trek 2.3.1 → 2.4.0

data/lib/generators/trek/templates/initializers/content_security_policy.rb

@@ -0,0 +1,49 @@
+# The Content Security Policy: what pages may load and run, so a script injected into a page (an XSS)
+# can't run, nor send data elsewhere. See
+# https://guides.rubyonrails.org/security.html#content-security-policy-header
+#
+# It only reports violations for now (`content_security_policy_report_only`): check the browser's
+# console, and the violations reported to AppSignal (the "csp" namespace) or the log, on every page,
+# then set it to false to enforce it.
+#
+# Add the hosts the front office uses, e.g. for analytics `policy.script_src :self, "https://plausible.io"`
+# and `policy.connect_src :self, "https://plausible.io"`, or for videos `policy.frame_src "https://www.youtube-nocookie.com"`.
+Rails.application.configure do
+  # Where uploaded files are served from: the store's public URL, and the bucket's endpoint for files
+  # just uploaded (config/initializers/shrine.rb). Origins only, as CSP sources.
+  upload_hosts = ENV.values_at("S3_BASE_URL", "S3_ENDPOINT").compact_blank.map do |url|
+    URI(url).tap { |uri| uri.path = "" }.to_s
+  end
+
+  config.content_security_policy do |policy|
+    policy.default_src :self
+    policy.base_uri :self
+    policy.form_action :self
+    # Framed by its own pages only (Lookbook's previews), against clickjacking
+    policy.frame_ancestors :self
+    policy.object_src :none
+    # No inline script: the app's own files, and the scripts given the request's nonce
+    policy.script_src :self
+    # Inline `style` attributes stay allowed: Trek's components and Backpack's set some (colors,
+    # custom properties)
+    policy.style_src :self, :unsafe_inline
+    policy.font_src :self, :data
+    # For fonts from Google Fonts (the admin's Inter is served by the app):
+    # policy.style_src :self, :unsafe_inline, "https://fonts.googleapis.com"
+    # policy.font_src :self, :data, "https://fonts.gstatic.com"
+    policy.img_src :self, :data, :blob, *upload_hosts
+    policy.media_src :self, :blob, *upload_hosts
+    policy.connect_src :self
+    # Trek's endpoint logs the violations, and reports them to AppSignal when the app uses it
+    policy.report_uri ENV.fetch("CSP_REPORT_URI", "/csp-reports")
+  end
+
+  # A nonce for the scripts written in a page (`javascript_tag nonce: true`), per session rather than
+  # per request: Turbo renders the next pages under the first one's policy, but with their nonce. A
+  # visitor without a session yet gets a random one, as an empty nonce is invalid: prefer script files
+  # to inline scripts on pages Turbo visits without a session.
+  config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s.presence || SecureRandom.base64(16) }
+  config.content_security_policy_nonce_directives = %w[script-src]
+
+  config.content_security_policy_report_only = true
+end

data/lib/generators/trek/templates/initializers/permissions_policy.rb

@@ -0,0 +1,19 @@
+# Turns off the browser features the app doesn't use (the Permissions-Policy header), so a script
+# injected into a page can't use them either. Allow one the front office needs, e.g. `geolocation=(self)`
+# for a map.
+#
+# Not Rails' `config.permissions_policy`, which still sends the former Feature-Policy header.
+Rails.application.config.action_dispatch.default_headers["Permissions-Policy"] = %w[
+  accelerometer=()
+  camera=()
+  display-capture=()
+  geolocation=()
+  gyroscope=()
+  hid=()
+  magnetometer=()
+  microphone=()
+  midi=()
+  payment=()
+  serial=()
+  usb=()
+].join(", ")

data/lib/generators/trek/templates/jobs/admin/password_reset_job.rb

@@ -0,0 +1,9 @@
+# Emails a password reset link to a privileged user, and nothing for any other email. The reset
+# request form queues it whatever the email, so the response takes as long whether an account
+# exists or not.
+class Admin::PasswordResetJob < ApplicationJob
+  def perform(email)
+    user = User.privileged.find_by(email:)
+    Admin::PasswordsMailer.reset(user).deliver_now if user
+  end
+end

