trusty-cms 7.1.2 → 7.1.3

data/spec/controllers/admin/snippets_controller_spec.rb

@@ -0,0 +1,95 @@
+require 'spec_helper'
+
+# Exercises the full request cycle through Admin::ResourceController (the base
+# for most admin CRUD): before-action chain, permitted_params, response_for
+# dispatch, and the redirect/re-render paths. High blast radius for a Rails
+# upgrade, so keep this green before and after the bump.
+RSpec.describe Admin::SnippetsController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:user) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(user)
+  end
+
+  describe 'GET #index' do
+    it 'succeeds for an authorized user' do
+      create(:snippet, name: 'listed')
+      get :index
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #new' do
+    it 'succeeds' do
+      get :new
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'POST #create' do
+    it 'creates a snippet and redirects to the index' do
+      expect {
+        post :create, params: { snippet: { name: 'greeting', content: 'Hello' } }
+      }.to change(Snippet, :count).by(1)
+
+      expect(response).to be_redirect
+      expect(Snippet.find_by(name: 'greeting').content).to eq('Hello')
+    end
+
+    it 'records the creating user' do
+      post :create, params: { snippet: { name: 'owned', content: 'x' } }
+      expect(Snippet.find_by(name: 'owned').created_by_id).to eq(user.id)
+    end
+
+    # NOTE: Admin::ResourceController defines #rescue_action, but that is a
+    # Rails 2 hook the framework no longer calls, and it is not re-wired via
+    # rescue_from (only Admin::PagesController does that). So an invalid create
+    # currently raises RecordInvalid unhandled (a 500 in production) instead of
+    # re-rendering the form via `response_for :invalid`. Characterizing the
+    # current behavior; revisit if rescue_action is ever wired up.
+    it 'raises on invalid input and persists nothing (latent bug: rescue_action is dead)' do
+      expect {
+        post :create, params: { snippet: { name: '', content: 'x' } }
+      }.to raise_error(ActiveRecord::RecordInvalid)
+
+      expect(Snippet.where(name: '')).to be_empty
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates the snippet and redirects' do
+      snippet = create(:snippet, name: 'editme', content: 'old')
+
+      put :update, params: { id: snippet.id, snippet: { content: 'new' } }
+
+      expect(response).to be_redirect
+      expect(snippet.reload.content).to eq('new')
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    it 'destroys the snippet and redirects' do
+      snippet = create(:snippet, name: 'goner')
+
+      expect {
+        delete :destroy, params: { id: snippet.id }
+      }.to change(Snippet, :count).by(-1)
+
+      expect(response).to be_redirect
+    end
+  end
+
+  describe 'authorization' do
+    it 'denies a user without editor privileges' do
+      allow(controller).to receive(:current_user).and_return(create(:user, email: 'plain@example.com'))
+
+      get :index
+
+      expect(response).to be_redirect
+      expect(flash[:error]).to be_present
+    end
+  end
+end

data/spec/controllers/site_controller_spec.rb

@@ -0,0 +1,63 @@
+require 'spec_helper'
+
+describe SiteController, type: :request do
+  let!(:home) { FactoryBot.create(:home, title: 'Home') }
+
+  before { home.parts.create(name: 'body', content: 'Welcome <r:title />') }
+
+  describe 'serving pages' do
+    it 'renders the home page at the root path' do
+      get '/'
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('Welcome Home')
+    end
+
+    it 'renders a published child page by its path' do
+      about = FactoryBot.create(:page, title: 'About', slug: 'about', parent: home, status_id: Status[:published].id)
+      about.parts.create(name: 'body', content: 'About <r:title />')
+
+      get '/about'
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('About About')
+    end
+
+    it 'renders a nested published page' do
+      section = FactoryBot.create(:page, title: 'Section', slug: 'section', parent: home, status_id: Status[:published].id)
+      article = FactoryBot.create(:page, title: 'Article', slug: 'article', parent: section, status_id: Status[:published].id)
+      article.parts.create(name: 'body', content: 'Deep content')
+
+      get '/section/article'
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('Deep content')
+    end
+  end
+
+  describe 'unknown paths' do
+    it 'renders the not-found template with a 404 status' do
+      get '/does/not/exist'
+      expect(response).to have_http_status(:not_found)
+      expect(response.body).to include('could not be located')
+    end
+  end
+
+  describe 'content type' do
+    it 'sets the response Content-Type from the page layout' do
+      layout = Layout.create!(name: 'Plain', content: '<r:content />', content_type: 'text/plain')
+      page = FactoryBot.create(:page, title: 'Raw', slug: 'raw', parent: home, status_id: Status[:published].id, layout: layout)
+      page.parts.create(name: 'body', content: 'plain body')
+
+      get '/raw'
+      expect(response.media_type).to eq('text/plain')
+    end
+  end
+
+  describe '.cache_timeout' do
+    it 'round-trips through the response cache director' do
+      original = SiteController.cache_timeout
+      SiteController.cache_timeout = 5.minutes
+      expect(SiteController.cache_timeout).to eq(5.minutes)
+    ensure
+      SiteController.cache_timeout = original
+    end
+  end
+end

