig: {
     logo: { src: '/logo.svg', width: 24, height: 24 },
 
@@ -18,7 +29,15 @@ export default defineConfig({
     nav: [
       { text: 'Home', link: '/' },
       { text: 'Guide', link: '/what-is-trek' },
-      { text: 'Reference', link: '/reference/' }
+      { text: 'Reference', link: '/reference/' },
+      {
+        text: `v${version}`,
+        items: [
+          { text: 'Changelog', link: '/changelog' },
+          { text: 'RubyGems', link: `https://rubygems.org/gems/trek/versions/${version}` },
+          { text: 'npm', link: `https://www.npmjs.com/package/trek/v/${version}` }
+        ]
+      }
     ],
 
     sidebar: {

data/docs/.vitepress/theme/style.css

@@ -75,15 +75,18 @@
  * -------------------------------------------------------------------------- */
 
 :root {
+  /* The violet end of the hero name gradient, a step darker on hover and when pressed */
+  --trek-button-brand: #7a4df0;
+
   --vp-button-brand-border: transparent;
   --vp-button-brand-text: var(--vp-c-white);
-  --vp-button-brand-bg: var(--vp-c-brand-3);
+  --vp-button-brand-bg: var(--trek-button-brand);
   --vp-button-brand-hover-border: transparent;
   --vp-button-brand-hover-text: var(--vp-c-white);
-  --vp-button-brand-hover-bg: var(--vp-c-brand-2);
+  --vp-button-brand-hover-bg: color-mix(in srgb, var(--trek-button-brand) 88%, black);
   --vp-button-brand-active-border: transparent;
   --vp-button-brand-active-text: var(--vp-c-white);
-  --vp-button-brand-active-bg: var(--vp-c-brand-1);
+  --vp-button-brand-active-bg: color-mix(in srgb, var(--trek-button-brand) 76%, black);
 }
 
 /**
@@ -91,19 +94,44 @@
  * -------------------------------------------------------------------------- */
 
 :root {
+  --trek-green: #63e0a6;
+  --trek-purple: #9b7bff;
+
   --vp-home-hero-name-color: transparent;
-  --vp-home-hero-name-background: -webkit-linear-gradient(
+  /* Darker stops on the light background, the brand colors themselves on the dark one */
+  --vp-home-hero-name-background: linear-gradient(
     120deg,
-    #bd34fe 30%,
-    #41d1ff
+    #1fa971 15%,
+    #7a4df0 100%
   );
 
   --vp-home-hero-image-background-image: linear-gradient(
     -45deg,
-    #bd34fe 50%,
-    #47caff 50%
+    var(--trek-purple) 50%,
+    var(--trek-green) 50%
   );
   --vp-home-hero-image-filter: blur(44px);
+
+  /* Feature icons (docs/index.md): the ink follows the text color, light or dark */
+  --trek-icon-ink: currentColor;
+  --trek-icon-accent: var(--trek-green);
+}
+
+/* Text selection in the brand violet rather than the browser's default blue */
+::selection {
+  background-color: color-mix(in srgb, var(--trek-purple) 30%, transparent);
+}
+
+.dark ::selection {
+  background-color: color-mix(in srgb, var(--trek-purple) 45%, transparent);
+}
+
+.dark {
+  --vp-home-hero-name-background: linear-gradient(
+    120deg,
+    var(--trek-green) 15%,
+    var(--trek-purple) 100%
+  );
 }
 
 @media (min-width: 640px) {

data/docs/changelog.md

@@ -0,0 +1,9 @@
+---
+outline: 2
+---
+
+# Changelog
+
+What changed in each release of Trek, newest first, with upgrade notes when an app needs to act. **Unreleased** lists what's merged but not yet published.
+
+<!--@include: ../CHANGELOG.md-->

data/docs/index.md

@@ -7,7 +7,7 @@ hero:
   text: "Take the easy path"
   tagline: "A modern content management & back-office system for Ruby on Rails"
   image:
-    src: /logo.svg
+    src: /trek-mark.webp
     alt: Trek
   actions:
     - theme: brand
@@ -18,22 +18,22 @@ hero:
       link: /getting-started
 
