trek 2.3.1 → 2.4.0

data/.yarnrc.yml

@@ -1,7 +1,5 @@
-nodeLinker: node-modules
+enableGlobalCache: false
 
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"
+nodeLinker: node-modules
 
-yarnPath: .yarn/releases/yarn-3.8.0.cjs
+yarnPath: .yarn/releases/yarn-4.18.1.cjs

data/AGENTS.md

@@ -9,7 +9,7 @@ Trek is a customizable CMS for Ruby on Rails, shipped as a **Ruby gem** (`trek`)
 ## Tech stack
 
 - **Ruby** `>= 3.1` (RuboCop targets 3.4) · **Rails** `>= 6.0, < 8.2` (lockfile 8.1.3; host apps need 7.0+)
-- **Node** 22.21.1 (`.node-version`) · **Yarn** 3.8.0 (berry) · **PostgreSQL** 12+ · **libvips** for images
+- **Node** 24.22.0 (`.node-version`) · **Yarn** 4.18.1 with its defaults: no install scripts, no package published less than a day ago · **PostgreSQL** 12+ · **libvips** for images
 - Backend: `action_policy`, `closure_tree`, `acts_as_list`, `mobility` + `i18n-tasks`, `shrine` (+ blurhash/image_processing/aws-sdk-s3), `view_component` + `slim-rails` + `lookbook`, `kaminari`, `deepl-rb`
 - Frontend: **esbuild** (`esbuild.config.js`) + **PostCSS** (`postcss.config.js`); Stimulus/Turbo, TipTap, Uppy, Tom Select, SortableJS
 - Tests: **RSpec** (`rspec-rails`, capybara, simplecov) · Docs: **VitePress** (`docs/`)
@@ -23,7 +23,8 @@ rake                      # default: spec + rubocop
 rake spec                 # run tests (or: bundle exec rspec)
 COVERAGE=1 bundle exec rspec  # tests + SimpleCov report in coverage/ (fails under the minimum set in spec/spec_helper.rb)
 make lint                 # all linters below
-make fix                  # rubocop/eslint/stylelint/prettier autocorrect
+make fix                  # rubocop/eslint/stylelint/prettier autocorrect, then make i18n-normalize
+make i18n-normalize       # sort the locale keys (i18n-tasks normalize), then Prettier them; CI checks it
 make release              # bump version (version.rb + package.json), stamp CHANGELOG, tag, push gem + npm
 yarn docs:dev             # VitePress docs locally
 ```
@@ -42,14 +43,14 @@ Security: `bundle exec brakeman` · `bundle exec bundle-audit check --update`
 
 ## Structure
 
-- `app/` — engine code, namespaced under `trek/`: `components/` (ViewComponents), `controllers/`, `forms/`, `models/`, `policies/` (ActionPolicy), `uploaders/` (Shrine), `views/`, `javascript/` (Stimulus)
+- `app/` — engine code, namespaced under `trek/`: `components/` (ViewComponents), `controllers/`, `forms/`, `models/`, `policies/` (ActionPolicy), `uploaders/` (Shrine), `validators/` (top-level, e.g. `NotDisposableValidator`), `views/`, `javascript/` (Stimulus)
 - `lib/generators/trek/` — the heart of the gem: `install/` (~30 generators), `scaffold_generator.rb`, `admin/`, `templates/`
 - `lib/trek/` — `engine.rb`, `version.rb`, `i18n_keys_resolver.rb`, `typography_formatter.rb`
 - `config/locales/` — `trek.en.yml`, `trek.fr.yml`
 - `spec/` — RSpec suite, two kinds of spec:
   - **isolated** (`require_relative` the file under test, stub its host): concerns, helpers, simple components
   - **Rails** (`require "rails_helper"`): boots `spec/dummy`, a minimal host app on PostgreSQL (`trek_test`, or `DATABASE_URL`). Its models, migrations, Shrine initializer and the whole admin (controllers, views, routes, policies, mailers) are not committed: `spec/dummy/lib/generated_files.rb` runs Trek's own generator steps into `tmp/dummy` on every boot, and the database is rebuilt from them. A new model or migration template must be added to its `STEPS`, or `spec/dummy/generated_files_spec.rb` fails.
-  - **Host-app specs**: model and admin request specs and their [Oaken](https://github.com/kaspth/oaken) seeds are templates (`lib/generators/trek/templates/{spec/models,spec/requests,db/seeds}/`), installed in host apps by `trek:install:model_specs` and run by Trek's suite from `tmp/dummy` (`spec/dummy/generated_specs_spec.rb`); test data comes from `users.create`, `pages.create` and `seed "cases/…"`, not factories. Write specs for Trek's models there, in host-app style (no `frozen_string_literal`, Ruby 3.1-compatible — no bare `it` block parameter), so host apps get them too.
