trek 2.5.0 → 2.6.0

data/lib/generators/trek/templates/public_accounts/web/views/password_resets/new.html.slim.tt

@@ -0,0 +1,15 @@
+= render "<%= accounts_path %>/flash"
+
+h1 = t(".title")
+p = t(".intro")
+
+= form_with url: <%= route_prefix %>_password_reset_path do |f|
+  = f.label :email, <%= class_name %>.human_attribute_name(:email)
+  = f.email_field :email,
+      value: @email,
+      required: true,
+      autofocus: true,
+      autocomplete: "username"
+  = f.submit t(".submit")
+
+p = link_to t(".sign_in"), <%= route_prefix %>_sign_in_path

data/lib/generators/trek/templates/public_accounts/web/views/passwords/edit.html.slim.tt

@@ -0,0 +1,25 @@
+= render "<%= accounts_path %>/flash"
+
+h1 = t(".title")
+ruby:
+  rules = {
+    min: @<%= file_name %>.password_min_length,
+    passphrase: @<%= file_name %>.passphrase_length
+  }
+p = t(".intro", **rules)
+
+= form_with model: @<%= file_name %>, url: <%= route_prefix %>_password_path, method: :patch do |f|
+  - if @<%= file_name %>.errors.any?
+    ul(role="alert")
+      - @<%= file_name %>.errors.full_messages.each do |message|
+        li = message
+  = f.label :password
+  = f.password_field :password,
+      required: true,
+      autofocus: true,
+      autocomplete: "new-password",
+      maxlength: 72,
+      minlength: @<%= file_name %>.password_min_length
+  = f.submit t(".submit")
+
+p = link_to t(".back"), <%= route_prefix %>_account_path

data/lib/generators/trek/templates/public_accounts/web/views/registrations/new.html.slim.tt

@@ -0,0 +1,28 @@
+= render "<%= accounts_path %>/flash"
+
+h1 = t(".title")
+
+= form_with model: @<%= file_name %>, url: <%= route_prefix %>_sign_up_path do |f|
+  - if @<%= file_name %>.errors.any?
+    ul(role="alert")
+      - @<%= file_name %>.errors.full_messages.each do |message|
+        li = message
+  = f.label :email
+  = f.email_field :email, required: true, autofocus: true, autocomplete: "email"
+  = f.label :name
+  = f.text_field :name, autocomplete: "name"
+  = f.label :password
+  ruby:
+    rules = {
+      min: @<%= file_name %>.password_min_length,
+      passphrase: @<%= file_name %>.passphrase_length
+    }
+  p = t(".rules", **rules)
+  = f.password_field :password,
+      required: true,
+      autocomplete: "new-password",
+      maxlength: 72,
+      minlength: @<%= file_name %>.password_min_length
+  = f.submit t(".submit")
+
+p = link_to t(".sign_in"), <%= route_prefix %>_sign_in_path

data/lib/generators/trek/templates/public_accounts/web/views/sessions/new.html.slim.tt

@@ -0,0 +1,38 @@
+= render "<%= accounts_path %>/flash"
+
+h1 = t(".title")
+<% if code? -%>
+- validity = distance_of_time_in_words(0, <%= class_name %>::SignInCode.validity)
+p = t(".intro", email: @email, validity:)
+
+= form_with url: <%= route_prefix %>_sign_in_code_path do |f|
+  = f.label :otp, t(".code")
+  = f.text_field :otp,
+      required: true,
+      autofocus: true,
+      autocomplete: "one-time-code",
+      inputmode: "numeric",
+      pattern: "[0-9 ]*",
+      maxlength: 7
+  = f.submit t(".submit")
+
+p = link_to t(".other_email"), <%= route_prefix %>_sign_in_path
+<% else -%>
+
+= form_with url: <%= route_prefix %>_sign_in_path do |f|
+  = f.label :email, <%= class_name %>.human_attribute_name(:email)
+  = f.email_field :email,
+      value: @email,
+      required: true,
+      autofocus: true,
+      autocomplete: "username"
+  = f.label :password, <%= class_name %>.human_attribute_name(:password)
+  = f.password_field :password,
+      required: true,
+      autocomplete: "current-password",
+      maxlength: 72
+  = f.submit t(".submit")
+
+p = link_to t(".forgot_password"), new_<%= route_prefix %>_password_reset_path
+p = link_to t(".sign_up"), <%= route_prefix %>_sign_up_path
+<% end -%>

data/lib/generators/trek/templates/public_accounts/web/views/sign_in_codes/new.html.slim.tt