 features:
-  - icon: 🚀
+  - icon: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" width="32" height="32" aria-hidden="true"><path fill-rule="evenodd" fill="var(--trek-icon-ink, currentColor)" d="M16 14A8 8 0 0 1 32 14V38H16ZM21 18A3 3 0 1 0 27 18A3 3 0 1 0 21 18ZM16 26V38H4A12 12 0 0 1 16 26ZM32 26A12 12 0 0 1 44 38H32Z"/><path fill="var(--trek-icon-accent, #63E0A6)" d="M18 40H30A6 6 0 0 1 18 40Z"/></svg>'
     title: Ready out of the box
     details: One installer sets up authentication, authorization, file uploads, emails, i18n and a polished admin UI — with sensible conventions you can override later.
-  - icon: 📝
+  - icon: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" width="32" height="32" aria-hidden="true"><path fill-rule="evenodd" fill="var(--trek-icon-ink, currentColor)" d="M6 6H30V30A12 12 0 0 1 18 42H6ZM12 14H24V18H12ZM12 22H20V26H12Z"/><path fill="var(--trek-icon-accent, #63E0A6)" d="M34 6H42V32A4 4 0 0 1 34 32Z"/></svg>'
     title: Modern content editing
     details: A Tiptap-based rich text editor, hierarchical pages with versioning and SEO-friendly paths, plus reusable content fragments.
-  - icon: 🛠
+  - icon: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" width="32" height="32" aria-hidden="true"><path fill-rule="evenodd" fill="var(--trek-icon-ink, currentColor)" d="M6 18H30V30H42V42H6Z"/><path fill="var(--trek-icon-accent, #63E0A6)" d="M6 18V6A12 12 0 0 1 18 18Z"/></svg>'
     title: Scaffold-driven development
     details: One command generates the model, admin panel, views, policy, routes and locales for any resource — just like Rails scaffolding, but for your back-office.
-  - icon: 🌍
+  - icon: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" width="32" height="32" aria-hidden="true"><path fill-rule="evenodd" fill="var(--trek-icon-ink, currentColor)" d="M22 22H5A17 17 0 0 1 22 5ZM22 26V43A17 17 0 0 1 5 26ZM26 26H43A17 17 0 0 1 26 43Z"/><path fill="var(--trek-icon-accent, #63E0A6)" d="M26 22V5A17 17 0 0 1 43 22Z"/></svg>'
     title: Multilingual by default
     details: Content and admin UI translations powered by Mobility and i18n-tasks, with optional automatic translation via DeepL.
-  - icon: 🔐
+  - icon: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" width="32" height="32" aria-hidden="true"><path fill-rule="evenodd" fill="var(--trek-icon-ink, currentColor)" d="M14 22V16A10 10 0 0 1 34 16V22H28V16A4 4 0 0 0 20 16V22ZM8 22H24V42H16A8 8 0 0 1 8 34Z"/><path fill="var(--trek-icon-accent, #63E0A6)" d="M24 22H40V34A8 8 0 0 1 32 42H24Z"/></svg>'
     title: Roles & policies built in
     details: Authentication on Rails' own has_secure_password and ActionPolicy authorization with admin, editor, user, reader and guest roles, enforced across every panel.
-  - icon: 🧩
+  - icon: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" width="32" height="32" aria-hidden="true"><path fill-rule="evenodd" fill="var(--trek-icon-ink, currentColor)" d="M6 6H22V22H6ZM26 22V6A16 16 0 0 1 42 22ZM6 26H22V42A16 16 0 0 1 6 26Z"/><path fill="var(--trek-icon-accent, #63E0A6)" d="M26 26H42V42H26Z"/></svg>'
     title: Hotwire-native UI
     details: ViewComponents, Stimulus and Turbo under the hood, with light & dark themes, Radix colors and a customizable design system.
 ---

data/docs/reference/controllers.md

@@ -26,9 +26,10 @@ end
 
 ### Filters
 
-`Trek::Filters` lets users narrow an index by attribute values. Call `apply_filters!` in your `index` action — it
-rewrites `@objects` from `params[:filters]`, applying a `where(column => value)` per non-blank filter (a value of
-`"nil"` matches `NULL`):
+`Trek::Filters` lets users narrow an index by attribute values. Declare the columns users may filter on via
+`available_filters`, then call `apply_filters!` in your `index` action — it rewrites `@objects` from
+`params[:filters]`, applying a `where(column => value)` per non-blank filter (a value of `"nil"` matches `NULL`). The filters are read
+through strong params (`filter_params`): any other key, and any value that isn't a single value, is ignored:
 
 ```ruby
 module Admin
@@ -44,6 +45,10 @@ module Admin
 
     private
 
+    def available_filters
+      %i[country_code]
+    end
+
     def countries
       City.distinct.pluck(:country_code).index_with { |code| I18n.t("countries.#{code}") }
     end
@@ -70,7 +75,7 @@ with the chosen filter:
 ### Scopes
 
 `Trek::Scopes` filters by **named model scopes** rather than raw attributes. Declare the allowed scopes via
-`available_scopes`, then call `apply_scopes!` in your `index`. It also exposes `scope_counts` and
+`available_scopes`, then call `apply_scopes!` in your `index`; any other name in `params[:scopes]` is ignored. It also exposes `scope_counts` and
 `unscoped_objects` helpers (the per-scope match counts and the pre-scope collection) for building scope tabs:
 