+  - **Host-app specs**: model, admin request, policy and mailer specs and their [Oaken](https://github.com/kaspth/oaken) seeds are templates (`lib/generators/trek/templates/{spec/models,spec/requests,spec/policies,spec/mailers,db/seeds}/`), installed in host apps by `trek:install:model_specs` and run by Trek's suite from `tmp/dummy` (`spec/dummy/generated_specs_spec.rb`); test data comes from `users.create`, `pages.create` and `seed "cases/…"`, not factories. Write specs for Trek's models there, in host-app style (no `frozen_string_literal`, Ruby 3.1-compatible — no bare `it` block parameter), so host apps get them too.
   - **Generators** (`spec/trek/generators_spec.rb`): every generator runs on a copy of a real `rails new` app (`spec/support/generators.rb`, built once per run into `tmp/generator_skeleton`), then again to check it changes nothing. Shell-outs are recorded in `shell_commands`, not run. A new generator is picked up automatically; if it needs arguments, an earlier Trek step or a starting file, add it to the spec's `arguments`, `prerequisites` or `setups`.
   - Both kinds run in one process, so an isolated spec must restore any global it changes (`I18n`, `Shrine` storages…). `spec_helper` loads Rails and Action View before Trek, as a host app does: several dependencies (ActionPolicy, Slim, ViewComponent) configure themselves from what is already loaded.
 - `docs/` — VitePress site
@@ -61,5 +62,7 @@ Security: `bundle exec brakeman` · `bundle exec bundle-audit check --update`
 - **i18n**: keep English + French locales in sync (`config/locales/trek.*.yml`); DeepL auto-translation via `DEEPL_AUTH_KEY`
 - **Versioning**: version lives in both `lib/trek/version.rb` and `package.json` — keep in sync via `make release`
 - **CHANGELOG.md**: Keep-a-Changelog format. **Every MR must add an `[Unreleased]` entry.** Keep entries short: one or two sentences on what changed for host apps, not how it was found or fixed — the MR description holds the details. When the change requires action in the host app on upgrade, end the entry with a bold `**Upgrade note:**` label followed by what to do. Use the same label when the change lets host apps remove or simplify existing patches or custom implementations (e.g. "**Upgrade note:** you can now drop your custom …") — never as an unlabelled trailing sentence.
+- **Generated model names**: a new model template belonging to another model is nested under it, in `models/<owner>/` (`User::Session`, `User::PreviousPassword`), not prefixed (`UserSession`). Nested in an Active Record model, it keeps the prefixed table name (`user_sessions`) and its owner's `has_many` finds it without `class_name:`. The older `PagePath`, `PageVersion` and `TagCategory` move in Trek 3 (#248).
+- **Generators' npm packages**: the install generators' `NPM_DEPENDENCIES` (`lib/generators/trek/install/*_generator.rb`) add to host apps the packages needed by the config files they copy from Trek's root (`esbuild.config.js`, `postcss.config.js`, `.eslintrc.json`, `.stylelintrc.json`, `lefthook.yml`). When a package is bumped in Trek's `package.json` — by hand or by Renovate, which doesn't touch the generators — bump its range in the generator in the same MR, or new apps get a version the copied config may not work with (as esbuild 0.15 did). List only packages those configs or the generated scripts use.
 - **Public code**: Trek ships publicly (gem, npm, docs), so nothing committed may mention a client or project name, nor a client's domain models or business logic — not in code, comments, specs, templates, docs, CHANGELOG or commit messages. Use neutral examples (`Page`, `Shop::Product`, an engine's `Blog::Post`). Client context belongs in GitLab issues and MR descriptions only.
 - **CI**: GitLab CI (`.gitlab-ci.yml`), stages build → lint → security → test → deploy; docs deploy to Netlify; deps via Renovate

data/CHANGELOG.md

@@ -1,5 +1,60 @@
 ## [Unreleased]
 
+## [2.4.0] - 2026-10-16
+
+### Added
+
+- `Trek::Form::ImageFieldComponent` (`f.image_field`) shows a « See original » button opening the uploaded image in a new tab.
+- An audit log: `rails g trek:install:audit_log` installs an `AuditLog` model recording each mutation in the admin (author, request, target record, status), sign-ins included, and an admin list for the `admin` role; `Trek::AuditLog::PurgeJob` deletes rows past 6 months. See [Audit log](https://trek.etamin.studio/reference/generators/audit-log). **Upgrade note:** an app with its own audit log can drop its copy for Trek's, keeping its `audit_logs` table (see the docs' migration steps).
+- `Trek::Filters` exposes `filter_params` to views, as `Trek::Scopes` does `scope_params`.
+- Users can't reuse one of their last 5 passwords (`Trek::Users::PasswordHistory`, configurable with `password_history_size`). **Upgrade note:** copy `app/models/user/previous_password.rb` (`User::PreviousPassword`) and the `user_previous_passwords` migration from Trek's templates (`lib/generators/trek/templates/{models,migrations}`), run it, add `include Trek::Users::PasswordHistory` after `has_secure_password` in `app/models/user.rb`, and re-run `rails g trek:install:model_specs` for the new specs.
