trusty-cms 7.1.2 → 7.2

data/spec/controllers/admin/security_controller_spec.rb

@@ -0,0 +1,85 @@
+require 'spec_helper'
+
+# Exercises Admin::SecurityController — password changes and TOTP two-factor
+# enable/disable/verify for the current user. Touches devise-two-factor and QR
+# provisioning, both plausible upgrade casualties.
+RSpec.describe Admin::SecurityController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:user) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(user)
+    # sign_out/sign_in need Warden wiring we don't set up here; the auth side
+    # effect isn't what these specs are checking.
+    allow(controller).to receive(:sign_out)
+  end
+
+  describe 'GET #show' do
+    it 'generates an OTP secret and QR provisioning data' do
+      expect(user.otp_secret).to be_blank
+
+      get :show
+
+      expect(response).to have_http_status(:ok)
+      expect(user.reload.otp_secret).to be_present
+      expect(controller.instance_variable_get(:@qr_png_data)).to start_with('data:image/png')
+    end
+  end
+
+  describe 'GET #edit' do
+    it 'succeeds' do
+      get :edit
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates the password, signs out, and redirects to sign-in' do
+      put :update, params: { user: { password: 'NewComplex1!', password_confirmation: 'NewComplex1!' } }
+
+      expect(controller).to have_received(:sign_out).with(user)
+      expect(response).to redirect_to(new_user_session_path)
+    end
+
+    it 're-renders edit when the password change is invalid' do
+      put :update, params: { user: { password: 'x', password_confirmation: 'y' } }
+
+      expect(flash[:error]).to be_present
+    end
+  end
+
+  describe 'POST #verify_two_factor' do
+    it 'enables 2FA when the OTP is valid' do
+      allow(user).to receive(:validate_and_consume_otp!).with('123456').and_return(true)
+
+      post :verify_two_factor, params: { otp_attempt: '123456' }
+
+      expect(user.reload.otp_required_for_login).to be(true)
+      expect(response).to redirect_to(admin_security_path)
+    end
+
+    it 'reports an error when the OTP is invalid' do
+      allow(user).to receive(:validate_and_consume_otp!).and_return(false)
+
+      post :verify_two_factor, params: { otp_attempt: 'bad' }
+
+      expect(flash[:error]).to be_present
+      expect(response).to redirect_to(admin_security_path)
+    end
+  end
+
+  describe 'POST #disable_two_factor' do
+    it 'clears the OTP settings and redirects' do
+      user.update!(otp_required_for_login: true, otp_secret: User.generate_otp_secret)
+
+      post :disable_two_factor
+
+      user.reload
+      expect(user.otp_required_for_login).to be(false)
+      expect(user.otp_secret).to be_nil
+      expect(response).to redirect_to(admin_security_path)
+    end
+  end
+end

