trusty-cms 7.1.2 → 7.1.3

data/spec/models/user_serialize_telemetry_spec.rb

@@ -0,0 +1,124 @@
+require 'spec_helper'
+
+# Load the REAL multi_site scoping code (the extension is not activated in the
+# dummy test app) so we reproduce the exact production site-scope on User.
+require File.expand_path(
+  '../../vendor/extensions/multi-site-extension/lib/multi_site/scoped_model', __dir__
+)
+
+# Telemetry for the intermittent CMS logout (issue #1040). This is observe-only:
+# it must NOT change Devise's behavior, and must report exactly when a valid user
+# is excluded from session deserialization by the site scope.
+describe 'User.serialize_from_session telemetry (issue #1040)', type: :model do
+  # Apply the production multi_site User scope for this example group only, then
+  # restore it (config.order = "random", so a leaked default_scope would corrupt
+  # other specs).
+  around do |example|
+    original_default_scopes = User.default_scopes.dup
+
+    added_page_accessor = false
+    unless Page.respond_to?(:current_site)
+      Page.singleton_class.send(:attr_accessor, :current_site)
+      added_page_accessor = true
+    end
+
+    unless User.singleton_class.include?(MultiSite::ScopedModel::ScopedClassMethods)
+      User.extend(MultiSite::ScopedModel::ScopedClassMethods)
+    end
+    # `extend` above can't be undone, so pin is_site_scoped? explicitly per
+    # example (true here, false in ensure) to keep the telemetry from leaking on
+    # into unrelated specs after this group runs.
+    User.define_singleton_method(:is_site_scoped?) { true }
+    User.class_eval { default_scope { joins(user_scope_condition) } }
+
+    begin
+      example.run
+    ensure
+      User.default_scopes = original_default_scopes
+      User.define_singleton_method(:is_site_scoped?) { false }
+      if added_page_accessor
+        Page.singleton_class.send(:remove_method, :current_site)
+        Page.singleton_class.send(:remove_method, :current_site=)
+      end
+      Thread.current[:trusty_request_host] = nil
+    end
+  end
+
+  let(:site_a) { create(:site) }
+  let(:site_b) { create(:site) }
+
+  # Editor assigned to site_a only.
+  let(:editor) do
+    user = create(:user, email: 'editor@example.com')
+    AdminsSite.create!(admin: user, site: site_a)
+    user
+  end
+
+  def serialize
+    User.serialize_from_session(editor.id, editor.authenticatable_salt)
+  end
+
+  context 'when current_site excludes an otherwise-valid user (the bug)' do
+    before { Page.current_site = site_b }
+
+    it 'still returns nil — behavior is unchanged vs the scoped default' do
+      expect(serialize).to be_nil
+    end
+
+    it 'reports the miss to the log with context and a classification' do
+      Thread.current[:trusty_request_host] = site_a.base_domain # host they belong to
+      expect(Rails.logger).to receive(:warn).with(/CMS site-scope logout/)
+      serialize
+    end
+
+    it 'classifies a host-they-belong-to mismatch as a race' do
+      Thread.current[:trusty_request_host] = site_a.base_domain
+      ctx = TrustyCms::SiteScopeAuthReporter.build_context(editor)
+      expect(ctx[:classification]).to eq('race')
+      expect(ctx[:user_id]).to eq(editor.id)
+      expect(ctx[:current_site_id]).to eq(site_b.id)
+    end
+
+    it 'classifies a host they are not assigned to as genuine_cross_site' do
+      Thread.current[:trusty_request_host] = site_b.base_domain # host they do NOT belong to
+      ctx = TrustyCms::SiteScopeAuthReporter.build_context(editor)
+      expect(ctx[:classification]).to eq('genuine_cross_site')
+    end
+
+    it 'classifies a request host that matches no site as host_unmatched' do
+      Thread.current[:trusty_request_host] = 'nomatch.invalid'
+      ctx = TrustyCms::SiteScopeAuthReporter.build_context(editor)
+      expect(ctx[:expected_site_id]).to be_nil
+      expect(ctx[:classification]).to eq('host_unmatched')
+    end
+  end
+
+  context 'when current_site includes the user (normal case)' do
+    before { Page.current_site = site_a }
+
+    it 'returns the user and reports nothing' do
+      expect(Rails.logger).not_to receive(:warn).with(/CMS site-scope logout/)
+      expect(serialize).to eq(editor)
+    end
+  end
+
+  context 'when the session key maps to no user at all' do
+    before { Page.current_site = site_a }
+
+    it 'reports nothing (ordinary expired/invalid session)' do
+      expect(Rails.logger).not_to receive(:warn).with(/CMS site-scope logout/)
+      expect(User.serialize_from_session(0, 'nope')).to be_nil
+    end
+  end
+
+  it 'never raises into the auth path if telemetry blows up' do
+    Page.current_site = site_b
+    allow(TrustyCms::SiteScopeAuthReporter).to receive(:build_context).and_raise('boom')
+    allow(Rails.logger).to receive(:error)
+
+    result = nil
+    expect { result = serialize }.not_to raise_error
+    expect(result).to be_nil
+    expect(Rails.logger).to have_received(:error).with(/SiteScopeAuthReporter error/)
+  end
+end