+- Password expiry and renewal (`Trek::Users::PasswordRenewal`): an admin can ask every user for a new password after a suspected compromise, and `password_expires_after` (none by default) makes passwords expire. A user concerned is signed out and sent to the new password form, which states the rules and rates the password as it is typed (`Trek::Form::PasswordStrengthComponent`). **Upgrade note:** copy the `user_password_renewal` migration from Trek's templates (`lib/generators/trek/templates/migrations`) and run it, add `include Trek::Users::PasswordRenewal` after `has_secure_password` in `app/models/user.rb`, and take the changes to `require_authentication` in `app/controllers/concerns/trek/authentication.rb`, the `require_password_renewal` action of `Admin::UsersController`, its route (`post :require_password_renewal, on: :collection` in `resources :users`), and the `admin/users/index` and `admin/user_password_resets/edit` views from Trek's templates.
+- Sessions expire after 48 hours without a request and 30 days after signing in (`Trek::Users::SessionLifetime`, configurable on `User::Session`), and users see their active sessions in a tab of their profile, to sign out any other or all of them; an IP address shows its host name on hover. Session activity is written at most every 5 minutes instead of on every request. **Upgrade note:** copy the `user_session_tracking` migration from Trek's templates (`lib/generators/trek/templates/migrations`) and run it; add `include Trek::Users::SessionLifetime` to `app/models/user/session.rb` (or `app/models/user_session.rb`); take Trek's changes to `app/controllers/concerns/trek/authentication.rb` (`find_session_by_cookie`, `start_new_session_for`, `track_last_activity`), to `Admin::UsersController#show` and to `app/views/admin/users/show.html.slim` (with its new `_properties` and `_sessions` partials); copy `app/controllers/admin/active_sessions_controller.rb` from Trek's templates and add its route (`resources :active_sessions, only: :destroy do delete :others, action: :destroy_others, on: :collection end` in the admin namespace); schedule `Trek::PurgeExpiredSessionsJob` daily.
+- Users see their previous sign-in (date, browser, IP address) on their profile's Active sessions tab, and a sign-in from a browser that never signed in as them emails them (`Trek::Users::SignIns`, `new_sign_in_email`). **Upgrade note:** copy the `user_sign_ins` migration and the `admin_mailer/new_sign_in` views from Trek's templates and run the migration; add `include Trek::Users::SignIns` to `app/models/user.rb`; take Trek's changes to `app/controllers/concerns/trek/authentication.rb` (`record_sign_in_of` and the methods after it), `app/controllers/admin/user_sessions_controller.rb` (`create`, `sign_in_notice`), `app/mailers/admin_mailer.rb` (`new_sign_in`) and `app/views/admin/users/_sessions.html.slim`.
+- `Trek::SectionComponent`: a titled section of a page (an `h2` labelling it), with an optional hint under the heading.
+- `NotDisposableValidator` refuses email addresses from disposable providers, on any model: `validates :email, not_disposable: true`. The domains come from the `valid_email2` gem, which keeps them up to date. See [Validators](https://trek.etamin.studio/reference/validators).
+- Failed sign-ins are throttled per account and per IP address over a longer window: after 5 failures in a row, an account's sign-in locks for 1 minute, doubled on each further failure up to 1 hour, and its user is emailed (`Trek::Users::SignInLockout`); an IP address gets 20 failures an hour, whatever the account. A locked account gets the same answer as a wrong password, and a failed or throttled sign-in now renders the form (422, 429) instead of redirecting, so the audit log counts it as a failure, on the account tried. See [Failed sign-ins](https://trek.etamin.studio/reference/models/user#failed-sign-ins), including why `Rails.cache` must be shared between servers. **Upgrade note:** copy the `user_sign_in_lockout` migration and the `admin_mailer/sign_in_locked` views from Trek's templates and run the migration; add `include Trek::Users::SignInLockout` to `app/models/user.rb`; take Trek's `app/controllers/admin/user_sessions_controller.rb` and the `sign_in_locked` method of `app/mailers/admin_mailer.rb`.
+- Passkeys: users add and delete passkeys on a new tab of their profile, which names each after its password manager, and sign in with one instead of their password, from a button on the sign-in form or the email field's autofill (`Trek::Users::Passkeys`, `User::Passkey`, through the `webauthn` gem). The password keeps working. See [Passkeys](https://trek.etamin.studio/reference/models/user#passkeys). **Upgrade note:** copy `app/models/user/passkey.rb` and the `user_passkeys` migration from Trek's templates and run it; add `include Trek::Users::Passkeys` to `app/models/user.rb`; copy `app/controllers/admin/passkeys_controller.rb` and `app/controllers/admin/passkey_sessions_controller.rb`, and add their routes in the admin namespace (`resources :passkeys, only: %i[create destroy] do get :options, on: :collection end` and `resource :passkey_session, only: :create do get :options end`); take Trek's changes to `app/views/admin/user_sessions/new.html.slim`, `app/views/admin/users/show.html.slim` (with the new `_passkeys` partial) and `Admin::UsersController#show`; with the audit log, add `Admin::PasskeySessionsController` to `config/initializers/audit_log.rb`.
