trusty-cms 7.1.3 → 7.2

data/spec/controllers/admin/pages_controller_spec.rb

@@ -0,0 +1,162 @@
+require 'spec_helper'
+
+# Exercises Admin::PagesController — the most heavily customized ResourceController
+# subclass (search, restore, per-site edit guards, meta-row setup, ordering).
+# Controller specs (views not rendered) let us drive the actions and their many
+# private helpers without the asset-pipeline-heavy admin HTML layout. This is the
+# highest-blast-radius controller in the app, so keep it green across the Rails 8 bump.
+RSpec.describe Admin::PagesController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:admin) { create(:admin) }
+  let!(:home) { create(:home, title: 'Home') }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(admin)
+    # #current_site / Page.current_site / Page.homepage come from the multi-site
+    # extension, which isn't loaded in the dummy app; stub the touch points.
+    allow(Page).to receive(:current_site).and_return(nil)
+    allow(Page).to receive(:homepage).and_return(home)
+  end
+
+  describe 'GET #index' do
+    it 'succeeds and sets up the site/homepage/search' do
+      get :index
+      expect(response).to have_http_status(:ok)
+      expect(controller.instance_variable_get(:@homepage)).to eq(home)
+    end
+  end
+
+  describe 'GET #new' do
+    it 'builds a new page with defaults' do
+      get :new
+      expect(response).to have_http_status(:ok)
+      page = controller.instance_variable_get(:@page)
+      expect(page).to be_a(Page).and be_new_record
+    end
+
+    it 'roots a top-level page at "/" when no parent is given' do
+      get :new
+      expect(controller.instance_variable_get(:@page).slug).to eq('/')
+    end
+
+    it 'sets the parent_id from page_id' do
+      get :new, params: { page_id: home.id }
+      expect(controller.instance_variable_get(:@page).parent_id).to eq(home.id)
+    end
+  end
+
+  describe 'GET #edit' do
+    context 'when the page belongs to a site the admin can access' do
+      let(:site) { create(:site) }
+      let(:page) { create(:page, title: 'Editable', parent: home, site_id: site.id) }
+
+      before { admin.sites << site }
+
+      it 'succeeds and loads edit assigns' do
+        get :edit, params: { id: page.id }
+
+        expect(response).to have_http_status(:ok)
+        expect(controller.instance_variable_get(:@page)).to eq(page)
+        expect(controller.instance_variable_get(:@page_url)).to be_present
+      end
+    end
+
+    context 'when the page belongs to a site the admin cannot access' do
+      let(:site) { create(:site) }
+      let(:page) { create(:page, title: 'Forbidden', parent: home, site_id: site.id) }
+
+      it 'redirects back to the pages index' do
+        get :edit, params: { id: page.id }
+        expect(response).to redirect_to(admin_pages_url)
+      end
+    end
+  end
+
+  describe 'POST #create' do
+    it 'creates a page and redirects' do
+      expect {
+        post :create, params: { page: { title: 'Fresh', slug: 'fresh', breadcrumb: 'Fresh', parent_id: home.id } }
+      }.to change(Page, :count).by(1)
+
+      expect(response).to be_redirect
+    end
+
+    it 're-renders new via the rescue_from validation_error handler when invalid' do
+      expect {
+        post :create, params: { page: { title: '', slug: '', breadcrumb: '', parent_id: home.id } }
+      }.not_to change(Page, :count)
+
+      expect(flash[:error]).to be_present
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates the page and redirects' do
+      page = create(:page, title: 'Before', parent: home)
+
+      put :update, params: { id: page.id, page: { title: 'After' } }
+
+      expect(response).to be_redirect
+      expect(page.reload.title).to eq('After')
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    it 'destroys the page and counts descendants' do
+      page = create(:page, title: 'Doomed', parent: home)
+
+      expect {
+        delete :destroy, params: { id: page.id }
+      }.to change(Page, :count).by(-1)
+
+      expect(response).to be_redirect
+    end
+  end
+
+  describe 'GET #search' do
+    it 'returns matching pages when a query is present' do
+      create(:page, title: 'Findable', slug: 'findable', parent: home)
+
+      get :search, params: { site_id: nil, search: { query: 'Findable' } }
+
+      expect(response).to have_http_status(:ok)
+      titles = controller.instance_variable_get(:@pages).map(&:title)
+      expect(titles).to include('Findable')
+    end
+
+    it 'does not run a query when none is given' do
+      get :search, params: { site_id: '' }
+      expect(controller.instance_variable_get(:@pages)).to be_nil
+    end
+  end
+
+  describe 'POST #save_table_position' do
+    it 'saves the new order and returns ok' do
+      allow(Page).to receive(:save_order)
+      post :save_table_position, params: { new_position: %w[1 2 3] }
+      expect(response).to have_http_status(:ok)
+      expect(Page).to have_received(:save_order).with(%w[1 2 3])
+    end
+  end
+
+  describe 'PUT #restore' do
+    # NOTE: latent bug / Rails 8 upgrade blocker — restore_page_version calls
+    # PaperTrail's `reify`, which YAML-loads the stored version. Under Psych 4+
+    # (psych 5.4 is pinned) safe-loading rejects ActiveSupport::TimeWithZone
+    # because no permitted classes are configured, so restoring any page that has
+    # a timestamp in its versioned state raises Psych::DisallowedClass. Page
+    # restore is effectively broken until paper_trail's serializer is configured
+    # with permitted classes (e.g. via ActiveRecord::Base.yaml_column_permitted_classes
+    # or a custom serializer). Characterizing current behavior.
+    it 'currently fails to reify a versioned page (Psych safe-load blocker)' do
+      page = create(:page, title: 'V1', parent: home)
+      PaperTrail.request(whodunnit: admin.id.to_s) { page.update!(title: 'V2') }
+
+      expect {
+        put :restore, params: { id: page.id, version_index: 1 }
+      }.to raise_error(Psych::DisallowedClass, /TimeWithZone/)
+    end
+  end
+end