@@ -0,0 +1,17 @@
+= render "<%= accounts_path %>/flash"
+
+h1 = t(".title")
+p = t(".intro")
+
+= form_with url: <%= route_prefix %>_sign_in_path do |f|
+  = f.label :email, <%= class_name %>.human_attribute_name(:email)
+  = f.email_field :email,
+      value: @email,
+      required: true,
+      autofocus: true,
+      autocomplete: "email"
+  = f.submit t(".submit")
+<% if password? -%>
+
+p = link_to t(".password"), <%= route_prefix %>_password_sign_in_path
+<% end -%>

data/lib/generators/trek/templates/spec/jobs/mail_delivery_job_spec.rb

@@ -0,0 +1,11 @@
+require "rails_helper"
+
+RSpec.describe MailDeliveryJob, type: :job do
+  it "delivers the mail enqueued by deliver_later" do
+    expect(ActionMailer::Base.delivery_job).to eq(described_class)
+  end
+
+  it "retries a failed delivery instead of discarding it" do
+    expect(described_class.rescue_handlers.map(&:first)).to include("StandardError")
+  end
+end

data/lib/generators/trek/templates/spec/mailers/admin_mailer_spec.rb

@@ -15,6 +15,9 @@ RSpec.describe AdminMailer do
   end
 
   describe "the new sign-in email" do
+    # No DNS lookup in specs: an address without a host name, unless an example gives one
+    before { allow(Trek::ReverseDns).to receive(:hostname).and_return(nil) }
+
     # In English whatever the app's default locale: the examples read English words
     let(:user) { users.create(role: :editor, locale: "en") }
     let(:mail) do
@@ -30,6 +33,13 @@ RSpec.describe AdminMailer do
       expect(mail.text_part.body.to_s).to include("Firefox on Windows").and include("203.0.113.7")
     end
 
+    it "names the address's host, as the active sessions do", :aggregate_failures do
+      allow(Trek::ReverseDns).to receive(:hostname).with("203.0.113.7").and_return("host.example.net")
+
+      expect(mail.text_part.body.to_s).to include("203.0.113.7 (host.example.net)")
+      expect(mail.html_part.body.to_s).to include("203.0.113.7 (host.example.net)")
+    end
+
     it "links to the active sessions and to a password reset" do
       expect(mail.html_part.body.to_s).to include("#sessions").and include("user_password_resets/new")
     end

data/lib/generators/trek/templates/spec/requests/admin/fragments_spec.rb

@@ -53,7 +53,7 @@ RSpec.describe "Admin fragments", type: :request do
   it "refuses a key already used in the namespace" do
     post admin_fragments_path, params: { fragment: { key: "footer", namespace: "layout", title: "Another footer" } }
 
-    expect(response).to have_http_status(:unprocessable_entity)
+    expect(response).to have_http_status(:unprocessable_content)
   end
 
   it "renders the edit form" do

data/lib/generators/trek/templates/spec/requests/admin/good_job_spec.rb

@@ -0,0 +1,34 @@
+require "rails_helper"
+
+# The GoodJob dashboard is mounted outside the admin controllers (config/routes.rb), so the guard
+# lives in config/initializers/good_job.rb. Anyone but an administrator must get a 404.
+RSpec.describe "GoodJob dashboard", type: :request do
+  let(:password) { "secret-password-123" }
+
+  def sign_in(user)
+    post admin_user_session_path, params: { email: user.email, password: }
+  end
+
+  it "lets an administrator in" do
+    sign_in User.create!(email: "admin@example.com", password:, role: "admin")
+
+    get "/admin/good_job"
+    follow_redirect!
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "hides the dashboard from a privileged user who is not an administrator" do
+    sign_in User.create!(email: "editor@example.com", password:, role: "editor")
+
+    get "/admin/good_job"
+
+    expect(response).to have_http_status(:not_found)
+  end
+
+  it "hides the dashboard from a visitor" do
+    get "/admin/good_job"
+
+    expect(response).to have_http_status(:not_found)
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/pages_spec.rb