+- A [Security and compliance](https://trek.etamin.studio/security) docs page maps Trek's security measures to ISO 27001's controls and NIS2's measures, and lists what stays with the app, its hosting and the organization.
+- The [Security and compliance](https://trek.etamin.studio/security#cryptography) page lists the cryptography a generated app uses, and how each algorithm stands against a quantum computer.
+- The generated GitLab CI has an `sbom` job, commented out, making a Software Bill of Materials (CycloneDX, with cdxgen) of the app's gems and npm packages, for a client who asks for one. See [Software Bill of Materials](https://trek.etamin.studio/reference/generators/install#software-bill-of-materials). **Upgrade note:** when a client asks for an SBOM, copy the `sbom` job from Trek's `lib/generators/trek/templates/.gitlab-ci.yml` into the app's `.gitlab-ci.yml`, uncommented.
+- `ADMIN_ALLOWED_IPS` restricts the admin to IP addresses and ranges (e.g. `203.0.113.0/24, 2001:db8::/32`): from anywhere else, `/admin` and everything below it answer like an unknown URL, a 404. Off when unset. Behind a CDN, list its ranges in `trusted_proxies` first. See [Restricting the admin to IP addresses](https://trek.etamin.studio/proxies#restricting-the-admin-to-ip-addresses).
+- Security headers: `rails g trek:install:security_headers`, which `trek:install` runs, sets up a Content Security Policy, report-only at first, allowing no inline script, and a `Permissions-Policy` header turning off the browser features the app doesn't use (camera, microphone, geolocation…). Violations are reported to `/csp-reports` (`Trek::CspReportsController`), which sends them to AppSignal, one incident per directive and blocked origin, and to the log, throttled against floods. It replaces Rails' commented-out example, but leaves an app's own policy. HSTS, from `force_ssl`, already covers subdomains; its `preload` option is documented. See [Security headers](https://trek.etamin.studio/reference/generators/security-headers). **Upgrade note:** run `rails g trek:install:security_headers`, browse the app with the console open and watch AppSignal's `csp` namespace, add the front office's third-party hosts, then set `content_security_policy_report_only` to `false`.
+
+### Changed
+
+- Trek pins **Node 24.22.0** (was 24.18.0) in `.node-version`. **Upgrade note:** existing apps can set `24.22.0` in their `.node-version`.
+- `trek:install:yarn` installs **Yarn 4.18.1** (was 4.18.0), and Trek's own development moves to it from Yarn 3, with its defaults: no install scripts, and no package published less than a day ago. **Upgrade note:** existing apps can upgrade with `yarn set version 4.18.1` followed by `yarn install`.
+- Passwords follow the ANSSI's recommendations for a privileged access (`Trek::Users::PasswordPolicy`, included by `Trek::Users::Validations`): at least 12 characters, with a digit and a symbol below 20, and neither a common password, a keyboard or number sequence, nor the user's name or email; a Have I Been Pwned check is opt-in. Existing passwords keep working: the rules apply when one is set. **Upgrade note:** the rules are configurable in `app/models/user.rb` (`password_min_length`, `passphrase_length`, `password_check_pwned`); update seeds and specs whose passwords no longer pass.
+- The generated signed-in browser model is `User::Session` (`user.sessions`), in the same `user_sessions` table. Apps generated before keep working with `UserSession`. **Upgrade note:** to follow, move `app/models/user_session.rb` to `app/models/user/session.rb` as `class User::Session`, replace `has_many :user_sessions` with `has_many :sessions` in `app/models/user.rb`, and update `UserSession.find_by` and `user.user_sessions` in `app/controllers/concerns/trek/authentication.rb` and `app/controllers/admin/user_password_resets_controller.rb`; no migration is needed.
+- The admin's Inter font comes with Trek's npm package ([`@fontsource/inter`](https://fontsource.org/fonts/inter)), bundled into `admin.css`, instead of Google Fonts: visitors' browsers no longer contact Google, and the Content Security Policy needs no Google host. **Upgrade note:** remove `admin_webfonts_link_tag` from `app/helpers/application_helper.rb` and `app/views/layouts/admin.html.slim`, and the Google Fonts `link` tags from both admin layouts (`admin.html.slim`, `admin/auth.html.slim`); `esbuild.config.js` must have the `.woff` and `.woff2` file loaders, as Trek's has.
+
+### Deprecated
+
+- `Trek::UserSession`, the sign-in form object Trek 2 no longer uses, warns and will be removed in Trek 3. **Upgrade note:** in a sign-in controller still building one, pass the params to `User.authenticate_by(email:, password:)` instead, as Trek's generated `Admin::UserSessionsController` does.
