trusty-cms 7.1.3 → 8.0

data/spec/controllers/admin/users_controller_spec.rb

@@ -0,0 +1,132 @@
+require 'spec_helper'
+
+# Exercises Admin::UsersController, which layers admin-only authorization and
+# several custom overrides (create/update/destroy/disable_2fa, plus the
+# self-protection guards) on top of ResourceController. Devise/2FA touch points
+# make this a useful regression net for a Rails/Ruby upgrade.
+RSpec.describe Admin::UsersController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:admin) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(admin)
+  end
+
+  def valid_user_params(overrides = {})
+    {
+      first_name: 'New',
+      last_name: 'Person',
+      email: 'newperson@example.com',
+      password: 'ComplexPass1!',
+      password_confirmation: 'ComplexPass1!',
+    }.merge(overrides)
+  end
+
+  describe 'GET #index' do
+    it 'succeeds for an admin' do
+      get :index
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #new' do
+    it 'succeeds' do
+      get :new
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #show' do
+    it 'redirects to the edit page' do
+      user = create(:user, email: 'showme@example.com')
+      get :show, params: { id: user.id }
+      expect(response).to redirect_to(edit_admin_user_path(user.id))
+    end
+  end
+
+  describe 'POST #create' do
+    it 'creates a user and redirects with a notice' do
+      expect {
+        post :create, params: { user: valid_user_params }
+      }.to change(User, :count).by(1)
+
+      expect(response).to redirect_to(admin_users_path)
+      expect(flash[:notice]).to eq('User was created.')
+    end
+
+    it 're-renders new with an error when the user is invalid' do
+      expect {
+        post :create, params: { user: valid_user_params(email: '') }
+      }.not_to change(User, :count)
+
+      expect(flash[:error]).to match(/error saving the user/)
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates an existing user and redirects' do
+      user = create(:user, email: 'editme@example.com')
+
+      put :update, params: { id: user.id, user: { first_name: 'Renamed' } }
+
+      expect(response).to be_redirect
+      expect(user.reload.first_name).to eq('Renamed')
+    end
+
+    # NOTE: latent bug — the guard compares `user_params['admin'] == false`, but
+    # over a real HTTP request the checkbox param arrives as the string 'false',
+    # which is != false. So through the normal request path an admin CAN demote
+    # themselves and no warning is shown. Characterizing current behavior;
+    # revisit if the guard is ever fixed to coerce the param.
+    it 'does NOT block self-demotion when admin arrives as the string "false" (bug)' do
+      put :update, params: { id: admin.id, user: { admin: 'false' } }
+
+      expect(admin.reload.admin).to be(false)
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    it 'destroys another user' do
+      user = create(:user, email: 'goner@example.com')
+
+      expect {
+        delete :destroy, params: { id: user.id }
+      }.to change(User, :count).by(-1)
+    end
+
+    it 'refuses to let a user delete themselves' do
+      expect {
+        delete :destroy, params: { id: admin.id }
+      }.not_to change(User, :count)
+
+      expect(response).to redirect_to(admin_users_path)
+      expect(flash[:error]).to be_present
+    end
+  end
+
+  describe 'PATCH #disable_2fa' do
+    it 'clears the OTP settings and redirects' do
+      user = create(:user, email: '2fa@example.com', otp_required_for_login: true)
+
+      patch :disable_2fa, params: { id: user.id }
+
+      user.reload
+      expect(user.otp_required_for_login).to be(false)
+      expect(user.otp_secret).to be_nil
+      expect(response).to redirect_to(admin_users_path)
+    end
+  end
+
+  describe 'authorization' do
+    it 'denies a non-admin user' do
+      allow(controller).to receive(:current_user).and_return(create(:non_admin, email: 'plain@example.com'))
+
+      get :index
+
+      expect(response).to be_redirect
+      expect(flash[:error]).to be_present
+    end
+  end
+end