@@ -34,7 +34,7 @@ RSpec.describe "Admin pages", type: :request do
   it "refuses a page without a title" do
     post admin_pages_path, params: { page: { title: "" } }
 
-    expect(response).to have_http_status(:unprocessable_entity)
+    expect(response).to have_http_status(:unprocessable_content)
   end
 
   it "renders the edit form" do

data/lib/generators/trek/templates/spec/requests/admin/panels_spec.rb

@@ -51,4 +51,20 @@ RSpec.describe "Admin content editor panels", type: :request do
 
     expect(response).to have_http_status(:ok)
   end
+
+  it "asks for a link's title, and gives it to the editor", :aggregate_failures do
+    get new_admin_panels_link_path(link: { turbo_frame_id: "page_1_content" })
+    expect(stacked_panel.at_css("input[name='link[title]']")).to be_present
+
+    post admin_panels_links_path(format: :turbo_stream),
+      params: { link: { turbo_frame_id: "page_1_content", href: "https://example.com/", title: "An example" } }
+    expect(response.body).to include(""title":"An example"")
+  end
+
+  it "inserts a call to action into the editor" do
+    post admin_panels_prompts_path(format: :turbo_stream),
+      params: { prompt: { turbo_frame_id: "page_1_content", href: "https://example.com/", text: "Sign up" } }
+
+    expect(response.body).to include("<prompts-block", "Sign up")
+  end
 end

data/lib/generators/trek/templates/spec/requests/admin/password_renewal_spec.rb

@@ -12,7 +12,7 @@ RSpec.describe "Admin password renewal", type: :request do
     editor
     sign_in(admin)
 
-    post require_password_renewal_admin_users_path
+    post admin_password_renewal_path
 
     expect(editor.reload.password_renewal_required).to be(true)
   end
@@ -21,7 +21,7 @@ RSpec.describe "Admin password renewal", type: :request do
     admin
     sign_in(editor)
 
-    post require_password_renewal_admin_users_path
+    post admin_password_renewal_path
 
     expect(admin.reload.password_renewal_required).to be(false)
   end

data/lib/generators/trek/templates/spec/requests/admin/sign_in_lockout_spec.rb

@@ -24,7 +24,7 @@ RSpec.describe "Admin sign-in lockout", type: :request do
 
       sign_in
 
-      expect(response).to have_http_status(:unprocessable_entity)
+      expect(response).to have_http_status(:unprocessable_content)
     end
 
     it "answers a locked account as a wrong password, so it can't be told apart" do

data/lib/generators/trek/templates/spec/requests/admin/user_sessions_spec.rb

@@ -31,7 +31,7 @@ RSpec.describe "Admin sign-in", type: :request do
   it "refuses a wrong password" do
     post admin_user_session_path, params: { email: editor.email, password: "not the password" }
 
-    expect(response).to have_http_status(:unprocessable_entity)
+    expect(response).to have_http_status(:unprocessable_content)
   end
 
   it "keeps the email typed after a wrong password" do
@@ -44,7 +44,7 @@ RSpec.describe "Admin sign-in", type: :request do
     reader = users.create(role: :reader)
     post admin_user_session_path, params: { email: reader.email, password: users.password }
 
-    expect(response).to have_http_status(:unprocessable_entity)
+    expect(response).to have_http_status(:unprocessable_content)
   end
 
   it "answers an unknown email as a wrong password, so it can't be used to find accounts" do

data/lib/generators/trek/templates/views/admin/users/index.html.slim

@@ -14,7 +14,7 @@
 
     if allowed_to?(:require_password_renewal?, model)
       c.with_button(
-        href: [:require_password_renewal, :admin, :users],
+        href: [:admin, :password_renewal],
         text: t(".require_password_renewal"),
         data: {
           turbo_method: :post,

data/lib/generators/trek/templates/views/admin_mailer/new_sign_in.en.html.slim

@@ -5,7 +5,7 @@ p
 ul
   li = l(@at, format: :long)
   li = user_agent_summary(@user_agent)
-  li = @ip
+  li = @address
 p If it was you, there's nothing to do.
 p
   | If it wasn't, change your password right away,

data/lib/generators/trek/templates/views/admin_mailer/new_sign_in.en.text.erb

@@ -4,7 +4,7 @@ Your <%%= t("application_name") %> account was just signed in to from a browser
 