data/lib/generators/trek/templates/layouts/admin/auth.html.slim

@@ -12,11 +12,6 @@ html(lang=I18n.locale class=class_for_theme)
     link(rel="manifest" href="/site.webmanifest")
     = csrf_meta_tags
     = csp_meta_tag
-    link(rel="preconnect" href="https://fonts.googleapis.com")
-    link(rel="preconnect" href="https://fonts.gstatic.com" crossorigin)
-    / slim-lint:disable LineLength
-    link(href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&display=swap" rel="stylesheet")
-    / slim-lint:enable LineLength
     = stylesheet_link_tag "admin",
                           media: "all",
                           'data-turbo-track': "reload"

data/lib/generators/trek/templates/layouts/admin.html.slim

@@ -12,9 +12,6 @@ html(lang=I18n.locale class=class_for_theme)
     link(rel="manifest" href="/site.webmanifest")
     = csrf_meta_tags
     = csp_meta_tag
-    link(rel="preconnect" href="https://fonts.googleapis.com")
-    link(rel="preconnect" href="https://fonts.gstatic.com" crossorigin)
-    = admin_webfonts_link_tag
     = stylesheet_link_tag "admin",
                           media: "all",
                           "data-turbo-track": "reload"

data/lib/generators/trek/templates/mailers/admin/passwords_mailer.rb

@@ -4,9 +4,9 @@ class Admin::PasswordsMailer < ApplicationMailer
   def reset(user)
     @user = user
     @url = edit_admin_user_password_reset_url(@user.generate_token_for(:password_reset))
-    @expiration_delay = distance_of_time_in_words(0, User.token_definitions[:password_reset].expires_in)
 
     I18n.with_locale(@user.locale || I18n.default_locale) do
+      @expiration_delay = distance_of_time_in_words(0, User.token_definitions[:password_reset].expires_in)
       mail to: @user.email
     end
   end

data/lib/generators/trek/templates/mailers/admin_mailer.rb

@@ -1,10 +1,37 @@
 class AdminMailer < ApplicationMailer
   include ActionView::Helpers::DateHelper
 
+  helper Trek::UserAgentsHelper
+
   def invite(user)
     @user = user
     @url = edit_admin_user_password_reset_url(@user.generate_token_for(:invite))
-    @expiration_delay = distance_of_time_in_words(0, User.token_definitions[:invite].expires_in)
+
+    I18n.with_locale(@user.locale || I18n.default_locale) do
+      @expiration_delay = distance_of_time_in_words(0, User.token_definitions[:invite].expires_in)
+      mail to: @user.email
+    end
+  end
+
+  # A sign-in from a browser that never signed in as the user, so they can react if it wasn't them
+  def new_sign_in(user, at:, ip:, user_agent:)
+    @user = user
+    @at = at
+    @ip = ip
+    @user_agent = user_agent
+    @sessions_url = admin_user_url(user, anchor: "sessions")
+    @reset_url = new_admin_user_password_reset_url
+
+    I18n.with_locale(@user.locale || I18n.default_locale) do
+      mail to: @user.email
+    end
+  end
+
+  # Signing in is locked after failed sign-ins in a row (Trek::Users::SignInLockout): the user waits,
+  # or resets their password if they forgot it, or learns someone is guessing it.
+  def sign_in_locked(user)
+    @user = user
+    @reset_url = new_admin_user_password_reset_url
 