data/spec/controllers/page_status_controller_spec.rb

@@ -0,0 +1,66 @@
+require 'spec_helper'
+
+# Exercises PageStatusController#refresh — a token-authenticated, no-CSRF JSON
+# endpoint that publishes scheduled pages whose time has come. Auth is a bearer
+# token compared with secure_compare; cover the reject paths and the publish
+# behaviour.
+RSpec.describe PageStatusController, type: :controller do
+  routes { TrustyCms::Application.routes }
+  # refresh skips authenticate_user!, but ApplicationController before-actions
+  # still read current_user, which needs Warden injected on the request.
+  include Devise::Test::ControllerHelpers
+
+  let(:token) { 'secret-bearer-token' }
+
+  def authorize!(value = token)
+    request.headers['Authorization'] = "Bearer #{value}"
+  end
+
+  before do
+    allow(Rails.application.credentials).to receive(:dig)
+      .with(:trusty_cms, :page_status_bearer_token).and_return(token)
+  end
+
+  describe 'POST #refresh authentication' do
+    it 'returns 401 when no token is provided' do
+      post :refresh
+      expect(response).to have_http_status(:unauthorized)
+      expect(JSON.parse(response.body)['error']).to eq('Missing Bearer Token')
+    end
+
+    it 'returns 401 when the token is wrong' do
+      authorize!('nope')
+      post :refresh
+      expect(response).to have_http_status(:unauthorized)
+      expect(JSON.parse(response.body)['error']).to eq('Invalid Bearer Token')
+    end
+  end
+
+  describe 'POST #refresh' do
+    before { authorize! }
+
+    it 'publishes scheduled pages whose publish time has passed' do
+      due = create(:page, title: 'Due', slug: 'due', status_id: Status[:scheduled].id,
+                          published_at: 1.day.ago)
+
+      post :refresh
+
+      expect(response).to have_http_status(:ok)
+      body = JSON.parse(response.body)
+      expect(body['updated_page_ids']).to include(due.id)
+      expect(due.reload.status_id).to eq(Status[:published].id)
+    end
+
+    it 'leaves future-scheduled pages alone' do
+      future = create(:page, title: 'Future', slug: 'future', status_id: Status[:scheduled].id,
+                             published_at: 1.day.from_now)
+
+      post :refresh
+
+      body = JSON.parse(response.body)
+      expect(body['remaining_scheduled_page_ids']).to include(future.id)
+      expect(body['message']).to match(/No scheduled pages/)
+      expect(future.reload.status_id).to eq(Status[:scheduled].id)
+    end
+  end
+end

data/spec/dummy/bin/rails

@@ -1,4 +1,4 @@
 #!/usr/bin/env ruby
-APP_PATH = File.expand_path('../../config/application', __FILE__)
-require_relative '../config/boot'
-require 'rails/commands'
+APP_PATH = File.expand_path("../config/application", __dir__)
+require_relative "../config/boot"
+require "rails/commands"

data/spec/dummy/bin/rake

@@ -1,4 +1,4 @@
 #!/usr/bin/env ruby
-require_relative '../config/boot'
-require 'rake'
+require_relative "../config/boot"
+require "rake"
 Rake.application.run

data/spec/dummy/bin/setup

@@ -1,29 +1,37 @@
 #!/usr/bin/env ruby
-require 'pathname'
+require "fileutils"
 
-# path to your application root.
-APP_ROOT = Pathname.new File.expand_path('../../',  __FILE__)
+APP_ROOT = File.expand_path("..", __dir__)
+APP_NAME = "trusty-cms"
 
-Dir.chdir APP_ROOT do
-  # This script is a starting point to setup your application.
-  # Add necessary setup steps to this file:
+def system!(*args)
+  system(*args, exception: true)
+end
+
+FileUtils.chdir APP_ROOT do
+  # This script is a way to set up or update your development environment automatically.
+  # This script is idempotent, so that you can run it at any time and get an expectable outcome.
+  # Add necessary setup steps to this file.
 
   puts "== Installing dependencies =="
-  system "gem install bundler --conservative"
-  system "bundle check || bundle install"
+  system! "gem install bundler --conservative"
+  system("bundle check") || system!("bundle install")
 