 ```ruby

data/docs/reference/models/user.md

@@ -52,8 +52,8 @@ User.create(email: "new@example.com", role: :editor, send_invite: true)
 
 `Trek::Users::Validations` enforces:
 
-- `email` — presence, uniqueness, valid format
-- `password` — minimum 8 characters (on creation or password change)
+- `email` — stored stripped and in lower case (lookups too, so sign-in and password resets ignore case), present, unique whatever its case, and well-formed by [`email_validator`](https://github.com/K-and-R/email_validator)'s strict mode (no consecutive or leading/trailing dots, a domain with a TLD)
+- `password` — when one is assigned: at least 8 characters, and not spaces only. A blank password is ignored by `has_secure_password` (the current one is kept); the password reset form refuses it
 
 ## Scopes
 

data/lib/generators/trek/templates/controllers/admin/user_password_resets_controller.rb

@@ -29,6 +29,13 @@ module Admin
     end
 
     def update
+      # has_secure_password ignores a blank password: refuse it, rather than report a change that
+      # didn't happen.
+      if params[:password].blank?
+        @user.errors.add(:password, :blank)
+        return redirect_to edit_admin_user_password_reset_path(@token), alert: @user.errors.full_messages.join(", ")
+      end
+
       @user.update!(params.permit(:password))
       @user.user_sessions.destroy_all
       redirect_to new_admin_user_session_path, notice: t(".success")

data/lib/generators/trek/templates/spec/models/user_spec.rb

@@ -26,6 +26,27 @@ RSpec.describe User do
       expect(user).to be_invalid
     end
 
+    it "requires a unique email whatever its case" do
+      users.create(email: "ada@example.com")
+      user.email = "Ada@Example.com"
+
+      expect(user).to be_invalid
+    end
+
+    %w[ada..lovelace@example.com .ada@example.com ada.@example.com ada@example..com ada@example].each do |email|
+      it "refuses an email mail providers would reject: #{email}" do
+        user.email = email
+
+        expect(user).to be_invalid
+      end
+    end
+
+    it "refuses a password made of spaces only" do
+      user.password = " " * 8
+
+      expect(user).to be_invalid
+    end
+
     it "requires a password of at least 8 characters on creation" do
       user.password = "short"
 
@@ -47,6 +68,18 @@ RSpec.describe User do
     end
   end
 
+  describe "email" do
+    it "is stored in lower case, without surrounding spaces" do
+      expect(users.create(email: " Ada@Example.com ").email).to eq("ada@example.com")
+    end
+
+    it "finds the user whatever its case" do
+      ada = users.create(email: "ada@example.com")
+
+      expect(described_class.find_by(email: "ADA@example.com")).to eq(ada)
+    end
+  end
+
   describe "roles" do
     it "defaults to guest" do
       expect(user.role).to eq("guest")

data/lib/generators/trek/templates/spec/requests/admin/user_password_resets_spec.rb

@@ -9,6 +9,12 @@ RSpec.describe "Admin password resets", type: :request do
     expect(response).to have_http_status(:ok)
   end
 
+  it "keeps the reset request actions in the card, out of the sticky action bar" do
+    get new_admin_user_password_reset_path
+
+    expect(response.body).to include("c-trek--form--actions-aspect-seamless")
+  end
+
   it "emails a reset link to a privileged user" do
     expect { post admin_user_password_resets_path, params: { email: editor.email } }
       .to have_enqueued_mail(Admin::PasswordsMailer, :reset)
@@ -31,6 +37,12 @@ RSpec.describe "Admin password resets", type: :request do
     expect(response).to have_http_status(:ok)
   end
 
+  it "keeps the new password actions in the card, out of the sticky action bar" do
+    get edit_admin_user_password_reset_path(editor.password_reset_token)
+
+    expect(response.body).to include("c-trek--form--actions-aspect-seamless")
+  end
+
   it "renders the new password form from an invitation link" do
     get edit_admin_user_password_reset_path(editor.generate_token_for(:invite))
 
@@ -56,6 +68,13 @@ RSpec.describe "Admin password resets", type: :request do
     expect(editor.user_sessions).to be_empty
   end
 