     I18n.with_locale(@user.locale || I18n.default_locale) do
       mail to: @user.email

data/lib/generators/trek/templates/migrations/audit_logs.rb.erb

@@ -0,0 +1,27 @@
+class TrekAuditLogs < <%= migration_class_name %>
+  def change
+    create_table :audit_logs do |t|
+      # Who made the request: nil when nobody is signed in. index: false, see the index below.
+      t.references :actor, polymorphic: true, index: false
+      # The record the request worked on, when there is one.
+      t.references :auditable, polymorphic: true
+
+      t.string :action, null: false
+      t.string :http_method, null: false
+      t.string :path, null: false
+      t.integer :http_status
+      t.jsonb :params, null: false, default: {}
+      t.string :ip_address
+      t.string :user_agent
+      t.string :request_id
+      t.string :error_class
+
+      # Rows are never updated: no updated_at.
+      t.datetime :created_at, null: false
+    end
+
+    add_index :audit_logs, [:actor_type, :actor_id, :created_at]
+    add_index :audit_logs, :created_at
+    add_index :audit_logs, :request_id
+  end
+end

data/lib/generators/trek/templates/migrations/tags.rb.erb

@@ -1,13 +1,18 @@
 class TrekTags < <%= migration_class_name %>
   def change
     create_table :tags do |t|
-      t.string :key, index: { unique: true }
+      t.string :key
       t.string :name
       t.integer :position, null: false
       t.references :category, foreign_key: { to_table: :tag_categories }
       t.integer :taggings_count, null: false, default: 0
 
       t.timestamps
+
+      # A key is unique within its category, as Tag validates it
+      t.index %i[category_id key], unique: true
+      # and among the tags without one, which the index above lets through: NULLs never collide
+      t.index :key, unique: true, where: "category_id IS NULL", name: "index_tags_on_key_without_category"
     end
   end
 end

data/lib/generators/trek/templates/migrations/user_passkeys.rb.erb

@@ -0,0 +1,24 @@
+class TrekUserPasskeys < <%= migration_class_name %>
+  def change
+    # The random id a user's passkeys are created for (Trek::Users::Passkeys), set on the first one
+    add_column :users, :webauthn_id, :string
+    add_index :users, :webauthn_id, unique: true
+
+    create_table :user_passkeys do |t|
+      t.belongs_to :user, null: false, foreign_key: true
+      # The browser it was added from, shown when Trek doesn't know its provider (aaguid)
+      t.string :name, null: false
+      # The credential's id and public key, as the browser sent them
+      t.string :external_id, null: false, index: { unique: true }
+      t.text :public_key, null: false
+      t.bigint :sign_count, null: false, default: 0
+      # How the browser reaches the authenticator ("internal", "hybrid", "usb"…)
+      t.string :transports, array: true, null: false, default: []
+      # The authenticator's model, e.g. a password manager (Trek::PasskeyProviders), when it says
+      t.string :aaguid
+      t.datetime :last_used_at
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/trek/templates/migrations/user_password_renewal.rb.erb

@@ -0,0 +1,8 @@
+class TrekUserPasswordRenewal < <%= migration_class_name %>
+  def change
+    # When the password was last set, for its expiry (Trek::Users::PasswordRenewal)
+    add_column :users, :password_changed_at, :datetime
+    # When an admin asked everyone for a new password, after a suspected compromise
+    add_column :users, :password_renewal_required_at, :datetime
+  end
+end

data/lib/generators/trek/templates/migrations/user_previous_passwords.rb.erb

@@ -0,0 +1,10 @@
+class TrekUserPreviousPasswords < <%= migration_class_name %>
+  def change
+    create_table :user_previous_passwords do |t|
+      t.belongs_to :user, null: false, foreign_key: true
+      t.string :password_digest, null: false
+
+      t.datetime :created_at, null: false
+    end
+  end
+end

data/lib/generators/trek/templates/migrations/user_session_tracking.rb.erb

@@ -0,0 +1,11 @@
+class TrekUserSessionTracking < <%= migration_class_name %>
+  def change
+    # The session's last request, for its idle timeout (Trek::Users::SessionLifetime)
+    add_column :user_sessions, :last_activity_at, :datetime
+    up_only { execute "UPDATE user_sessions SET last_activity_at = updated_at" }
+    change_column_null :user_sessions, :last_activity_at, false
+
+    # The host name of the IP address it signed in from (Trek::ReverseDns)
+    add_column :user_sessions, :ip_hostname, :string
+  end
+end