   # puts "\n== Copying sample files =="
   # unless File.exist?("config/database.yml")
-  #   system "cp config/database.yml.sample config/database.yml"
+  #   FileUtils.cp "config/database.yml.sample", "config/database.yml"
   # end
 
   puts "\n== Preparing database =="
-  system "bin/rake db:setup"
+  system! "bin/rails db:prepare"
 
   puts "\n== Removing old logs and tempfiles =="
-  system "rm -f log/*"
-  system "rm -rf tmp/cache"
+  system! "bin/rails log:clear tmp:clear"
 
   puts "\n== Restarting application server =="
-  system "touch tmp/restart.txt"
+  system! "bin/rails restart"
+
+  # puts "\n== Configuring puma-dev =="
+  # system "ln -nfs #{APP_ROOT} ~/.puma-dev/#{APP_NAME}"
+  # system "curl -Is https://#{APP_NAME}.test/up | head -n 1"
 end

data/spec/dummy/config/application.rb

@@ -41,6 +41,8 @@ module TrustyCms
 
     config.encoding = 'utf-8'
     config.time_zone = 'UTC'
+    # Rails 8.1 will make `to_time` always preserve the receiver's timezone.
+    config.active_support.to_time_preserves_timezone = :zone
     # Skip frameworks you're not going to use (only works if using vendor/rails).
     # To use Rails without a database, you must remove the Active Record framework
     # config.frameworks -= [ :action_mailer ]

data/spec/dummy/config/boot.rb

@@ -2,4 +2,4 @@
 ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../../../Gemfile', __FILE__)
 
 require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])
-#$LOAD_PATH.unshift File.expand_path('../../../../lib', __FILE__)
+#$LOAD_PATH.unshift File.expand_path('../../../../lib', __FILE__)

data/spec/dummy/config/cable.yml

@@ -0,0 +1,10 @@
+development:
+  adapter: async
+
+test:
+  adapter: test
+
+production:
+  adapter: redis
+  url: <%= ENV.fetch("REDIS_URL") { "redis://localhost:6379/1" } %>
+  channel_prefix: trusty_cms_production

data/spec/dummy/config/initializers/content_security_policy.rb

@@ -0,0 +1,25 @@
+# Be sure to restart your server when you modify this file.
+
+# Define an application-wide content security policy.
+# See the Securing Rails Applications Guide for more information:
+# https://guides.rubyonrails.org/security.html#content-security-policy-header
+
+# Rails.application.configure do
+#   config.content_security_policy do |policy|
+#     policy.default_src :self, :https
+#     policy.font_src    :self, :https, :data
+#     policy.img_src     :self, :https, :data
+#     policy.object_src  :none
+#     policy.script_src  :self, :https
+#     policy.style_src   :self, :https
+#     # Specify URI for violation reports
+#     # policy.report_uri "/csp-violation-report-endpoint"
+#   end
+#
+#   # Generate session nonces for permitted importmap, inline scripts, and inline styles.
+#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+#   config.content_security_policy_nonce_directives = %w(script-src style-src)
+#
+#   # Report violations without enforcing the policy.
+#   # config.content_security_policy_report_only = true
+# end

data/spec/dummy/config/initializers/filter_parameter_logging.rb

@@ -1,4 +1,8 @@
 # Be sure to restart your server when you modify this file.
 
-# Configure sensitive parameters which will be filtered from the log file.
-Rails.application.config.filter_parameters += [:password]
+# Configure parameters to be partially matched (e.g. passw matches password) and filtered from the log file.
+# Use this to limit dissemination of sensitive information.
+# See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
+Rails.application.config.filter_parameters += [
+  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn
+]

data/spec/dummy/config/initializers/inflections.rb

@@ -4,13 +4,13 @@
 # are locale specific, and you may define rules for as many different
 # locales as you wish. All of these examples are active by default:
 # ActiveSupport::Inflector.inflections(:en) do |inflect|
-#   inflect.plural /^(ox)$/i, '\1en'
-#   inflect.singular /^(ox)en/i, '\1'
-#   inflect.irregular 'person', 'people'
+#   inflect.plural /^(ox)$/i, "\\1en"
+#   inflect.singular /^(ox)en/i, "\\1"
+#   inflect.irregular "person", "people"
 #   inflect.uncountable %w( fish sheep )
 # end
 