data/spec/rails_helper.rb

@@ -3,12 +3,11 @@ ENV["RAILS_ENV"] ||= 'test'
 require 'spec_helper'
 require 'rspec/rails'
 require 'capybara/rails'
-require 'capybara/poltergeist'
-Capybara.javascript_driver = :poltergeist
-
-Capybara.register_driver :poltergeist do |app|
-  Capybara::Poltergeist::Driver.new(app, timeout: 60)
-end
+# JS-driven system/feature tests use headless Chrome via Selenium. Poltergeist
+# (PhantomJS) was removed: it is unmaintained and does not run on modern
+# Ruby/Rails. The driver is registered lazily by Capybara, so this line does
+# not require selenium-webdriver unless a :js example actually runs.
+Capybara.javascript_driver = :selenium_chrome_headless
 
 require 'database_cleaner'
 DatabaseCleaner.strategy = :truncation, {except: %w[config]}
@@ -46,6 +45,14 @@ RSpec.configure do |config|
   # https://relishapp.com/rspec/rspec-rails/docs
   config.infer_spec_type_from_file_location!
 
+  # Devise/Warden test helpers: sign_in for request specs, login_as for feature
+  # specs. (Previously the feature specs called login_as with no helper wired
+  # up.)
+  config.include Devise::Test::IntegrationHelpers, type: :request
+  config.include Warden::Test::Helpers, type: :feature
+  config.before(:each, type: :feature) { Warden.test_mode! }
+  config.after(:each, type: :feature) { Warden.test_reset! }
+
   config.before(:suite) do
     TrustyCms::Config.initialize_cache
 

data/spec/requests/admin/snippets_spec.rb

@@ -0,0 +1,81 @@
+require 'rails_helper'
+
+# Full-stack smoke: routing -> Devise/Warden auth -> ResourceController ->
+# responder -> JSON render -> model -> DB. Uses the JSON endpoints so the smoke
+# doesn't depend on the (asset-pipeline-heavy) admin HTML layout, which can't be
+# rendered in this test environment. This is a high-value regression net for a
+# Rails/Ruby upgrade: it exercises the real request cycle end to end.
+RSpec.describe 'Admin::Snippets requests', type: :request do
+  let(:admin) { FactoryBot.create(:admin) }
+
+  describe 'authentication' do
+    it 'redirects an unauthenticated HTML request to sign-in' do
+      get '/admin/snippets'
+      expect(response).to redirect_to(new_user_session_path)
+    end
+
+    it 'returns 401 for an unauthenticated JSON request' do
+      get '/admin/snippets.json'
+      expect(response).to have_http_status(:unauthorized)
+    end
+  end
+
+  describe 'authorization' do
+    it 'forbids a signed-in user without editor privileges (JSON)' do
+      sign_in FactoryBot.create(:user, email: 'plain@example.com')
+      get '/admin/snippets.json'
+      expect(response).to have_http_status(:forbidden)
+    end
+  end
+
+  context 'when signed in as an admin' do
+    before { sign_in admin }
+
+    it 'lists snippets as JSON' do
+      FactoryBot.create(:snippet, name: 'listed', content: 'x')
+
+      get '/admin/snippets.json'
+
+      expect(response).to have_http_status(:ok)
+      names = JSON.parse(response.body).map { |s| s['name'] }
+      expect(names).to include('listed')
+    end
+
+    it 'creates a snippet via JSON' do
+      expect {
+        post '/admin/snippets.json', params: { snippet: { name: 'greeting', content: 'hi' } }
+      }.to change(Snippet, :count).by(1)
+
+      expect(response).to have_http_status(:created)
+      expect(Snippet.find_by(name: 'greeting').content).to eq('hi')
+    end
+
+    it 'updates a snippet via JSON' do
+      snippet = FactoryBot.create(:snippet, name: 'editme', content: 'old')
+
+      put "/admin/snippets/#{snippet.id}.json", params: { snippet: { content: 'new' } }
+
+      expect(response).to have_http_status(:ok)
+      expect(snippet.reload.content).to eq('new')
+    end
+
+    it 'destroys the record via JSON' do
+      snippet = FactoryBot.create(:snippet, name: 'goner')
+
+      expect {
+        delete "/admin/snippets/#{snippet.id}.json"
+      }.to change(Snippet, :count).by(-1)
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to be_empty
+    end
+
+    it 'destroys the record and redirects (HTML)' do
+      snippet = FactoryBot.create(:snippet, name: 'goner-html')
+      expect {
+        delete "/admin/snippets/#{snippet.id}"
+      }.to change(Snippet, :count).by(-1)
+      expect(response).to redirect_to(admin_snippets_path)
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -1,9 +1,10 @@
 ENV['RAILS_ENV'] ||= 'test'
-require File.expand_path('../dummy/config/environment.rb', __FILE__)
 