data/lib/generators/trek/templates/migrations/user_sign_in_lockout.rb.erb

@@ -0,0 +1,7 @@
+class TrekUserSignInLockout < <%= migration_class_name %>
+  def change
+    # Failed sign-ins in a row, and until when they lock signing in (Trek::Users::SignInLockout)
+    add_column :users, :failed_sign_in_count, :integer, default: 0, null: false
+    add_column :users, :sign_in_locked_until, :datetime
+  end
+end

data/lib/generators/trek/templates/migrations/user_sign_ins.rb.erb

@@ -0,0 +1,13 @@
+class TrekUserSignIns < <%= migration_class_name %>
+  def change
+    # The current and the previous sign-ins (Trek::Users::SignIns), kept when their sessions end
+    change_table :users, bulk: true do |t|
+      t.datetime :current_sign_in_at
+      t.string :current_sign_in_ip
+      t.string :current_sign_in_user_agent
+      t.datetime :last_sign_in_at
+      t.string :last_sign_in_ip
+      t.string :last_sign_in_user_agent
+    end
+  end
+end

data/lib/generators/trek/templates/models/audit_log.rb

@@ -0,0 +1,3 @@
+class AuditLog < ApplicationRecord
+  include Trek::AuditLog
+end

data/lib/generators/trek/templates/models/tag_category.rb

@@ -1,7 +1,8 @@
 class TagCategory < ApplicationRecord
+  # Not deleted while it has tags: left without a category, their keys could collide with others'
   has_many :tags,
     -> { ordered },
-    dependent: :nullify,
+    dependent: :restrict_with_error,
     foreign_key: :category_id,
     inverse_of: :category
 

data/lib/generators/trek/templates/models/user/passkey.rb

@@ -0,0 +1,17 @@
+# A passkey the user signs in with instead of their password (Trek::Users::Passkeys): its private
+# key stays on their device or in their password manager, Trek keeps the public one.
+class User::Passkey < ApplicationRecord
+  belongs_to :user
+
+  validates :name, presence: true, length: { maximum: 100 }
+
+  # Its provider, or else the browser it was added from (`name`)
+  def to_s
+    provider || name
+  end
+
+  # The password manager, platform or security key keeping it, when Trek knows it
+  def provider
+    Trek::PasskeyProviders[aaguid]
+  end
+end

data/lib/generators/trek/templates/models/user/previous_password.rb

@@ -0,0 +1,4 @@
+# A user's previous password digest, so Trek::Users::PasswordHistory can refuse a recent password.
+class User::PreviousPassword < ApplicationRecord
+  belongs_to :user
+end

data/lib/generators/trek/templates/models/user/session.rb

@@ -0,0 +1,8 @@
+# A browser signed in as the user, found through a signed session_id cookie.
+class User::Session < ApplicationRecord
+  # Expires after 48 hours without a request, and 30 days after signing in; set idle_timeout and
+  # lifetime to change it.
+  include Trek::Users::SessionLifetime
+
+  belongs_to :user
+end

data/lib/generators/trek/templates/policies/audit_log.rb

@@ -0,0 +1,4 @@
+module Admin
+  class AuditLogPolicy < Trek::AuditLogPolicy
+  end
+end

data/lib/generators/trek/templates/spec/mailers/admin/passwords_mailer_spec.rb

@@ -0,0 +1,16 @@
+require "rails_helper"
+
+RSpec.describe Admin::PasswordsMailer do
+  include ActionView::Helpers::DateHelper
+
+  # Not the app's default locale, so the email can't be right by chance
+  let(:locale) { (I18n.available_locales - [I18n.default_locale]).first }
+
+  it "formats the reset link's expiry in the recipient's locale" do
+    skip "the app has a single locale" unless locale
+    user = users.create(role: :editor, locale: locale)
+    expiry = I18n.with_locale(locale) { distance_of_time_in_words(0, User.token_definitions[:password_reset].expires_in) }
+
+    expect(described_class.reset(user).text_part.body.to_s).to include(expiry)
+  end
+end