 - <%%= l(@at, format: :long) %>
 - <%%= user_agent_summary(@user_agent) %>
-- <%%= @ip %>
+- <%%= @address %>
 
 If it was you, there's nothing to do.
 

data/lib/generators/trek/templates/views/admin_mailer/new_sign_in.fr.html.slim

@@ -5,7 +5,7 @@ p
 ul
   li = l(@at, format: :long)
   li = user_agent_summary(@user_agent)
-  li = @ip
+  li = @address
 p Si c'était vous, il n'y a rien à faire.
 p
   | Sinon, changez votre mot de passe tout de suite,

data/lib/generators/trek/templates/views/admin_mailer/new_sign_in.fr.text.erb

@@ -4,7 +4,7 @@ Votre compte <%%= t("application_name") %> vient d'être connecté depuis un nav
 
 - <%%= l(@at, format: :long) %>
 - <%%= user_agent_summary(@user_agent) %>
-- <%%= @ip %>
+- <%%= @address %>
 
 Si c'était vous, il n'y a rien à faire.
 

data/lib/trek/csp_reports.rb

@@ -16,7 +16,9 @@ module Trek
   # report, it must be plausible too: a known directive, and a keyword or a host name blocked.
   #
   # A violation keeps the page's path, without its query, which may carry a token, and the blocked
-  # resource's origin.
+  # resource's origin. To tell what was blocked, it also keeps where (the source file's URL, without
+  # its query, and the line), and the sample: the start of the inline script or style, which browsers
+  # only send under `'report-sample'`.
   module CspReports
     EXTENSION_SCHEMES = %w[chrome-extension moz-extension safari-extension safari-web-extension ms-browser-extension].freeze
 
@@ -32,9 +34,13 @@ module Trek
     SCHEMES = %w[http https ws wss].freeze
     HOST_NAME = /\A(?=.{1,253}\z)[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*\z/i
 
-    Violation = Struct.new(:directive, :blocked, :page, :disposition, keyword_init: true) do
+    # Browsers send 40 characters at most; a forged report could send any number
+    SAMPLE_LENGTH = 40
+
+    Violation = Struct.new(:directive, :blocked, :page, :disposition, :source, :sample, keyword_init: true) do
       def to_s
-        "#{directive} blocked #{blocked} on #{page} (#{disposition})"
+        # The sample inspected, as it may hold a line break
+        "#{directive} blocked #{blocked} on #{page} (#{disposition})#{" at #{source}" if source}#{": #{sample.inspect}" if sample}"
       end
     end
 
@@ -68,11 +74,23 @@ module Trek
         directive:,
         blocked:,
         page: page.path.presence || "/",
-        disposition: fields["disposition"] || "enforce"
+        disposition: fields["disposition"] || "enforce",
+        source: location(source, fields["line-number"] || fields["lineNumber"]),
+        sample: (fields["script-sample"] || fields["sample"]).to_s.first(SAMPLE_LENGTH).presence
       )
     end
     private_class_method :violation
 
+    # Where the violation happened: the source file's origin and path, and the line
+    def self.location(source, line)
+      uri = parse_uri(source)
+      return unless uri&.host && (base = origin(source))
+
+      line = Integer(line, exception: false)
+      "#{base}#{uri.path}#{":#{line}" if line}"
+    end
+    private_class_method :location
+
     # A URL's origin, or the keyword a browser reports instead ("inline", "eval", "data"…); nil when
     # it's neither
     def self.origin(value)