data/spec/controllers/admin/sessions_controller_spec.rb

@@ -0,0 +1,56 @@
+require 'spec_helper'
+
+# Exercises Admin::SessionsController#create — the custom login flow that
+# branches into the two-factor handoff for OTP-enabled users. Overriding a
+# Devise controller is exactly the sort of thing that can break across a Devise
+# major, so pin the three branches (2FA, plain sign-in, bad credentials).
+RSpec.describe Admin::SessionsController, type: :controller do
+  routes { TrustyCms::Application.routes }
+  include Devise::Test::ControllerHelpers
+
+  let(:password) { 'ComplexPass1!' }
+
+  before do
+    request.env['devise.mapping'] = Devise.mappings[:user]
+    # sign_in needs Warden wiring that isn't the focus here.
+    allow(controller).to receive(:sign_in)
+  end
+
+  describe 'POST #create' do
+    it 'signs in a valid non-2FA user and redirects' do
+      user = create(:admin, password: password)
+
+      post :create, params: { user: { email: user.email, password: password } }
+
+      expect(controller).to have_received(:sign_in).with(:user, user)
+      expect(response).to redirect_to(admin_pages_path)
+    end
+
+    it 'starts the 2FA handoff for an OTP-enabled user' do
+      user = create(:admin, password: password, otp_required_for_login: true)
+
+      post :create, params: { user: { email: user.email, password: password } }
+
+      expect(response).to redirect_to(admin_two_factor_path)
+      expect(session[:pre_2fa_user_id]).to eq(user.id)
+      expect(session[:pre_2fa_started_at]).to be_present
+      expect(controller).not_to have_received(:sign_in)
+    end
+
+    it 're-renders the sign-in form on bad credentials' do
+      user = create(:admin, password: password)
+
+      post :create, params: { user: { email: user.email, password: 'wrong' } }
+
+      expect(controller).not_to have_received(:sign_in)
+      expect(flash.now[:alert]).to be_present
+    end
+
+    it 're-renders the sign-in form for an unknown email' do
+      post :create, params: { user: { email: 'nobody@example.com', password: password } }
+
+      expect(controller).not_to have_received(:sign_in)
+      expect(flash.now[:alert]).to be_present
+    end
+  end
+end

data/spec/controllers/admin/snippets_controller_spec.rb

@@ -0,0 +1,95 @@
+require 'spec_helper'
+
+# Exercises the full request cycle through Admin::ResourceController (the base
+# for most admin CRUD): before-action chain, permitted_params, response_for
+# dispatch, and the redirect/re-render paths. High blast radius for a Rails
+# upgrade, so keep this green before and after the bump.
+RSpec.describe Admin::SnippetsController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:user) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(user)
+  end
+
+  describe 'GET #index' do
+    it 'succeeds for an authorized user' do
+      create(:snippet, name: 'listed')
+      get :index
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #new' do
+    it 'succeeds' do
+      get :new
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'POST #create' do
+    it 'creates a snippet and redirects to the index' do
+      expect {
+        post :create, params: { snippet: { name: 'greeting', content: 'Hello' } }
+      }.to change(Snippet, :count).by(1)
+
+      expect(response).to be_redirect
+      expect(Snippet.find_by(name: 'greeting').content).to eq('Hello')
+    end
+
+    it 'records the creating user' do
+      post :create, params: { snippet: { name: 'owned', content: 'x' } }
+      expect(Snippet.find_by(name: 'owned').created_by_id).to eq(user.id)
+    end
+
+    # NOTE: Admin::ResourceController defines #rescue_action, but that is a
+    # Rails 2 hook the framework no longer calls, and it is not re-wired via
+    # rescue_from (only Admin::PagesController does that). So an invalid create
+    # currently raises RecordInvalid unhandled (a 500 in production) instead of
+    # re-rendering the form via `response_for :invalid`. Characterizing the
+    # current behavior; revisit if rescue_action is ever wired up.
+    it 'raises on invalid input and persists nothing (latent bug: rescue_action is dead)' do
+      expect {
+        post :create, params: { snippet: { name: '', content: 'x' } }
+      }.to raise_error(ActiveRecord::RecordInvalid)
+
+      expect(Snippet.where(name: '')).to be_empty
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates the snippet and redirects' do
+      snippet = create(:snippet, name: 'editme', content: 'old')
+
+      put :update, params: { id: snippet.id, snippet: { content: 'new' } }
+
+      expect(response).to be_redirect
+      expect(snippet.reload.content).to eq('new')
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    it 'destroys the snippet and redirects' do
+      snippet = create(:snippet, name: 'goner')
+
+      expect {
+        delete :destroy, params: { id: snippet.id }
+      }.to change(Snippet, :count).by(-1)
+
+      expect(response).to be_redirect
+    end
+  end
+
+  describe 'authorization' do
+    it 'denies a user without editor privileges' do
+      allow(controller).to receive(:current_user).and_return(create(:user, email: 'plain@example.com'))
+
+      get :index
+
+      expect(response).to be_redirect
+      expect(flash[:error]).to be_present
+    end
+  end
+end