data/spec/controllers/admin/preferences_controller_spec.rb

@@ -0,0 +1,44 @@
+require 'spec_helper'
+
+# Exercises Admin::PreferencesController, which lets the current user edit their
+# own profile/preferences. Simple ApplicationController subclass; covers the
+# show/edit render paths and the valid/invalid update branches.
+RSpec.describe Admin::PreferencesController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:admin) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(admin)
+  end
+
+  describe 'GET #show' do
+    it 'succeeds' do
+      get :show
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #edit' do
+    it 'succeeds' do
+      get :edit
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates the current user and redirects to configuration' do
+      put :update, params: { user: { first_name: 'Preferred' } }
+
+      expect(response).to redirect_to(admin_configuration_path)
+      expect(admin.reload.first_name).to eq('Preferred')
+    end
+
+    it 're-renders edit with an error when the update is invalid' do
+      put :update, params: { user: { email: 'not-an-email' } }
+
+      expect(flash[:error]).to be_present
+    end
+  end
+end

data/spec/controllers/admin/security_controller_spec.rb

@@ -0,0 +1,85 @@
+require 'spec_helper'
+
+# Exercises Admin::SecurityController — password changes and TOTP two-factor
+# enable/disable/verify for the current user. Touches devise-two-factor and QR
+# provisioning, both plausible upgrade casualties.
+RSpec.describe Admin::SecurityController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:user) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(user)
+    # sign_out/sign_in need Warden wiring we don't set up here; the auth side
+    # effect isn't what these specs are checking.
+    allow(controller).to receive(:sign_out)
+  end
+
+  describe 'GET #show' do
+    it 'generates an OTP secret and QR provisioning data' do
+      expect(user.otp_secret).to be_blank
+
+      get :show
+
+      expect(response).to have_http_status(:ok)
+      expect(user.reload.otp_secret).to be_present
+      expect(controller.instance_variable_get(:@qr_png_data)).to start_with('data:image/png')
+    end
+  end
+
+  describe 'GET #edit' do
+    it 'succeeds' do
+      get :edit
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates the password, signs out, and redirects to sign-in' do
+      put :update, params: { user: { password: 'NewComplex1!', password_confirmation: 'NewComplex1!' } }
+
+      expect(controller).to have_received(:sign_out).with(user)
+      expect(response).to redirect_to(new_user_session_path)
+    end
+
+    it 're-renders edit when the password change is invalid' do
+      put :update, params: { user: { password: 'x', password_confirmation: 'y' } }
+
+      expect(flash[:error]).to be_present
+    end
+  end
+
+  describe 'POST #verify_two_factor' do
+    it 'enables 2FA when the OTP is valid' do
+      allow(user).to receive(:validate_and_consume_otp!).with('123456').and_return(true)
+
+      post :verify_two_factor, params: { otp_attempt: '123456' }
+
+      expect(user.reload.otp_required_for_login).to be(true)
+      expect(response).to redirect_to(admin_security_path)
+    end
+
+    it 'reports an error when the OTP is invalid' do
+      allow(user).to receive(:validate_and_consume_otp!).and_return(false)
+
+      post :verify_two_factor, params: { otp_attempt: 'bad' }
+
+      expect(flash[:error]).to be_present
+      expect(response).to redirect_to(admin_security_path)
+    end
+  end
+
+  describe 'POST #disable_two_factor' do
+    it 'clears the OTP settings and redirects' do
+      user.update!(otp_required_for_login: true, otp_secret: User.generate_otp_secret)
+
+      post :disable_two_factor
+
+      user.reload
+      expect(user.otp_required_for_login).to be(false)
+      expect(user.otp_secret).to be_nil
+      expect(response).to redirect_to(admin_security_path)
+    end
+  end
+end

data/spec/controllers/admin/sessions_controller_spec.rb

@@ -0,0 +1,56 @@
+require 'spec_helper'
+
+# Exercises Admin::SessionsController#create — the custom login flow that
+# branches into the two-factor handoff for OTP-enabled users. Overriding a
+# Devise controller is exactly the sort of thing that can break across a Devise
+# major, so pin the three branches (2FA, plain sign-in, bad credentials).
+RSpec.describe Admin::SessionsController, type: :controller do
+  routes { TrustyCms::Application.routes }
+  include Devise::Test::ControllerHelpers
+
+  let(:password) { 'ComplexPass1!' }
+
+  before do
+    request.env['devise.mapping'] = Devise.mappings[:user]
+    # sign_in needs Warden wiring that isn't the focus here.
+    allow(controller).to receive(:sign_in)
+  end
+
+  describe 'POST #create' do
+    it 'signs in a valid non-2FA user and redirects' do
+      user = create(:admin, password: password)
+
+      post :create, params: { user: { email: user.email, password: password } }
+
+      expect(controller).to have_received(:sign_in).with(:user, user)
+      expect(response).to redirect_to(admin_pages_path)
+    end
+
+    it 'starts the 2FA handoff for an OTP-enabled user' do
+      user = create(:admin, password: password, otp_required_for_login: true)
+
+      post :create, params: { user: { email: user.email, password: password } }
+
+      expect(response).to redirect_to(admin_two_factor_path)
+      expect(session[:pre_2fa_user_id]).to eq(user.id)
+      expect(session[:pre_2fa_started_at]).to be_present
+      expect(controller).not_to have_received(:sign_in)
+    end
+
+    it 're-renders the sign-in form on bad credentials' do
+      user = create(:admin, password: password)
+
+      post :create, params: { user: { email: user.email, password: 'wrong' } }
+
+      expect(controller).not_to have_received(:sign_in)
+      expect(flash.now[:alert]).to be_present
+    end
+
+    it 're-renders the sign-in form for an unknown email' do
+      post :create, params: { user: { email: 'nobody@example.com', password: password } }
+
+      expect(controller).not_to have_received(:sign_in)
+      expect(flash.now[:alert]).to be_present
+    end
+  end
+end