data/lib/trek/typography_formatter.rb

@@ -1,20 +1,33 @@
+require "json"
+
 module Trek
   # `TypographyFormatter` formats strings to enforce French typography rules.
   #
   # Supports both plain strings and ProseMirror JSONB hashes. When given
   # a Hash, it walks the node tree and formats only `text` node values
-  # in place, leaving the structure intact.
+  # in place, leaving the structure intact. A ProseMirror document given
+  # as a JSON string, as the content editor submits it, is parsed first,
+  # and returned as a Hash.
   class TypographyFormatter
     NBSP = [160].pack("U*").freeze
     NNBSP = [8239].pack("U*").freeze # U+202F narrow no-break space
+    # Signs preceded by a non-breaking space, whether one was typed or not
     SPACE_BEFORE_CHARS = [
-      [NBSP, %w[: % € \$ » – —]],
+      [NBSP, %w[» – —]]
+    ].freeze
+    # Signs preceded by a non-breaking space when one was typed, or when they end a word: followed by a
+    # space, punctuation or the end of the text. Inside a word, as in a time (10:30), a URL
+    # (https://example.com/?a=50%25) or a ratio (3:1), they aren't punctuation, and are left alone.
+    SPACE_BEFORE_WORD_ENDING_CHARS = [
+      [NBSP, %w[: % € \$]],
       [NNBSP, %w[; ! \?]]
     ].freeze
+    WORD_ENDING_SIGNS = %w[: ; ! \?].freeze
     NBSP_AFTER_CHARS = %w[« – —].freeze
     NBSP_BEFORE_UNITS = %w[°C °F g h ha kg km Ko ko kW L l m min ml Mo mo s].freeze
 
     def initialize(input)
+      input = JSON.parse(input) if prosemirror_json?(input)
       @source = input
       @prosemirror = input.is_a?(Hash)
       @output = @prosemirror ? deep_dup_hash(input) : input.dup
@@ -34,6 +47,11 @@ module Trek
 
     private
 
+    # Formatted as plain text, the JSON would get non-breaking spaces before its colons, and no longer parse
+    def prosemirror_json?(input)
+      input.is_a?(String) && input.start_with?('{"type":"doc"')
+    end
+
     def format_string!
       remove_double_spaces
       add_nbsp
@@ -79,6 +97,18 @@ module Trek
         regexp = /(?<=\S)(\p{Zs}?(#{chars.join("|")}))/
         @output.gsub!(regexp, "#{space}\\2")
       end
+
+      word_end = "\\p{Zs}|\\z|[#{WORD_ENDING_SIGNS.join}.,…»”)\\]]"
+      # Not after another sign: "Quoi?!" gets one space, before the group
+      not_after_sign = "(?<![\\p{Zs}\\s#{WORD_ENDING_SIGNS.join}])"
+
+      SPACE_BEFORE_WORD_ENDING_CHARS.each do |space, chars|
+        signs = chars.join("|")
+        # Repairs what earlier versions spaced inside a word: "10 :30", "https ://"
+        @output.gsub!(/[#{NBSP}#{NNBSP}](#{signs})(?!#{word_end})/, "\\1")
+        @output.gsub!(/(?<=\S)\p{Zs}+(#{signs})(?=#{word_end})/, "#{space}\\1")
+        @output.gsub!(/#{not_after_sign}(#{signs})(?=#{word_end})/, "#{space}\\1")
+      end
     end
 
     def add_nbsp_before_units
@@ -87,7 +117,7 @@ module Trek
     end
 
     def add_nbsp_after_chars
-      regexp = /((#{NBSP_AFTER_CHARS.join("|")})\p{Zs}?)(?=\w)/
+      regexp = /((#{NBSP_AFTER_CHARS.join("|")})\p{Zs}?)(?=[\p{L}\p{N}])/
       @output.gsub!(regexp, "\\2#{NBSP}")
     end
 
@@ -109,7 +139,8 @@ module Trek
     end
 
     def replace_apostrophes
-      @output.gsub!(/(?<=\w)'(?=\w)/, "\u2019")
+      # Letters with accents too (l'\u00e9t\u00e9), which `\w` doesn't match
+      @output.gsub!(/(?<=[\p{L}\p{N}])'(?=[\p{L}\p{N}])/, "\u2019")
     end
 
     def remove_spaces_before_attached_punctuation

data/lib/trek/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Trek
-  VERSION = "2.5.0"
+  VERSION = "2.6.0"
 end