data/spec/controllers/admin/two_factor_controller_spec.rb

@@ -0,0 +1,63 @@
+require 'spec_helper'
+
+# Exercises Admin::TwoFactorController — the mid-login TOTP challenge. It runs
+# BEFORE the user is fully signed in (authenticate_user! is skipped) and drives
+# the flow off a short-lived session handoff (:pre_2fa_user_id / :started_at).
+RSpec.describe Admin::TwoFactorController, type: :controller do
+  routes { TrustyCms::Application.routes }
+  # current_user is read via Devise even though authenticate_user! is skipped.
+  include Devise::Test::ControllerHelpers
+
+  let(:user) { create(:admin, otp_required_for_login: true) }
+
+  # Put the user mid-2FA: pending id in the session, started just now.
+  def begin_2fa!(started_at: Time.current.to_i)
+    session[:pre_2fa_user_id] = user.id
+    session[:pre_2fa_started_at] = started_at
+  end
+
+  before { allow(controller).to receive(:sign_in) }
+
+  describe 'GET #show' do
+    it 'renders the challenge for a user mid-2FA' do
+      begin_2fa!
+      get :show
+      expect(response).to have_http_status(:ok)
+    end
+
+    it 'redirects to sign-in when there is no pending 2FA session' do
+      get :show
+      expect(response).to redirect_to(new_user_session_path)
+      expect(flash[:alert]).to be_present
+    end
+
+    it 'redirects to sign-in when the 2FA session has expired' do
+      begin_2fa!(started_at: 10.minutes.ago.to_i)
+      get :show
+      expect(response).to redirect_to(new_user_session_path)
+    end
+  end
+
+  describe 'POST #create' do
+    before { begin_2fa! }
+
+    it 'signs the user in and clears the handoff when the code is valid' do
+      allow_any_instance_of(User).to receive(:validate_and_consume_otp!).with('123456').and_return(true)
+
+      post :create, params: { otp_attempt: '123456' }
+
+      expect(controller).to have_received(:sign_in).with(:user, an_instance_of(User))
+      expect(response).to redirect_to(admin_pages_path)
+      expect(session[:pre_2fa_user_id]).to be_nil
+    end
+
+    it 'resets the session and redirects when the code is invalid' do
+      allow_any_instance_of(User).to receive(:validate_and_consume_otp!).and_return(false)
+
+      post :create, params: { otp_attempt: 'wrong' }
+
+      expect(response).to redirect_to(new_user_session_path)
+      expect(flash[:alert]).to be_present
+    end
+  end
+end