+  it "sends an empty password back to the form rather than pretending to change it" do
+    token = editor.password_reset_token
+    patch admin_user_password_reset_path(token), params: { password: "" }
+
+    expect(response).to redirect_to(edit_admin_user_password_reset_path(token))
+  end
+
   it "sends a password shorter than 8 characters back to the form" do
     token = editor.password_reset_token
     patch admin_user_password_reset_path(token), params: { password: "short" }

data/lib/generators/trek/templates/spec/requests/admin/user_sessions_spec.rb

@@ -9,6 +9,12 @@ RSpec.describe "Admin sign-in", type: :request do
     expect(response).to have_http_status(:ok)
   end
 
+  it "keeps the sign-in actions in the card, out of the sticky action bar" do
+    get new_admin_user_session_path
+
+    expect(response.body).to include("c-trek--form--actions-aspect-seamless")
+  end
+
   it "signs a privileged user in and opens the dashboard" do
     post admin_user_session_path, params: { email: editor.email, password: users.password }
     follow_redirect!
@@ -16,6 +22,12 @@ RSpec.describe "Admin sign-in", type: :request do
     expect(response).to have_http_status(:ok)
   end
 
+  it "signs in whatever the case of the email" do
+    post admin_user_session_path, params: { email: editor.email.upcase, password: users.password }
+
+    expect(response).to redirect_to(admin_root_url)
+  end
+
   it "refuses a wrong password" do
     post admin_user_session_path, params: { email: editor.email, password: "not the password" }
 

data/lib/generators/trek/templates/views/admin/user_password_resets/edit.html.slim

@@ -7,7 +7,7 @@
           maxlength: 72,
           minlength: 8
 
-    = render Trek::Form::ActionsComponent.new do |c|
+    = render Trek::Form::ActionsComponent.new(aspect: :seamless) do |c|
       ruby:
         c.with_button(
           type: "submit",

data/lib/generators/trek/templates/views/admin/user_password_resets/new.html.slim

@@ -6,7 +6,7 @@
           autofocus: true,
           autocomplete: "username"
 
-    = render Trek::Form::ActionsComponent.new do |c|
+    = render Trek::Form::ActionsComponent.new(aspect: :seamless) do |c|
       ruby:
         c.with_button(
           type: "submit",

data/lib/generators/trek/templates/views/admin/user_sessions/new.html.slim

@@ -15,7 +15,7 @@
           maxlength: 72,
           minlength: 8
 
-    = render Trek::Form::ActionsComponent.new do |c|
+    = render Trek::Form::ActionsComponent.new(aspect: :seamless) do |c|
       ruby:
         c.with_button(
           type: "submit",

data/lib/trek/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Trek
-  VERSION = "2.3.0"
+  VERSION = "2.3.2"
 end

data/lib/trek.rb

@@ -6,6 +6,7 @@ require "blurhash"
 require "closure_tree"
 require "deepl"
 require "dry-initializer"
+require "email_validator"
 require "fastimage"
 require "http_accept_language"
 require "image_processing"

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trek",
-  "version": "2.3.0",
+  "version": "2.3.2",
   "description": "A modern content management & back-office system for Ruby on Rails",
   "homepage": "https://trek.etamin.studio",
   "license": "MIT",

data/trek.gemspec

@@ -35,6 +35,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "closure_tree", "~> 9.0"
   spec.add_dependency "deepl-rb", "~> 3.0"
   spec.add_dependency "dry-initializer", "~> 3.1"
+  spec.add_dependency "email_validator", "~> 2.2"
   spec.add_dependency "fastimage", "~> 2.2"
   spec.add_dependency "http_accept_language", "~> 2.1"
   spec.add_dependency "i18n-tasks", "~> 1.0"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: trek
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.3.2
 platform: ruby
 authors:
 - Mohamed Bengrich
@@ -124,6 +124,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.1'
+- !ruby/object:Gem::Dependency
+  name: email_validator
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: fastimage
   requirement: !ruby/object:Gem::Requirement
@@ -781,11 +795,16 @@ files:
 - docs/.vitepress/config.mjs
 - docs/.vitepress/theme/index.js
 - docs/.vitepress/theme/style.css
+- docs/changelog.md
 - docs/customize.md
 - docs/deploy.md
 - docs/getting-started.md
 - docs/index.md
+- docs/public/apple-touch-icon.png
+- docs/public/favicon.ico
+- docs/public/favicon.png
 - docs/public/logo.svg
+- docs/public/trek-mark.webp
 - docs/reference/components.md
 - docs/reference/concerns/contentable.md
 - docs/reference/concerns/formattable.md