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trek",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "A modern content management & back-office system for Ruby on Rails",
   "homepage": "https://trek.etamin.studio",
   "license": "MIT",
@@ -20,16 +20,15 @@
   },
   "author": "Etamin Studio",
   "dependencies": {
+    "@floating-ui/dom": "^1.8.0",
     "@fontsource/inter": "^5.3.0",
     "@hotwired/stimulus": "^3.2.2",
     "@hotwired/turbo-rails": "^8.0.20",
     "@radix-ui/colors": "^3.0.0",
-    "@tiptap/core": "^2.1.11",
-    "@tiptap/extension-floating-menu": "^2.1.11",
-    "@tiptap/extension-link": "^2.1.11",
-    "@tiptap/extension-placeholder": "^2.1.11",
-    "@tiptap/pm": "^2.1.11",
-    "@tiptap/starter-kit": "^2.1.11",
+    "@tiptap/core": "^3.32.0",
+    "@tiptap/extension-floating-menu": "^3.32.0",
+    "@tiptap/pm": "^3.32.0",
+    "@tiptap/starter-kit": "^3.32.0",
     "@uppy/core": "^3.0.4",
     "@uppy/locales": "^3.0.1",
     "@uppy/thumbnail-generator": "^3.0.2",
@@ -42,11 +41,13 @@
     "tom-select": "^2.2.2"
   },
   "devDependencies": {
+    "@vitest/browser-playwright": "^5.0.5",
     "esbuild": "^0.28.0",
     "esbuild-rails": "^1.0.7",
     "esbuild-style-plugin": "^1.6.3",
     "eslint": "^8.49.0",
     "eslint-config-prettier": "^8.10.2",
+    "playwright": "^1.64.1",
     "postcss": "^8.4.30",
     "postcss-flexbugs-fixes": "^5.0.2",
     "postcss-import": "^15.1.0",
@@ -57,11 +58,14 @@
     "stylelint": "^15.11.0",
     "stylelint-config-standard": "^31.0.0",
     "stylelint-order": "^6.0.4",
+    "vite": "^8.3.5",
     "vitepress": "^1.6.4",
-    "vitepress-plugin-llms": "^1.13.1"
+    "vitepress-plugin-llms": "^1.13.1",
+    "vitest": "^5.0.5"
   },
   "packageManager": "yarn@4.18.1",
   "scripts": {
+    "test": "vitest run",
     "docs:dev": "vitepress dev docs",
     "docs:build": "vitepress build docs",
     "docs:preview": "vitepress preview docs"

data/trek.gemspec

@@ -50,7 +50,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "mobility", "~> 1.3.2"
   spec.add_dependency "phonelib", "~> 0.8"
   spec.add_dependency "postmark-rails"
-  spec.add_dependency "prosemirror", ">= 0.7.1", "< 2"
+  spec.add_dependency "prosemirror", ">= 1.0", "< 2"
   spec.add_dependency "rails", [">= 8.0", "< 8.2"]
   spec.add_dependency "rails-healthcheck"
   spec.add_dependency "rails-i18n", ">= 6.0"

data/vitest.config.mjs

@@ -0,0 +1,24 @@
+import { defineConfig } from "vitest/config";
+import { playwright } from "@vitest/browser-playwright";
+
+// JavaScript tests (yarn test): the admin's Stimulus controllers, with their libraries, in a headless Chrome.
+export default defineConfig({
+  test: {
+    include: ["spec/javascript/**/*.test.js"],
+    browser: {
+      enabled: true,
+      headless: true,
+      // The Chrome installed on the machine, as the system specs use: Playwright downloads none. CI's image
+      // has Debian's Chromium instead, at CHROME_PATH.
+      provider: playwright({
+        launchOptions: process.env.CHROME_PATH
+          ? { executablePath: process.env.CHROME_PATH }
+          : { channel: "chrome" },
+      }),
+      instances: [{ browser: "chromium" }],
+    },
+  },
+  // The components import their CSS, which the tests don't need: without this, Vite would load
+  // postcss.config.js, written for the esbuild build.
+  css: { postcss: {} },
+});