data/spec/factories/site.rb

@@ -0,0 +1,8 @@
+FactoryBot.define do
+  factory :site do
+    sequence(:name) { |n| "Site #{n}" }
+    sequence(:base_domain) { |n| "site#{n}.example.com" }
+    # domain is stored as a regexp string and validated for uniqueness.
+    sequence(:domain) { |n| "site#{n}\\.example\\.com" }
+  end
+end

data/spec/helpers/admin/references_helper_spec.rb

@@ -0,0 +1,54 @@
+require 'spec_helper'
+
+describe Admin::ReferencesHelper, type: :helper do
+  describe '#class_of_page' do
+    it 'defaults to Page when no class_name param is present' do
+      allow(helper).to receive(:params).and_return({})
+      expect(helper.class_of_page).to eq(Page)
+    end
+
+    it 'constantizes the class_name param' do
+      allow(helper).to receive(:params).and_return(class_name: 'FileNotFoundPage')
+      expect(helper.class_of_page).to eq(FileNotFoundPage)
+    end
+  end
+
+  describe '#filter' do
+    it 'is nil for an unknown filter name' do
+      allow(helper).to receive(:params).and_return(filter_name: 'No Such Filter')
+      expect(helper.filter).to be_nil
+    end
+
+    it 'finds a text filter by its filter_name' do
+      HamlFilter # ensure the descendant is autoloaded
+      allow(helper).to receive(:params).and_return(filter_name: 'Haml')
+      expect(helper.filter).to eq(HamlFilter)
+    end
+  end
+
+  describe '#filter_reference' do
+    it 'explains when there is no filter on the page part' do
+      allow(helper).to receive(:params).and_return({})
+      expect(helper.filter_reference).to eq('There is no filter on the current page part.')
+    end
+
+    it 'explains when a filter has no documentation' do
+      HamlFilter
+      allow(helper).to receive(:params).and_return(filter_name: 'Haml')
+      expect(helper.filter_reference).to eq('There is no documentation on this filter.')
+    end
+  end
+
+  describe '#_display_name' do
+    it 'returns the page class display name for tags' do
+      allow(helper).to receive(:params).and_return(type: 'tags')
+      expect(helper._display_name).to eq(Page.display_name)
+    end
+
+    it 'returns the filter name for filters' do
+      HamlFilter
+      allow(helper).to receive(:params).and_return(type: 'filters', filter_name: 'Haml')
+      expect(helper._display_name).to eq('Haml')
+    end
+  end
+end