data/spec/controllers/admin/two_factor_controller_spec.rb

@@ -0,0 +1,63 @@
+require 'spec_helper'
+
+# Exercises Admin::TwoFactorController — the mid-login TOTP challenge. It runs
+# BEFORE the user is fully signed in (authenticate_user! is skipped) and drives
+# the flow off a short-lived session handoff (:pre_2fa_user_id / :started_at).
+RSpec.describe Admin::TwoFactorController, type: :controller do
+  routes { TrustyCms::Application.routes }
+  # current_user is read via Devise even though authenticate_user! is skipped.
+  include Devise::Test::ControllerHelpers
+
+  let(:user) { create(:admin, otp_required_for_login: true) }
+
+  # Put the user mid-2FA: pending id in the session, started just now.
+  def begin_2fa!(started_at: Time.current.to_i)
+    session[:pre_2fa_user_id] = user.id
+    session[:pre_2fa_started_at] = started_at
+  end
+
+  before { allow(controller).to receive(:sign_in) }
+
+  describe 'GET #show' do
+    it 'renders the challenge for a user mid-2FA' do
+      begin_2fa!
+      get :show
+      expect(response).to have_http_status(:ok)
+    end
+
+    it 'redirects to sign-in when there is no pending 2FA session' do
+      get :show
+      expect(response).to redirect_to(new_user_session_path)
+      expect(flash[:alert]).to be_present
+    end
+
+    it 'redirects to sign-in when the 2FA session has expired' do
+      begin_2fa!(started_at: 10.minutes.ago.to_i)
+      get :show
+      expect(response).to redirect_to(new_user_session_path)
+    end
+  end
+
+  describe 'POST #create' do
+    before { begin_2fa! }
+
+    it 'signs the user in and clears the handoff when the code is valid' do
+      allow_any_instance_of(User).to receive(:validate_and_consume_otp!).with('123456').and_return(true)
+
+      post :create, params: { otp_attempt: '123456' }
+
+      expect(controller).to have_received(:sign_in).with(:user, an_instance_of(User))
+      expect(response).to redirect_to(admin_pages_path)
+      expect(session[:pre_2fa_user_id]).to be_nil
+    end
+
+    it 'resets the session and redirects when the code is invalid' do
+      allow_any_instance_of(User).to receive(:validate_and_consume_otp!).and_return(false)
+
+      post :create, params: { otp_attempt: 'wrong' }
+
+      expect(response).to redirect_to(new_user_session_path)
+      expect(flash[:alert]).to be_present
+    end
+  end
+end