+
+### Changed
+
+- The install generators no longer add `esbuild-plugin-import-glob`, `postcss-cli`, `postcss-nesting` and `postcss-url`, which no generated config uses. **Upgrade note:** you can drop them from the app's `package.json` (`yarn remove …`), except those its own `postcss.config.js`, `esbuild.config.js` or `package.json` scripts still use (e.g. `postcss-url` to rebase the URLs of `@import`-ed CSS).
+- `rails g trek:install` runs Trek's own generators in its process instead of starting `rails generate` for each, which saves about two minutes.
+
+### Fixed
+
+- The generated `.gitlab-ci.yml`'s commented-out deploy jobs point at `example.com` instead of a real site.
+- A tag's key is unique within its category, as `Tag` validates it and the docs said: the generated `tags` migration's unique index on `key` alone refused the same key in two categories with `ActiveRecord::RecordNotUnique`. A tag category with tags can no longer be deleted, which left them without a category, and the admin now says why a deletion is refused instead of reporting it done. **Upgrade note:** in `app/models/tag_category.rb`, replace `dependent: :nullify` with `dependent: :restrict_with_error`. Check that no category has two tags with the same key, nor two tags without a category, then generate a migration (`bin/rails g migration TagKeyUniquePerCategory`) with `remove_index :tags, name: "index_tags_on_key", if_exists: true` (apps generated with Trek 0.1.9 or later have it), `add_index :tags, %i[category_id key], unique: true` and `add_index :tags, :key, unique: true, where: "category_id IS NULL", name: "index_tags_on_key_without_category"`. Copy `spec/models/tag_spec.rb` from Trek's templates for the specs.
+- The notice after signing in is in the user's language, rather than the app's default one.
+- The password reset request no longer reveals whether an email has an account: it answers every email the same way, and queues `Admin::PasswordResetJob` for each, which emails privileged users only, so the response takes as long either way. **Upgrade note:** copy `app/jobs/admin/password_reset_job.rb` from Trek's templates (`lib/generators/trek/templates/jobs/admin`), and in `Admin::UserPasswordResetsController#create`, replace the user lookup and `deliver_later` with `Admin::PasswordResetJob.perform_later(params[:email].to_s)`.
+- Icons drawn in black (`stroke="#000000"`, such as the content editor's toolbar icons) stayed black in the dark theme, and in any colored context: since the sprite was sanitized in two passes, black was turned into `currentColor` before the icon's paths were inserted, so it never reached them. The substitution now runs once the paths are in.
+- `trek:install:esbuild` installed esbuild 0.15, too old for the `esbuild.config.js` it copies: `yarn build --watch` (and `bin/dev`) crashed with `esbuild.context is not a function`. It now installs esbuild 0.28, as Trek does. **Upgrade note:** in an app generated by an earlier Trek 2, run `yarn add --dev esbuild@^0.28.0`.
+- The generated invitation and password reset emails formatted the link's expiry (« 7 days ») in the app's default locale instead of the recipient's. `rails g trek:install:model_specs` now also installs mailer specs covering it. **Upgrade note:** in `app/mailers/admin_mailer.rb` and `app/mailers/admin/passwords_mailer.rb`, move the `@expiration_delay = …` line inside the `I18n.with_locale` block, before `mail`; re-run `rails g trek:install:model_specs` for the new specs.
+
+## [2.3.2] - 2026-10-02
+
+### Fixed
+
+- **Security:** `Trek::Scopes#apply_scopes` called any name found in `params[:scopes]` that the relation answered to, not only the controller's `available_scopes`, which let a request run unintended methods on the listed records. Only the names in `available_scopes` are applied now; others are ignored. **Upgrade note:** update Trek as soon as possible. A controller passing `apply_scopes` a scope name it does not list in `available_scopes` must add it there.
+- The generated admin sign-in, password reset request and new password pages rendered their actions with the default aspect of `Trek::Form::ActionsComponent`, whose sticky action bar (top margin, padding, background) is meant for edit forms: inside those small cards, the button and the « forgotten password » link sat in a padded bar. They now use the `seamless` aspect. **Upgrade note:** in apps generated before this version, pass `aspect: :seamless` to `Trek::Form::ActionsComponent.new` in `app/views/admin/user_sessions/new.html.slim` and `app/views/admin/user_password_resets/{new,edit}.html.slim`.