data/spec/helpers/admin/url_helper_spec.rb

@@ -0,0 +1,71 @@
+require 'spec_helper'
+
+describe Admin::UrlHelper, type: :helper do
+  describe '#format_path' do
+    it 'returns an empty string for a root or empty path' do
+      expect(helper.format_path('')).to eq('')
+      expect(helper.format_path('/')).to eq('')
+    end
+
+    it 'returns "Root" for a single segment' do
+      expect(helper.format_path('foo')).to eq('Root')
+    end
+
+    it 'returns "/" for two segments' do
+      expect(helper.format_path('foo/bar')).to eq('/')
+    end
+
+    it 'returns the middle subpath for deeper paths' do
+      expect(helper.format_path('foo/bar/baz')).to eq('/bar')
+      expect(helper.format_path('foo/bar/baz/qux')).to eq('/bar/baz')
+    end
+  end
+
+  describe '#extract_base_url' do
+    it 'keeps the scheme and host for a normal url' do
+      expect(helper.extract_base_url('http://example.com/some/page')).to eq('http://example.com')
+    end
+
+    it 'preserves the port for localhost urls' do
+      expect(helper.extract_base_url('http://localhost:3000/some/page')).to eq('http://localhost:3000')
+    end
+  end
+
+  describe '#default_route?' do
+    it 'is true for a plain Page' do
+      expect(helper.default_route?(Page.new)).to be(true)
+    end
+
+    it 'is false for a page subclass with no configured route' do
+      expect(helper.default_route?(FileNotFoundPage.new)).to be_falsey
+    end
+  end
+
+  describe '#lookup_page_path' do
+    it 'returns nil when no custom routes are configured' do
+      expect(helper.lookup_page_path(FileNotFoundPage.new)).to be_nil
+    end
+  end
+
+  describe '#build_url' do
+    it 'appends the page path for default-route pages' do
+      page = Page.new
+      allow(page).to receive(:path).and_return('/about')
+
+      expect(helper.build_url('http://example.com', page)).to eq('http://example.com/about')
+    end
+
+    it 'returns nil for a non-default page with no configured path' do
+      expect(helper.build_url('http://example.com', FileNotFoundPage.new)).to be_nil
+    end
+  end
+
+  describe '#generate_page_url' do
+    it 'combines the base url and page path' do
+      page = Page.new
+      allow(page).to receive(:path).and_return('/about')
+
+      expect(helper.generate_page_url('http://example.com/current', page)).to eq('http://example.com/about')
+    end
+  end
+end

data/spec/helpers/application_helper_spec.rb

@@ -0,0 +1,102 @@
+require 'spec_helper'
+
+describe ApplicationHelper, type: :helper do
+  describe 'title and subtitle' do
+    it 'falls back to the default title and subtitle' do
+      allow(helper).to receive(:trusty_config).and_return({})
+
+      expect(helper.title).to eq('Trusty CMS')
+      expect(helper.subtitle).to eq('Publishing for Small Teams')
+      expect(helper.default_page_title).to eq('Trusty CMS - Publishing for Small Teams')
+    end
+
+    it 'uses the configured title and subtitle when present' do
+      allow(helper).to receive(:trusty_config)
+        .and_return('admin.title' => 'My Admin', 'admin.subtitle' => 'My Subtitle')
+
+      expect(helper.title).to eq('My Admin')
+      expect(helper.subtitle).to eq('My Subtitle')
+      expect(helper.default_page_title).to eq('My Admin - My Subtitle')
+    end
+  end
+
+  describe '#logged_in?' do
+    it 'is true when there is a current user' do
+      allow(helper).to receive(:current_user).and_return(User.new)
+      expect(helper.logged_in?).to be(true)
+    end
+
+    it 'is false when there is no current user' do
+      allow(helper).to receive(:current_user).and_return(nil)
+      expect(helper.logged_in?).to be(false)
+    end
+  end
+
+  describe '#admin? and #designer?' do
+    it 'reflects an admin user' do
+      user = instance_double(User, admin?: true, designer?: false)
+      allow(helper).to receive(:current_user).and_return(user)
+
+      expect(helper.admin?).to be(true)
+      expect(helper.designer?).to be(true)
+    end
+
+    it 'treats a designer as a designer but not an admin' do
+      user = instance_double(User, admin?: false, designer?: true)
+      allow(helper).to receive(:current_user).and_return(user)
+
+      expect(helper.admin?).to be(false)
+      expect(helper.designer?).to be(true)
+    end
+
+    it 'is false for both when there is no current user' do
+      allow(helper).to receive(:current_user).and_return(nil)
+
+      expect(helper.admin?).to be_falsey
+      expect(helper.designer?).to be_falsey
+    end
+  end
+
+  describe '#meta_errors? and #meta_label' do
+    it 'reports no meta errors and a "More" label' do
+      expect(helper.meta_errors?).to be(false)
+      expect(helper.meta_label).to eq('More')
+    end
+  end
+
+  describe '#translate_with_default' do
+    it 'returns the given name when there is no translation' do
+      expect(helper.translate_with_default('Some Untranslated Name')).to eq('Some Untranslated Name')
+    end
+  end
+
+  describe '#clean' do
+    it 'collapses duplicate slashes and strips a trailing slash from the path' do
+      expect(helper.clean('http://example.com/a//b/')).to eq('/a/b')
+    end
+  end
+
+  describe '#append_image_extension' do
+    it 'appends .png when no extension is present' do
+      expect(helper.send(:append_image_extension, 'admin/foo')).to eq('admin/foo.png')
+    end
+
+    it 'leaves an existing extension untouched' do
+      expect(helper.send(:append_image_extension, 'admin/foo.gif')).to eq('admin/foo.gif')
+    end
+  end
+
+  describe '#available_locales_select' do
+    it 'prepends a default option with a blank value' do
+      expect(helper.available_locales_select.first.last).to eq('')
+    end
+  end
+
+  describe '#body_classes' do
+    it 'starts as an empty, memoized array' do
+      expect(helper.body_classes).to eq([])
+      helper.body_classes << 'reversed'
+      expect(helper.body_classes).to eq(['reversed'])
+    end
+  end
+end