data/lib/generators/trek/templates/spec/mailers/admin_mailer_spec.rb

@@ -0,0 +1,50 @@
+require "rails_helper"
+
+RSpec.describe AdminMailer do
+  include ActionView::Helpers::DateHelper
+
+  # Not the app's default locale, so the email can't be right by chance
+  let(:locale) { (I18n.available_locales - [I18n.default_locale]).first }
+
+  it "formats the invite link's expiry in the recipient's locale" do
+    skip "the app has a single locale" unless locale
+    user = users.create(role: :editor, locale: locale)
+    expiry = I18n.with_locale(locale) { distance_of_time_in_words(0, User.token_definitions[:invite].expires_in) }
+
+    expect(described_class.invite(user).text_part.body.to_s).to include(expiry)
+  end
+
+  describe "the new sign-in email" do
+    let(:user) { users.create(role: :editor) }
+    let(:mail) do
+      described_class.new_sign_in(
+        user,
+        at: Time.zone.parse("2026-10-13 08:30"),
+        ip: "203.0.113.7",
+        user_agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0"
+      )
+    end
+
+    it "tells the user which browser and address signed in" do
+      expect(mail.text_part.body.to_s).to include("Firefox on Windows").and include("203.0.113.7")
+    end
+
+    it "links to the active sessions and to a password reset" do
+      expect(mail.html_part.body.to_s).to include("#sessions").and include("user_password_resets/new")
+    end
+  end
+
+  it "tells about a sign-in lock in the recipient's locale" do
+    skip "the app has a single locale" unless locale
+    user = users.create(role: :editor, locale: locale)
+    subject = I18n.with_locale(locale) { I18n.t("admin_mailer.sign_in_locked.subject") }
+
+    expect(described_class.sign_in_locked(user).subject).to eq(subject)
+  end
+
+  it "links a sign-in lock to a password reset" do
+    user = users.create(role: :editor)
+
+    expect(described_class.sign_in_locked(user).text_part.body.to_s).to include("/admin/user_password_resets/new")
+  end
+end

data/lib/generators/trek/templates/spec/models/audit_log_spec.rb

@@ -0,0 +1,43 @@
+require "rails_helper"
+
+RSpec.describe AuditLog, type: :model do
+  it "lists the failures: an error status or a raised error" do
+    server_error = create_log(http_status: 500)
+    raised = create_log(error_class: "ActiveRecord::RecordNotFound")
+    create_log(http_status: 302)
+
+    expect(described_class.failures).to contain_exactly(server_error, raised)
+  end
+
+  it "orders the most recent rows first" do
+    old = create_log(created_at: 2.days.ago)
+    recent = create_log(created_at: 1.day.ago)
+
+    expect(described_class.ordered).to eq([recent, old])
+  end
+
+  it "can't be changed once written" do
+    log = create_log
+
+    expect { log.update!(http_status: 200) }.to raise_error(ActiveRecord::ReadOnlyRecord)
+  end
+
+  it "reads as its date, action and status" do
+    log = create_log(created_at: Time.zone.parse("2026-10-12 10:00"), http_status: 302)
+
+    expect(log.to_s).to eq("#{log.created_at.iso8601} – admin/pages#update – 302")
+  end
+
+  it "purges the rows older than the retention window" do
+    create_log(created_at: (Trek::AuditLog::PurgeJob.retention + 1.day).ago)
+    recent = create_log(created_at: (Trek::AuditLog::PurgeJob.retention - 1.day).ago)
+
+    Trek::AuditLog::PurgeJob.perform_now
+
+    expect(described_class.all).to contain_exactly(recent)
+  end
+
+  def create_log(**attributes)
+    described_class.create!(action: "admin/pages#update", http_method: "PATCH", path: "/admin/pages/1", **attributes)
+  end
+end