data/spec/controllers/admin/users_controller_spec.rb

@@ -0,0 +1,132 @@
+require 'spec_helper'
+
+# Exercises Admin::UsersController, which layers admin-only authorization and
+# several custom overrides (create/update/destroy/disable_2fa, plus the
+# self-protection guards) on top of ResourceController. Devise/2FA touch points
+# make this a useful regression net for a Rails/Ruby upgrade.
+RSpec.describe Admin::UsersController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:admin) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(admin)
+  end
+
+  def valid_user_params(overrides = {})
+    {
+      first_name: 'New',
+      last_name: 'Person',
+      email: 'newperson@example.com',
+      password: 'ComplexPass1!',
+      password_confirmation: 'ComplexPass1!',
+    }.merge(overrides)
+  end
+
+  describe 'GET #index' do
+    it 'succeeds for an admin' do
+      get :index
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #new' do
+    it 'succeeds' do
+      get :new
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #show' do
+    it 'redirects to the edit page' do
+      user = create(:user, email: 'showme@example.com')
+      get :show, params: { id: user.id }
+      expect(response).to redirect_to(edit_admin_user_path(user.id))
+    end
+  end
+
+  describe 'POST #create' do
+    it 'creates a user and redirects with a notice' do
+      expect {
+        post :create, params: { user: valid_user_params }
+      }.to change(User, :count).by(1)
+
+      expect(response).to redirect_to(admin_users_path)
+      expect(flash[:notice]).to eq('User was created.')
+    end
+
+    it 're-renders new with an error when the user is invalid' do
+      expect {
+        post :create, params: { user: valid_user_params(email: '') }
+      }.not_to change(User, :count)
+
+      expect(flash[:error]).to match(/error saving the user/)
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates an existing user and redirects' do
+      user = create(:user, email: 'editme@example.com')
+
+      put :update, params: { id: user.id, user: { first_name: 'Renamed' } }
+
+      expect(response).to be_redirect
+      expect(user.reload.first_name).to eq('Renamed')
+    end
+
+    # NOTE: latent bug — the guard compares `user_params['admin'] == false`, but
+    # over a real HTTP request the checkbox param arrives as the string 'false',
+    # which is != false. So through the normal request path an admin CAN demote
+    # themselves and no warning is shown. Characterizing current behavior;
+    # revisit if the guard is ever fixed to coerce the param.
+    it 'does NOT block self-demotion when admin arrives as the string "false" (bug)' do
+      put :update, params: { id: admin.id, user: { admin: 'false' } }
+
+      expect(admin.reload.admin).to be(false)
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    it 'destroys another user' do
+      user = create(:user, email: 'goner@example.com')
+
+      expect {
+        delete :destroy, params: { id: user.id }
+      }.to change(User, :count).by(-1)
+    end
+
+    it 'refuses to let a user delete themselves' do
+      expect {
+        delete :destroy, params: { id: admin.id }
+      }.not_to change(User, :count)
+
+      expect(response).to redirect_to(admin_users_path)
+      expect(flash[:error]).to be_present
+    end
+  end
+
+  describe 'PATCH #disable_2fa' do
+    it 'clears the OTP settings and redirects' do
+      user = create(:user, email: '2fa@example.com', otp_required_for_login: true)
+
+      patch :disable_2fa, params: { id: user.id }
+
+      user.reload
+      expect(user.otp_required_for_login).to be(false)
+      expect(user.otp_secret).to be_nil
+      expect(response).to redirect_to(admin_users_path)
+    end
+  end
+
+  describe 'authorization' do
+    it 'denies a non-admin user' do
+      allow(controller).to receive(:current_user).and_return(create(:non_admin, email: 'plain@example.com'))
+
+      get :index
+
+      expect(response).to be_redirect
+      expect(flash[:error]).to be_present
+    end
+  end
+end