data/spec/helpers/scoped_helper_spec.rb

@@ -0,0 +1,60 @@
+require 'spec_helper'
+
+describe ScopedHelper do
+  # ScopedHelper defines #title/#subtitle on its includer (via the included
+  # hook) and reads from #current_site, so mix it into a small host class and
+  # stub current_site rather than fight ApplicationHelper's own title/subtitle.
+  let(:host_class) do
+    Class.new do
+      include ScopedHelper
+      attr_accessor :site
+      def current_site
+        site
+      end
+    end
+  end
+
+  subject(:helper) { host_class.new }
+
+  def site_double(name:, subtitle:)
+    double('site', name: name, subtitle: subtitle)
+  end
+
+  describe '#title' do
+    it 'uses the current site name when present' do
+      helper.site = site_double(name: 'My Site', subtitle: '')
+      expect(helper.title).to eq('My Site')
+    end
+
+    it 'falls back to the configured admin title when the site name is blank' do
+      allow(TrustyCms::Config).to receive(:[]).with('admin.title').and_return('Configured Title')
+      helper.site = site_double(name: '', subtitle: '')
+      expect(helper.title).to eq('Configured Title')
+    end
+
+    it 'falls back to the default when both the site name and config are blank' do
+      allow(TrustyCms::Config).to receive(:[]).with('admin.title').and_return(nil)
+      helper.site = site_double(name: '', subtitle: '')
+      expect(helper.title).to eq('TrustyCMS')
+    end
+  end
+
+  describe '#subtitle' do
+    it 'uses the current site subtitle when present' do
+      helper.site = site_double(name: 'My Site', subtitle: 'My Subtitle')
+      expect(helper.subtitle).to eq('My Subtitle')
+    end
+
+    it 'falls back to the configured admin subtitle when the site subtitle is blank' do
+      allow(TrustyCms::Config).to receive(:[]).with('admin.subtitle').and_return('Configured Subtitle')
+      helper.site = site_double(name: 'My Site', subtitle: '')
+      expect(helper.subtitle).to eq('Configured Subtitle')
+    end
+
+    it 'falls back to the default when both the site subtitle and config are blank' do
+      allow(TrustyCms::Config).to receive(:[]).with('admin.subtitle').and_return(nil)
+      helper.site = site_double(name: 'My Site', subtitle: '')
+      expect(helper.subtitle).to eq('publishing for small teams')
+    end
+  end
+end