+
 ## [2.3.1] - 2026-10-02
 
 ### Changed

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    trek (2.3.1)
+    trek (2.4.0)
       action_policy (~> 0.6)
       actioncable
       acts_as_list (~> 1.1)
@@ -30,9 +30,12 @@ PATH
       shrine-blurhash (~> 0.2)
       slim-rails (~> 4.0)
       strip_attributes (~> 2.0)
+      time_for_a_boolean (~> 0.3)
       turbo-rails (>= 1.0)
+      valid_email2 (~> 7.1)
       view_component (< 5.0)
       view_component-form (~> 0.3)
+      webauthn (~> 3.4)
       zeitwerk (~> 2.6)
 
 GEM
@@ -119,6 +122,7 @@ GEM
       activesupport (>= 6.1)
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
+    android_key_attestation (0.3.0)
     ast (2.4.3)
     aws-eventstream (1.4.0)
     aws-partitions (1.1200.0)
@@ -142,6 +146,7 @@ GEM
     base64 (0.3.0)
     bcrypt (3.1.22)
     bigdecimal (4.1.2)
+    bindata (2.5.1)
     blurhash (0.1.8)
     brakeman (7.1.2)
       racc
@@ -158,6 +163,7 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    cbor (0.5.10.3)
     closure_tree (9.3.0)
       activerecord (>= 7.2.0)
       with_advisory_lock (>= 7.0.0)
@@ -165,6 +171,9 @@ GEM
     concurrent-ruby (1.3.8)
     connection_pool (3.0.2)
     content_disposition (1.0.0)
+    cose (1.3.1)
+      cbor (~> 0.5.9)
+      openssl-signature_algorithm (~> 1.0)
     crass (1.0.7)
     css_parser (3.0.0)
       addressable
@@ -245,6 +254,8 @@ GEM
       reline (>= 0.4.2)
     jmespath (1.6.2)
     json (2.21.2)
+    jwt (3.3.0)
+      base64
     kaminari (1.2.2)
       activesupport (>= 4.1.0)
       kaminari-actionview (= 1.2.2)
@@ -310,6 +321,9 @@ GEM
     nokogiri (1.19.4-x86_64-darwin)
       racc (~> 1.4)
     oaken (1.0.0)
+    openssl (4.0.2)
+    openssl-signature_algorithm (1.3.0)
+      openssl (> 2.0)
     parallel (1.27.0)
     parser (3.3.10.0)
       ast (~> 2.4.1)
@@ -466,6 +480,8 @@ GEM
     ruby-vips (2.3.0)
       ffi (~> 1.12)
       logger
+    safety_net_attestation (0.5.0)
+      jwt (>= 2.0, < 4.0)
     securerandom (0.4.1)
     shrine (3.10.0)
       content_disposition (~> 1.0)
@@ -502,7 +518,14 @@ GEM
       unicode-display_width (>= 1.1.1, < 4)
     thor (1.5.0)
     tilt (2.6.1)
+    time_for_a_boolean (0.3.0)
+      activerecord
+      railties
     timeout (0.6.1)
+    tpm-key_attestation (0.14.2)
+      bindata (~> 2.4)
+      openssl (> 2.0)
+      openssl-signature_algorithm (~> 1.0)
     tsort (0.2.0)
     turbo-rails (2.0.23)
       actionpack (>= 7.1.0)
@@ -514,6 +537,9 @@ GEM
     unicode-emoji (4.2.0)
     uri (1.1.1)
     useragent (0.16.11)
+    valid_email2 (7.1.0)
+      activemodel (>= 6.0)
+      mail (~> 2.5)
     view_component (4.12.0)
       actionview (>= 7.1.0)
       activesupport (>= 7.1.0)
@@ -523,6 +549,14 @@ GEM
       activesupport (>= 7.2.0, < 8.2)
       view_component (>= 2.34.0, < 5.0)
       zeitwerk (~> 2.5)
+    webauthn (3.4.3)
+      android_key_attestation (~> 0.3.0)
+      bindata (~> 2.4)
+      cbor (~> 0.5.9)
+      cose (~> 1.1)
+      openssl (>= 2.2)
+      safety_net_attestation (~> 0.5.0)
+      tpm-key_attestation (~> 0.14.0)
     websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)

data/Makefile

@@ -6,12 +6,24 @@ lint:
 	yarn eslint "app/**/*.js"
 	yarn stylelint "app/**/*.css"
 	yarn prettier --check "{app,config,lib,spec}/**/*.{css,js,json,md,yml}"
+	bundle exec i18n-tasks missing -t diff
 
 fix:
 	bundle exec rubocop --autocorrect
 	yarn eslint "app/**/*.js" --fix
 	yarn stylelint "app/**/*.css" --fix
 	yarn prettier --write "{app,config,lib,spec}/**/*.{css,js,json,md,yml}"
+	$(MAKE) i18n-normalize
+
+# Sort the locale keys (i18n-tasks), then format the files as the rest of the repo (Prettier): each
+# tool alone undoes the other's style, so they always run together.