data/spec/controllers/admin/users_controller_spec.rb

@@ -0,0 +1,132 @@
+require 'spec_helper'
+
+# Exercises Admin::UsersController, which layers admin-only authorization and
+# several custom overrides (create/update/destroy/disable_2fa, plus the
+# self-protection guards) on top of ResourceController. Devise/2FA touch points
+# make this a useful regression net for a Rails/Ruby upgrade.
+RSpec.describe Admin::UsersController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:admin) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(admin)
+  end
+
+  def valid_user_params(overrides = {})
+    {
+      first_name: 'New',
+      last_name: 'Person',
+      email: 'newperson@example.com',
+      password: 'ComplexPass1!',
+      password_confirmation: 'ComplexPass1!',
+    }.merge(overrides)
+  end
+
+  describe 'GET #index' do
+    it 'succeeds for an admin' do
+      get :index
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #new' do
+    it 'succeeds' do
+      get :new
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #show' do
+    it 'redirects to the edit page' do
+      user = create(:user, email: 'showme@example.com')
+      get :show, params: { id: user.id }
+      expect(response).to redirect_to(edit_admin_user_path(user.id))
+    end
+  end
+
+  describe 'POST #create' do
+    it 'creates a user and redirects with a notice' do
+      expect {
+        post :create, params: { user: valid_user_params }
+      }.to change(User, :count).by(1)
+
+      expect(response).to redirect_to(admin_users_path)
+      expect(flash[:notice]).to eq('User was created.')
+    end
+
+    it 're-renders new with an error when the user is invalid' do
+      expect {
+        post :create, params: { user: valid_user_params(email: '') }
+      }.not_to change(User, :count)
+
+      expect(flash[:error]).to match(/error saving the user/)
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates an existing user and redirects' do
+      user = create(:user, email: 'editme@example.com')
+
+      put :update, params: { id: user.id, user: { first_name: 'Renamed' } }
+
+      expect(response).to be_redirect
+      expect(user.reload.first_name).to eq('Renamed')
+    end
+
+    # NOTE: latent bug — the guard compares `user_params['admin'] == false`, but
+    # over a real HTTP request the checkbox param arrives as the string 'false',
+    # which is != false. So through the normal request path an admin CAN demote
+    # themselves and no warning is shown. Characterizing current behavior;
+    # revisit if the guard is ever fixed to coerce the param.
+    it 'does NOT block self-demotion when admin arrives as the string "false" (bug)' do
+      put :update, params: { id: admin.id, user: { admin: 'false' } }
+
+      expect(admin.reload.admin).to be(false)
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    it 'destroys another user' do
+      user = create(:user, email: 'goner@example.com')
+
+      expect {
+        delete :destroy, params: { id: user.id }
+      }.to change(User, :count).by(-1)
+    end
+
+    it 'refuses to let a user delete themselves' do
+      expect {
+        delete :destroy, params: { id: admin.id }
+      }.not_to change(User, :count)
+
+      expect(response).to redirect_to(admin_users_path)