data/spec/controllers/page_status_controller_spec.rb

@@ -0,0 +1,66 @@
+require 'spec_helper'
+
+# Exercises PageStatusController#refresh — a token-authenticated, no-CSRF JSON
+# endpoint that publishes scheduled pages whose time has come. Auth is a bearer
+# token compared with secure_compare; cover the reject paths and the publish
+# behaviour.
+RSpec.describe PageStatusController, type: :controller do
+  routes { TrustyCms::Application.routes }
+  # refresh skips authenticate_user!, but ApplicationController before-actions
+  # still read current_user, which needs Warden injected on the request.
+  include Devise::Test::ControllerHelpers
+
+  let(:token) { 'secret-bearer-token' }
+
+  def authorize!(value = token)
+    request.headers['Authorization'] = "Bearer #{value}"
+  end
+
+  before do
+    allow(Rails.application.credentials).to receive(:dig)
+      .with(:trusty_cms, :page_status_bearer_token).and_return(token)
+  end
+
+  describe 'POST #refresh authentication' do
+    it 'returns 401 when no token is provided' do
+      post :refresh
+      expect(response).to have_http_status(:unauthorized)
+      expect(JSON.parse(response.body)['error']).to eq('Missing Bearer Token')
+    end
+
+    it 'returns 401 when the token is wrong' do
+      authorize!('nope')
+      post :refresh
+      expect(response).to have_http_status(:unauthorized)
+      expect(JSON.parse(response.body)['error']).to eq('Invalid Bearer Token')
+    end
+  end
+
+  describe 'POST #refresh' do
+    before { authorize! }
+
+    it 'publishes scheduled pages whose publish time has passed' do
+      due = create(:page, title: 'Due', slug: 'due', status_id: Status[:scheduled].id,
+                          published_at: 1.day.ago)
+
+      post :refresh
+
+      expect(response).to have_http_status(:ok)
+      body = JSON.parse(response.body)
+      expect(body['updated_page_ids']).to include(due.id)
+      expect(due.reload.status_id).to eq(Status[:published].id)
+    end
+
+    it 'leaves future-scheduled pages alone' do
+      future = create(:page, title: 'Future', slug: 'future', status_id: Status[:scheduled].id,
+                             published_at: 1.day.from_now)
+
+      post :refresh
+
+      body = JSON.parse(response.body)
+      expect(body['remaining_scheduled_page_ids']).to include(future.id)
+      expect(body['message']).to match(/No scheduled pages/)
+      expect(future.reload.status_id).to eq(Status[:scheduled].id)
+    end
+  end
+end

data/spec/controllers/site_controller_spec.rb

@@ -0,0 +1,63 @@
+require 'spec_helper'
+
+describe SiteController, type: :request do
+  let!(:home) { FactoryBot.create(:home, title: 'Home') }
+
+  before { home.parts.create(name: 'body', content: 'Welcome <r:title />') }
+
+  describe 'serving pages' do
+    it 'renders the home page at the root path' do
+      get '/'
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('Welcome Home')
+    end
+
+    it 'renders a published child page by its path' do
+      about = FactoryBot.create(:page, title: 'About', slug: 'about', parent: home, status_id: Status[:published].id)
+      about.parts.create(name: 'body', content: 'About <r:title />')
+
+      get '/about'
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('About About')
+    end
+
+    it 'renders a nested published page' do
+      section = FactoryBot.create(:page, title: 'Section', slug: 'section', parent: home, status_id: Status[:published].id)
+      article = FactoryBot.create(:page, title: 'Article', slug: 'article', parent: section, status_id: Status[:published].id)
+      article.parts.create(name: 'body', content: 'Deep content')
+
+      get '/section/article'
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('Deep content')
+    end
+  end
+
+  describe 'unknown paths' do
+    it 'renders the not-found template with a 404 status' do
+      get '/does/not/exist'
+      expect(response).to have_http_status(:not_found)
+      expect(response.body).to include('could not be located')
+    end
+  end
+
+  describe 'content type' do
+    it 'sets the response Content-Type from the page layout' do
+      layout = Layout.create!(name: 'Plain', content: '<r:content />', content_type: 'text/plain')
+      page = FactoryBot.create(:page, title: 'Raw', slug: 'raw', parent: home, status_id: Status[:published].id, layout: layout)
+      page.parts.create(name: 'body', content: 'plain body')
+
+      get '/raw'
+      expect(response.media_type).to eq('text/plain')
+    end
+  end
+
+  describe '.cache_timeout' do
+    it 'round-trips through the response cache director' do
+      original = SiteController.cache_timeout
+      SiteController.cache_timeout = 5.minutes
+      expect(SiteController.cache_timeout).to eq(5.minutes)
+    ensure
+      SiteController.cache_timeout = original
+    end
+  end
+end

data/spec/dummy/bin/rails

@@ -1,4 +1,4 @@
 #!/usr/bin/env ruby
-APP_PATH = File.expand_path('../../config/application', __FILE__)
-require_relative '../config/boot'
-require 'rails/commands'
+APP_PATH = File.expand_path("../config/application", __dir__)
+require_relative "../config/boot"
+require "rails/commands"

data/spec/dummy/bin/rake

@@ -1,4 +1,4 @@
 #!/usr/bin/env ruby
-require_relative '../config/boot'
-require 'rake'
+require_relative "../config/boot"
+require "rake"
 Rake.application.run

data/spec/dummy/bin/setup

@@ -1,29 +1,37 @@
 #!/usr/bin/env ruby
-require 'pathname'
+require "fileutils"
 