data/spec/lib/active_record_extensions_spec.rb

@@ -0,0 +1,65 @@
+require 'spec_helper'
+
+# ActiveRecord::Base monkeypatches. object_id_attr in particular relies on
+# .descendants and generated accessors, so pin its behaviour ahead of any
+# Rails upgrade. Exercised through PagePart, which uses it in production.
+describe 'ActiveRecord extensions' do
+  describe '.object_id_attr' do
+    it 'instantiates the matching descendant for the stored id' do
+      HamlFilter # ensure the descendant is autoloaded
+      part = PagePart.new(filter_id: 'Haml')
+      expect(part.filter).to be_a(HamlFilter)
+    end
+
+    it 'falls back to the base class when no descendant matches' do
+      part = PagePart.new(filter_id: nil)
+      expect(part.filter.class).to eq(TextFilter)
+    end
+
+    it 'memoises the built object until the id changes' do
+      part = PagePart.new(filter_id: nil)
+      first = part.filter
+      expect(part.filter).to equal(first)
+
+      HamlFilter
+      part.filter_id = 'Haml'
+      expect(part.filter).to be_a(HamlFilter)
+    end
+  end
+
+  describe '.validates_path' do
+    let(:model_class) do
+      Class.new(PageField) do
+        validates_path :content
+        def self.name
+          'PathValidatedField'
+        end
+      end
+    end
+
+    it 'is valid when the value resolves to a real page' do
+      page = FactoryBot.create(:page, slug: '/', status_id: Status[:published].id)
+      allow(Page).to receive(:find_by_path).and_return(page)
+
+      record = model_class.new(name: 'ref', content: '/')
+      record.valid?
+      expect(record.errors[:content]).to be_empty
+    end
+
+    it 'adds an error when the path is not found' do
+      allow(Page).to receive(:find_by_path).and_return(nil)
+
+      record = model_class.new(name: 'ref', content: '/missing')
+      record.valid?
+      expect(record.errors[:content]).to be_present
+    end
+
+    it 'adds an error when the path resolves to a FileNotFoundPage' do
+      allow(Page).to receive(:find_by_path).and_return(FileNotFoundPage.new)
+
+      record = model_class.new(name: 'ref', content: '/404')
+      record.valid?
+      expect(record.errors[:content]).to be_present
+    end
+  end
+end

data/spec/lib/login_system_spec.rb

@@ -0,0 +1,61 @@
+require 'spec_helper'
+
+# LoginSystem is TrustyCms's custom role-based authorization layer, mixed into
+# ApplicationController. The class-level access rules are pure logic, so pin
+# them ahead of any Rails upgrade without needing a full request cycle.
+describe LoginSystem do
+  describe 'role-based access (.only_allow_access_to / .user_has_access_to_action?)' do
+    let(:controller_class) do
+      Class.new(ActionController::Base) do
+        include LoginSystem
+        only_allow_access_to :index, :show,
+                             when: %i[admin designer],
+                             denied_message: 'You need editor privileges.'
+      end
+    end
+
+    it 'records the declared permissions per action' do
+      perms = controller_class.controller_permissions[:index]
+      expect(perms[:when]).to eq(%i[admin designer])
+      expect(perms[:denied_message]).to eq('You need editor privileges.')
+    end
+
+    it 'grants access to a user with an allowed role' do
+      expect(controller_class.user_has_access_to_action?(User.new(admin: true), :index)).to be(true)
+      expect(controller_class.user_has_access_to_action?(User.new(designer: true), :show)).to be(true)
+    end
+
+    it 'denies a user without an allowed role' do
+      expect(controller_class.user_has_access_to_action?(User.new, :index)).to be(false)
+    end
+
+    it 'denies an anonymous (nil) user' do
+      expect(controller_class.user_has_access_to_action?(nil, :index)).to be(false)
+    end
+
+    it 'allows any action that has no declared restriction' do
+      expect(controller_class.user_has_access_to_action?(User.new, :unlisted_action)).to be(true)
+    end
+  end
+
+  describe 'conditional access (:if)' do
+    let(:controller_class) do
+      Class.new(ActionController::Base) do
+        include LoginSystem
+        only_allow_access_to :index, if: :allowed?
+        def allowed?
+          true
+        end
+      end
+    end
+
+    it 'delegates to the named predicate on the controller' do
+      expect(controller_class.user_has_access_to_action?(User.new, :index)).to be(true)
+    end
+  end
+
+  # NOTE: .login_required? / .login_required reference `filter_chain`, a Rails
+  # API removed years ago, and would raise NoMethodError if called. They are
+  # dead code today (only commented-out call sites remain), so they are not
+  # exercised here. Flagging for removal or repair rather than pinning.
+end