+      expect(flash[:error]).to be_present
+    end
+  end
+
+  describe 'PATCH #disable_2fa' do
+    it 'clears the OTP settings and redirects' do
+      user = create(:user, email: '2fa@example.com', otp_required_for_login: true)
+
+      patch :disable_2fa, params: { id: user.id }
+
+      user.reload
+      expect(user.otp_required_for_login).to be(false)
+      expect(user.otp_secret).to be_nil
+      expect(response).to redirect_to(admin_users_path)
+    end
+  end
+
+  describe 'authorization' do
+    it 'denies a non-admin user' do
+      allow(controller).to receive(:current_user).and_return(create(:non_admin, email: 'plain@example.com'))
+
+      get :index
+
+      expect(response).to be_redirect
+      expect(flash[:error]).to be_present
+    end
+  end
+end

data/spec/controllers/page_status_controller_spec.rb

@@ -0,0 +1,66 @@
+require 'spec_helper'
+
+# Exercises PageStatusController#refresh — a token-authenticated, no-CSRF JSON
+# endpoint that publishes scheduled pages whose time has come. Auth is a bearer
+# token compared with secure_compare; cover the reject paths and the publish
+# behaviour.
+RSpec.describe PageStatusController, type: :controller do
+  routes { TrustyCms::Application.routes }
+  # refresh skips authenticate_user!, but ApplicationController before-actions
+  # still read current_user, which needs Warden injected on the request.
+  include Devise::Test::ControllerHelpers
+
+  let(:token) { 'secret-bearer-token' }
+
+  def authorize!(value = token)
+    request.headers['Authorization'] = "Bearer #{value}"
+  end
+
+  before do
+    allow(Rails.application.credentials).to receive(:dig)
+      .with(:trusty_cms, :page_status_bearer_token).and_return(token)
+  end
+
+  describe 'POST #refresh authentication' do
+    it 'returns 401 when no token is provided' do
+      post :refresh
+      expect(response).to have_http_status(:unauthorized)
+      expect(JSON.parse(response.body)['error']).to eq('Missing Bearer Token')
+    end
+
+    it 'returns 401 when the token is wrong' do
+      authorize!('nope')
+      post :refresh
+      expect(response).to have_http_status(:unauthorized)
+      expect(JSON.parse(response.body)['error']).to eq('Invalid Bearer Token')
+    end
+  end
+
+  describe 'POST #refresh' do
+    before { authorize! }
+
+    it 'publishes scheduled pages whose publish time has passed' do
+      due = create(:page, title: 'Due', slug: 'due', status_id: Status[:scheduled].id,
+                          published_at: 1.day.ago)
+
+      post :refresh
+
+      expect(response).to have_http_status(:ok)
+      body = JSON.parse(response.body)
+      expect(body['updated_page_ids']).to include(due.id)
+      expect(due.reload.status_id).to eq(Status[:published].id)
+    end
+
+    it 'leaves future-scheduled pages alone' do
+      future = create(:page, title: 'Future', slug: 'future', status_id: Status[:scheduled].id,
+                             published_at: 1.day.from_now)
+
+      post :refresh
+
+      body = JSON.parse(response.body)
+      expect(body['remaining_scheduled_page_ids']).to include(future.id)
+      expect(body['message']).to match(/No scheduled pages/)
+      expect(future.reload.status_id).to eq(Status[:scheduled].id)
+    end
+  end
+end