+i18n-normalize:
+	bundle exec i18n-tasks normalize
+	yarn prettier --write "config/locales/*.yml"
+
+# Fails when the locale files aren't normalized (see i18n-normalize)
+i18n-check: i18n-normalize
+	git diff --exit-code config/locales
 
 release:
 	@read -p "New version (current: $$(sed -n 's/.*VERSION = "\(.*\)"/\1/p' lib/trek/version.rb)): " version; \

data/app/assets/icons/trek/passkey.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">
+  <path fill-rule="evenodd" d="M4.8,4A4,4,0,1,1,.8,8,4,4,0,0,1,4.8,4Zm0,2.4A1.6,1.6,0,1,0,6.4,8,1.6,1.6,0,0,0,4.8,6.4Z"/>
+  <path d="M15.2,8.8H8.4V7.2h6.8a.8.8,0,0,1,0,1.6Z"/>
+  <path d="M12.8,11.2a.8.8,0,0,1-.8-.8V8h1.6v2.4A.8.8,0,0,1,12.8,11.2Z"/>
+</svg>

data/app/assets/stylesheets/trek/base.css

@@ -41,6 +41,12 @@ body {
   transition: background-color 0.2s ease-in-out, color 0.2s ease-in-out;
 }
 
+/* A term with more to say on hover, e.g. an IP address and its host name */
+abbr[title] {
+  cursor: help;
+  text-decoration: underline dotted;
+}
+
 a {
   color: var(--accent-9);
   transition: color 0.2s ease;

data/app/components/trek/entries/item_component/item_component.css

@@ -119,3 +119,9 @@ table .root {
   content: "•";
   margin: 0 1rem;
 }
+
+/* A status or a button: it keeps its width, and the content wraps instead. */
+.status {
+  flex-shrink: 0;
+  white-space: nowrap;
+}

data/app/components/trek/form/image_field_component/image_field_component.html.slim

@@ -31,3 +31,12 @@
               size: :narrow,
               data: remove_button_data_attributes,
             )
+          / The uploaded file itself, the preview being a thumbnail
+          = render Trek::ButtonComponent.new( \
+              text: t("admin.actions.see_original"),
+              size: :narrow,
+              href: image.url,
+              target: "_blank",
+              rel: "noopener",
+            ) do |button|
+            - button.with_icon("trek/external")

data/app/components/trek/form/password_strength_component/password_strength_component.css

@@ -0,0 +1,56 @@
+/* Use component-local class names and add them to HTML via #class_for(name) helper */
+
+/* The controller sets data-level, from 0 (too short) to 3 (strong), once a password is typed. */
+
+.strength {
+  align-items: center;
+  display: flex;
+  gap: 1.2rem;
+  margin-top: 0.8rem;
+}
+
+.bar {
+  display: flex;
+  flex: 1;
+  gap: 0.4rem;
+}
+
+.segment {
+  background-color: var(--slate-5);
+  border-radius: 0.2rem;
+  flex: 1;
+  height: 0.4rem;
+  transition: background-color 0.15s ease-out;
+}
+
+.label {
+  color: var(--slate-11);
+  font-size: 0.8em;
+  min-width: 8ch;
+  text-align: right;
+}
+
+.root[data-level="0"] .label,
+.root[data-level="1"] .label {
+  color: var(--tomato-11);
+}
+
+.root[data-level="1"] .segment:nth-child(-n + 1) {
+  background-color: var(--tomato-9);
+}
+
+.root[data-level="2"] .label {
+  color: var(--amber-11);
+}
+
+.root[data-level="2"] .segment:nth-child(-n + 2) {
+  background-color: var(--amber-9);
+}
+
+.root[data-level="3"] .label {
+  color: var(--grass-11);
+}
+
+.root[data-level="3"] .segment {
+  background-color: var(--grass-9);
+}

data/app/components/trek/form/password_strength_component/password_strength_component.html.slim

@@ -0,0 +1,8 @@
+div(class=root_class data=data_attributes)
+  = content
+  div class=class_for("strength")
+    div class=class_for("bar") aria-hidden="true"
+      - (LEVELS.size - 1).times do
+        span class=class_for("segment")
+    span(class=class_for("label") aria-live="polite"
+      data=stimulus_target_hash(:label))

data/app/components/trek/form/password_strength_component/password_strength_component.js

@@ -0,0 +1,74 @@
+import "./password_strength_component.css";
+
+import { Controller as BaseController } from "@hotwired/stimulus";
+
+// Keyboard rows (AZERTY and QWERTY), the alphabet and the digits, as Trek::Users::PasswordPolicy
+const SEQUENCES = [
+  "azertyuiop",
+  "qsdfghjklm",
+  "wxcvbn",
+  "qwertyuiop",
+  "asdfghjkl",
+  "zxcvbnm",
+  "abcdefghijklmnopqrstuvwxyz",
+  "01234567890",
+];
+const SEQUENCE_LENGTH = 5;
+
+// Rates the password typed from 0 (too short) to 3 (strong). Only a guide: the server checks the
+// common passwords and the user's name and email too.