-# path to your application root.
-APP_ROOT = Pathname.new File.expand_path('../../',  __FILE__)
+APP_ROOT = File.expand_path("..", __dir__)
+APP_NAME = "trusty-cms"
 
-Dir.chdir APP_ROOT do
-  # This script is a starting point to setup your application.
-  # Add necessary setup steps to this file:
+def system!(*args)
+  system(*args, exception: true)
+end
+
+FileUtils.chdir APP_ROOT do
+  # This script is a way to set up or update your development environment automatically.
+  # This script is idempotent, so that you can run it at any time and get an expectable outcome.
+  # Add necessary setup steps to this file.
 
   puts "== Installing dependencies =="
-  system "gem install bundler --conservative"
-  system "bundle check || bundle install"
+  system! "gem install bundler --conservative"
+  system("bundle check") || system!("bundle install")
 
   # puts "\n== Copying sample files =="
   # unless File.exist?("config/database.yml")
-  #   system "cp config/database.yml.sample config/database.yml"
+  #   FileUtils.cp "config/database.yml.sample", "config/database.yml"
   # end
 
   puts "\n== Preparing database =="
-  system "bin/rake db:setup"
+  system! "bin/rails db:prepare"
 
   puts "\n== Removing old logs and tempfiles =="
-  system "rm -f log/*"
-  system "rm -rf tmp/cache"
+  system! "bin/rails log:clear tmp:clear"
 
   puts "\n== Restarting application server =="
-  system "touch tmp/restart.txt"
+  system! "bin/rails restart"
+
+  # puts "\n== Configuring puma-dev =="
+  # system "ln -nfs #{APP_ROOT} ~/.puma-dev/#{APP_NAME}"
+  # system "curl -Is https://#{APP_NAME}.test/up | head -n 1"
 end

data/spec/dummy/config/boot.rb

@@ -2,4 +2,4 @@
 ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../../../Gemfile', __FILE__)
 
 require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])
-#$LOAD_PATH.unshift File.expand_path('../../../../lib', __FILE__)
+#$LOAD_PATH.unshift File.expand_path('../../../../lib', __FILE__)

data/spec/dummy/config/cable.yml

@@ -0,0 +1,10 @@
+development:
+  adapter: async
+
+test:
+  adapter: test
+
+production:
+  adapter: redis
+  url: <%= ENV.fetch("REDIS_URL") { "redis://localhost:6379/1" } %>
+  channel_prefix: trusty_cms_production

data/spec/dummy/config/initializers/content_security_policy.rb

@@ -0,0 +1,25 @@
+# Be sure to restart your server when you modify this file.
+
+# Define an application-wide content security policy.
+# See the Securing Rails Applications Guide for more information:
+# https://guides.rubyonrails.org/security.html#content-security-policy-header
+
+# Rails.application.configure do
+#   config.content_security_policy do |policy|
+#     policy.default_src :self, :https
+#     policy.font_src    :self, :https, :data
+#     policy.img_src     :self, :https, :data
+#     policy.object_src  :none
+#     policy.script_src  :self, :https
+#     policy.style_src   :self, :https
+#     # Specify URI for violation reports
+#     # policy.report_uri "/csp-violation-report-endpoint"
+#   end
+#
+#   # Generate session nonces for permitted importmap, inline scripts, and inline styles.
+#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+#   config.content_security_policy_nonce_directives = %w(script-src style-src)
+#
+#   # Report violations without enforcing the policy.
+#   # config.content_security_policy_report_only = true
+# end