data/spec/dummy/bin/rails

@@ -1,4 +1,4 @@
 #!/usr/bin/env ruby
-APP_PATH = File.expand_path('../../config/application', __FILE__)
-require_relative '../config/boot'
-require 'rails/commands'
+APP_PATH = File.expand_path("../config/application", __dir__)
+require_relative "../config/boot"
+require "rails/commands"

data/spec/dummy/bin/rake

@@ -1,4 +1,4 @@
 #!/usr/bin/env ruby
-require_relative '../config/boot'
-require 'rake'
+require_relative "../config/boot"
+require "rake"
 Rake.application.run

data/spec/dummy/bin/setup

@@ -1,29 +1,37 @@
 #!/usr/bin/env ruby
-require 'pathname'
+require "fileutils"
 
-# path to your application root.
-APP_ROOT = Pathname.new File.expand_path('../../',  __FILE__)
+APP_ROOT = File.expand_path("..", __dir__)
+APP_NAME = "trusty-cms"
 
-Dir.chdir APP_ROOT do
-  # This script is a starting point to setup your application.
-  # Add necessary setup steps to this file:
+def system!(*args)
+  system(*args, exception: true)
+end
+
+FileUtils.chdir APP_ROOT do
+  # This script is a way to set up or update your development environment automatically.
+  # This script is idempotent, so that you can run it at any time and get an expectable outcome.
+  # Add necessary setup steps to this file.
 
   puts "== Installing dependencies =="
-  system "gem install bundler --conservative"
-  system "bundle check || bundle install"
+  system! "gem install bundler --conservative"
+  system("bundle check") || system!("bundle install")
 
   # puts "\n== Copying sample files =="
   # unless File.exist?("config/database.yml")
-  #   system "cp config/database.yml.sample config/database.yml"
+  #   FileUtils.cp "config/database.yml.sample", "config/database.yml"
   # end
 
   puts "\n== Preparing database =="
-  system "bin/rake db:setup"
+  system! "bin/rails db:prepare"
 
   puts "\n== Removing old logs and tempfiles =="
-  system "rm -f log/*"
-  system "rm -rf tmp/cache"
+  system! "bin/rails log:clear tmp:clear"
 
   puts "\n== Restarting application server =="
-  system "touch tmp/restart.txt"
+  system! "bin/rails restart"
+
+  # puts "\n== Configuring puma-dev =="
+  # system "ln -nfs #{APP_ROOT} ~/.puma-dev/#{APP_NAME}"
+  # system "curl -Is https://#{APP_NAME}.test/up | head -n 1"
 end

data/spec/dummy/config/boot.rb

@@ -2,4 +2,4 @@
 ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../../../Gemfile', __FILE__)
 
 require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])
-#$LOAD_PATH.unshift File.expand_path('../../../../lib', __FILE__)
+#$LOAD_PATH.unshift File.expand_path('../../../../lib', __FILE__)