-# Coverage setup
+# Coverage setup — MUST run before any application code is loaded,
+# otherwise Ruby's Coverage library never sees files loaded at boot.
 require 'simplecov'
 require 'simplecov-lcov'
+require 'simplecov_json_formatter'
 
 SimpleCov::Formatter::LcovFormatter.config do |config|
   config.report_with_single_file = true
@@ -11,9 +12,22 @@ SimpleCov::Formatter::LcovFormatter.config do |config|
   config.lcov_file_name = 'lcov.info'
 end
 
-SimpleCov.formatter = SimpleCov::Formatter::LcovFormatter
+SimpleCov.configure do
+  add_filter %r{^/lib/generators/}
+  add_filter 'lib/trusty_cms/setup.rb'
+  add_filter %r{/templates/}   # generated-app boilerplate
+end
+
+SimpleCov.formatter = SimpleCov::Formatter::MultiFormatter.new([
+  SimpleCov::Formatter::JSONFormatter,   # coverage/coverage.json — consumed by qlty
+  SimpleCov::Formatter::LcovFormatter,
+  SimpleCov::Formatter::HTMLFormatter
+])
 SimpleCov.start('rails')
 
+# Now load the application — everything required below is tracked.
+require File.expand_path('../dummy/config/environment.rb', __FILE__)
+
 # Test framework setup
 require 'rspec/rails'
 require 'factory_bot_rails'

data/trusty_cms.gemspec

@@ -46,15 +46,15 @@ a general purpose content management system--not merely a blogging engine.'
   s.add_dependency 'mutex_m'
   s.add_dependency 'mysql2'
   s.add_dependency 'paper_trail', '~> 16.0.0'
-  s.add_dependency 'paper_trail-association_tracking', '~> 2.2.1'
-  s.add_dependency 'psych', '5.2.2'
+  s.add_dependency 'paper_trail-association_tracking', '>= 2.2.1', '< 2.4.0'
+  s.add_dependency 'psych', '5.4.0'
   s.add_dependency 'rack', '>= 2.0.1', '< 3.2.0'
   s.add_dependency 'rack-cache', '~> 1.7'
   s.add_dependency 'radius', '~> 0.8'
   s.add_dependency 'rails', '~> 7.2.2.1'
   s.add_dependency 'rake', '< 14.0'
   s.add_dependency 'ransack', '~> 4.2.1'
-  s.add_dependency 'rdoc', '>= 5.1', '< 7.0'
+  s.add_dependency 'rdoc', '>= 5.1', '< 9.0'
   s.add_dependency 'RedCloth', '4.3.4'
   s.add_dependency 'roadie-rails'
   s.add_dependency 'rqrcode'