data/lib/generators/trek/templates/spec/models/tag_spec.rb

@@ -0,0 +1,52 @@
+require "rails_helper"
+
+RSpec.describe Tag do
+  let(:colors) { TagCategory.create!(name: "Colors", key: "colors") }
+  let(:fruits) { TagCategory.create!(name: "Fruits", key: "fruits") }
+
+  describe "key" do
+    it "may be the same in two categories" do
+      described_class.create!(name: "Orange", key: "orange", category: colors)
+
+      expect(described_class.create(name: "Orange", key: "orange", category: fruits)).to be_persisted
+    end
+
+    it "is unique within a category" do
+      described_class.create!(name: "Orange", key: "orange", category: colors)
+
+      expect(described_class.new(name: "Orange", key: "orange", category: colors).tap(&:validate).errors.details[:key]).to include(error: :taken, value: "orange")
+    end
+
+    it "is unique among the tags without a category" do
+      described_class.create!(name: "Orange", key: "orange")
+
+      expect(described_class.new(name: "Orange", key: "orange").tap(&:validate).errors.details[:key]).to include(error: :taken, value: "orange")
+    end
+
+    # The database holds the rule too, against two saves at once
+    it "is unique within a category in the database" do
+      described_class.create!(name: "Orange", key: "orange", category: colors)
+
+      expect { described_class.new(name: "Orange", key: "orange", category: colors).save!(validate: false) }.to raise_error(ActiveRecord::RecordNotUnique)
+    end
+
+    it "is unique among the tags without a category in the database" do
+      described_class.create!(name: "Orange", key: "orange")
+
+      expect { described_class.new(name: "Orange", key: "orange").save!(validate: false) }.to raise_error(ActiveRecord::RecordNotUnique)
+    end
+  end
+
+  describe "category" do
+    # Its tags would be left without a category, where their keys could collide
+    it "can't be deleted while it has tags" do
+      described_class.create!(name: "Orange", key: "orange", category: colors)
+
+      expect(colors.destroy).to be(false)
+    end
+
+    it "can be deleted once empty" do
+      expect(colors.destroy).to be_destroyed
+    end
+  end
+end

data/lib/generators/trek/templates/spec/models/user/session_spec.rb

@@ -0,0 +1,68 @@
+require "rails_helper"
+
+RSpec.describe User::Session do
+  include ActiveSupport::Testing::TimeHelpers
+
+  let(:user) { users.create }
+  let(:session) { user.sessions.create! }
+
+  def come_back_after(duration)
+    travel duration
+    session.record_activity
+  end
+
+  it "is active right after signing in" do
+    expect(described_class.active).to include(session)
+  end
+
+  it "expires after idle_timeout without a request" do
+    session
+    travel described_class.idle_timeout + 1.minute
+
+    expect(session.reload).to be_expired
+  end
+
+  it "stays active while requests come in, until its lifetime" do
+    session
+    5.times { come_back_after(described_class.idle_timeout - 1.hour) }
+
+    expect(session.reload).not_to be_expired
+  end
+
+  it "expires after its lifetime, even when in use" do
+    session
+    travel_to (described_class.lifetime + 1.day).from_now do
+      session.record_activity
+
+      expect(session).to be_expired
+    end
+  end
+
+  it "records a request without touching updated_at" do
+    session
+    travel 1.hour
+
+    expect { session.record_activity }.not_to(change { session.reload.updated_at })
+  end
+
+  it "records a request at most once every activity_interval" do
+    session
+    travel 1.minute
+
+    expect { session.record_activity }.not_to(change { session.reload.last_activity_at })
+  end
+
+  it "purges the expired sessions" do
+    old = user.sessions.create!(created_at: 1.year.ago, last_activity_at: 1.year.ago)
+
+    Trek::PurgeExpiredSessionsJob.perform_now
+
+    expect(described_class.where(id: [old.id, session.id]).pluck(:id)).to eq([session.id])
+  end
+
+  it "lists the expired sessions, for the purge" do
+    old = user.sessions.create!(created_at: 1.year.ago, last_activity_at: 1.year.ago)
+
+    expect(described_class.expired).to contain_exactly(old)
+  end
+end