+export class Controller extends BaseController {
+  static targets = ["label"];
+  static values = {
+    minLength: Number,
+    passphraseLength: Number,
+    labels: Array,
+  };
+
+  connect() {
+    this.input = this.element.querySelector("input");
+    this.update = this.update.bind(this);
+    this.input.addEventListener("input", this.update);
+    this.update();
+  }
+
+  disconnect() {
+    this.input.removeEventListener("input", this.update);
+  }
+
+  update() {
+    const password = this.input.value;
+    const level = password ? this.level(password) : 0;
+
+    // Read by the CSS, which colors the bar and the label
+    if (password) this.element.dataset.level = level;
+    else delete this.element.dataset.level;
+    this.labelTarget.textContent = password ? this.labelsValue[level] : "";
+  }
+
+  level(password) {
+    if (password.length < this.minLengthValue) return 0;
+    if (this.sequence(password)) return 1;
+    if (password.length >= this.passphraseLengthValue) return 3;
+
+    const complex = /\d/.test(password) && /[^\p{L}\p{N}\s]/u.test(password);
+    if (!complex) return 1;
+
+    return password.length >= this.minLengthValue + 4 ? 3 : 2;
+  }
+
+  sequence(password) {
+    const normalized = password.toLowerCase().replace(/[^a-z0-9]/g, "");
+    if (new RegExp(`(.)\\1{${SEQUENCE_LENGTH - 1}}`).test(normalized))
+      return true;
+
+    return SEQUENCES.some((row) => {
+      const reversed = [...row].reverse().join("");
+      for (let i = 0; i + SEQUENCE_LENGTH <= normalized.length; i++) {
+        const chunk = normalized.slice(i, i + SEQUENCE_LENGTH);
+        if (row.includes(chunk) || reversed.includes(chunk)) return true;
+      }
+      return false;
+    });
+  }
+}

data/app/components/trek/form/password_strength_component.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Trek
+  module Form
+    # Wraps a new password field with a bar rating the password as it is typed, against the rules
+    # of Trek::Users::PasswordPolicy. Only a guide: the model has the last word.
+    #
+    #   = render Trek::Form::PasswordStrengthComponent.new(min_length: User.password_min_length,
+    #       passphrase_length: User.passphrase_length) do
+    #     = f.password_field :password, autocomplete: "new-password"
+    class PasswordStrengthComponent < Trek::Component
+      LEVELS = %i[too_short weak fair strong].freeze
+
+      option :min_length
+      option :passphrase_length
+
+      private
+
+      def data_attributes
+        {
+          controller: identifier,
+          "#{identifier}-min-length-value": min_length,
+          "#{identifier}-passphrase-length-value": passphrase_length,
+          "#{identifier}-labels-value": LEVELS.map { |level| t("trek.password_strength.#{level}") }.to_json
+        }
+      end
+    end
+  end
+end

data/app/components/trek/gate_component/gate_component.css

@@ -21,3 +21,10 @@
   margin-bottom: 3.2rem;
   padding-bottom: 2.4rem;
 }
+
+/* Another way in below the first form, e.g. signing in with a passkey */
+.wrapper > form + form {
+  border-top: 1px solid var(--slate-6);
+  margin-top: 3.2rem;
+  padding-top: 3.2rem;
+}

data/app/components/trek/icon/sprite_component.rb

@@ -67,11 +67,12 @@ module Trek
         # Extract inner content (children) from the second pass
         inner_content = children_sanitized.sub(/<svg[^>]*>/, "").sub("</svg>", "")
 
-        # Combine: symbol element from first pass + children from second pass
+        # Combine: symbol element from first pass + children from second pass. Black becomes
+        # currentColor once the children are in: they carry the strokes and fills.
         svg_sanitized
           .sub("<svg", "<symbol id=\"c-icon-#{key}\"")
-          .gsub(/#0{3,6}/, "currentColor")
           .sub(">", ">#{inner_content}")
+          .gsub(/#0{3,6}/, "currentColor")
           .sub("</svg>", "</symbol>")
           .gsub(/[\r\n]+/, "")
           .strip

data/app/components/trek/section_component/section_component.css

@@ -0,0 +1,22 @@
+/* Use component-local class names and add them to HTML via #class_for(name) helper */
+
+.root {
+  line-height: 1.25;
+  margin-bottom: 3.2rem;
+  max-width: 64rem;
+}
+
+/* As a property's title */
+.title {
+  color: var(--slate-12);
+  font-size: inherit;
+  font-weight: var(--semibold);
+  margin: 0 0 1.2rem;
+}
+
+/* As a form field's hint */
+.hint {
+  color: var(--slate-11);
+  font-size: 0.8em;
+  margin: -0.6rem 0 1.2rem;
+}

data/app/components/trek/section_component/section_component.html.slim

@@ -0,0 +1,5 @@
+section(class=root_class aria-labelledby=heading_id)
+  h2(id=heading_id class=class_for("title")) = title
+  - if hint
+    p(class=class_for("hint")) = hint
+  = content

data/app/components/trek/section_component/section_component.js

@@ -0,0 +1 @@
+import "./section_component.css";

data/app/components/trek/section_component.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Trek
+  # A titled section of a page (whose own title is the h1), e.g. a list under its heading, with an
+  # optional hint between them
+  class SectionComponent < Trek::Component
+    option :title
+    option :hint, optional: true
+
+    def heading_id
+      @heading_id ||= "section-#{SecureRandom.hex(4)}"
+    end
+  end
+end