data/spec/lib/ostruct_spec.rb

@@ -0,0 +1,33 @@
+require 'spec_helper'
+require 'ostruct'
+
+# lib/ostruct.rb reopens OpenStruct (originally patched for a Ruby upgrade) and
+# shadows the stdlib version via the load path. This is exactly the kind of
+# patch a Ruby/Rails upgrade can break, so pin the behaviour we rely on.
+describe 'OpenStruct patch' do
+it 'is the project patch, not the stdlib implementation' do
+  expect(OpenStruct.instance_method(:initialize).source_location.first)
+    .to eq(File.expand_path('../../lib/ostruct.rb', __dir__))
+end
+
+  it 'builds accessors from a hash, symbolizing string keys' do
+    os = OpenStruct.new('a' => 1, :b => 2)
+    expect(os.a).to eq(1)
+    expect(os.b).to eq(2)
+  end
+
+  it 'returns nil for an unset member' do
+    expect(OpenStruct.new.anything).to be_nil
+  end
+
+  it 'assigns and reads a member dynamically' do
+    os = OpenStruct.new
+    os.foo = 'bar'
+    expect(os.foo).to eq('bar')
+  end
+
+  it 'raises ArgumentError when a setter is given the wrong arity' do
+    os = OpenStruct.new
+    expect { os.send(:foo=, 1, 2) }.to raise_error(ArgumentError)
+  end
+end

data/spec/lib/string_extensions_spec.rb

@@ -0,0 +1,48 @@
+require 'spec_helper'
+require 'string_extensions/string_extensions'
+
+# Core-class monkeypatch: pin the behaviour so a Ruby/Rails upgrade that shifts
+# String#underscore/#humanize or stringex surfaces as a failure here.
+describe 'String extensions' do
+  describe '#symbolize' do
+    it 'collapses non-alphanumerics and underscores into a symbol' do
+      expect('Foo Bar!'.symbolize).to eq(:foo_bar)
+    end
+
+    it 'strips leading and trailing separators' do
+      expect('  Hello--World  '.symbolize).to eq(:hello_world)
+    end
+  end
+
+  describe '#titlecase' do
+    it 'upcases the first letter of each word' do
+      expect('hello world'.titlecase).to eq('Hello World')
+    end
+
+    it 'leaves already-capitalised words alone' do
+      expect('Hello World'.titlecase).to eq('Hello World')
+    end
+  end
+
+  describe '#to_name' do
+    it 'humanises and title-cases a class-style name' do
+      expect('FooBar'.to_name).to eq('Foo Bar')
+    end
+
+    it 'strips a trailing suffix when given one' do
+      expect('FooFilter'.to_name('Filter')).to eq('Foo')
+    end
+  end
+
+  describe '#parameterize and its aliases' do
+    it 'produces a url-style slug' do
+      expect('Hello World'.parameterize).to eq('hello-world')
+    end
+
+    it 'aliases to_slug, slugify and slugerize to parameterize' do
+      expect('Hello World'.to_slug).to eq('hello-world')
+      expect('Hello World'.slugify).to eq('hello-world')
+      expect('Hello World'.slugerize).to eq('hello-world')
+    end
+  end
+end

data/spec/lib/symbol_extensions_spec.rb

@@ -0,0 +1,14 @@
+require 'spec_helper'
+# NOTE: symbol_extensions is not required anywhere in the app itself, so we
+# require it explicitly here. Kept as an upgrade tripwire since it depends on
+# String#symbolize (see string_extensions).
+require 'string_extensions/string_extensions'
+require 'symbol_extensions/symbol_extensions'
+
+describe 'Symbol extensions' do
+  describe '#symbolize' do
+    it 'normalises the symbol via String#symbolize' do
+      expect(:'Foo Bar'.symbolize).to eq(:foo_bar)
+    end
+  end
+end