 # These inflection rules are supported but not enabled by default:
 # ActiveSupport::Inflector.inflections(:en) do |inflect|
-#   inflect.acronym 'RESTful'
+#   inflect.acronym "RESTful"
 # end

data/spec/dummy/config/initializers/new_framework_defaults_7_2.rb

@@ -0,0 +1,70 @@
+# Be sure to restart your server when you modify this file.
+#
+# This file eases your Rails 7.2 framework defaults upgrade.
+#
+# Uncomment each configuration one by one to switch to the new default.
+# Once your application is ready to run with all new defaults, you can remove
+# this file and set the `config.load_defaults` to `7.2`.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+# https://guides.rubyonrails.org/upgrading_ruby_on_rails.html
+
+###
+# Controls whether Active Job's `#perform_later` and similar methods automatically defer
+# the job queuing to after the current Active Record transaction is committed.
+#
+# Example:
+#   Topic.transaction do
+#     topic = Topic.create(...)
+#     NewTopicNotificationJob.perform_later(topic)
+#   end
+#
+# In this example, if the configuration is set to `:never`, the job will
+# be enqueued immediately, even though the `Topic` hasn't been committed yet.
+# Because of this, if the job is picked up almost immediately, or if the
+# transaction doesn't succeed for some reason, the job will fail to find this
+# topic in the database.
+#
+# If `enqueue_after_transaction_commit` is set to `:default`, the queue adapter
+# will define the behaviour.
+#
+# Note: Active Job backends can disable this feature. This is generally done by
+# backends that use the same database as Active Record as a queue, hence they
+# don't need this feature.
+#++
+# Rails.application.config.active_job.enqueue_after_transaction_commit = :default
+
+###
+# Adds image/webp to the list of content types Active Storage considers as an image
+# Prevents automatic conversion to a fallback PNG, and assumes clients support WebP, as they support gif, jpeg, and png.
+# This is possible due to broad browser support for WebP, but older browsers and email clients may still not support
+# WebP. Requires imagemagick/libvips built with WebP support.
+#++
+# Rails.application.config.active_storage.web_image_content_types = %w[image/png image/jpeg image/gif image/webp]
+
+###
+# Enable validation of migration timestamps. When set, an ActiveRecord::InvalidMigrationTimestampError
+# will be raised if the timestamp prefix for a migration is more than a day ahead of the timestamp
+# associated with the current time. This is done to prevent forward-dating of migration files, which can
+# impact migration generation and other migration commands.
+#
+# Applications with existing timestamped migrations that do not adhere to the
+# expected format can disable validation by setting this config to `false`.
+#++
+# Rails.application.config.active_record.validate_migration_timestamps = true
+
+###
+# Controls whether the PostgresqlAdapter should decode dates automatically with manual queries.
+#
+# Example:
+#   ActiveRecord::ConnectionAdapters::PostgreSQLAdapter.select_value("select '2024-01-01'::date") #=> Date
+#
+# This query used to return a `String`.
+#++
+# Rails.application.config.active_record.postgresql_adapter_decode_dates = true
+
+###
+# Enables YJIT as of Ruby 3.3, to bring sizeable performance improvements. If you are
+# deploying to a memory constrained environment you may want to set this to `false`.
+#++
+# Rails.application.config.yjit = true

data/spec/dummy/config/initializers/permissions_policy.rb

@@ -0,0 +1,13 @@
+# Be sure to restart your server when you modify this file.
+
+# Define an application-wide HTTP permissions policy. For further
+# information see: https://developers.google.com/web/updates/2018/06/feature-policy
+
+# Rails.application.config.permissions_policy do |policy|
+#   policy.camera      :none
+#   policy.gyroscope   :none
+#   policy.microphone  :none
+#   policy.usb         :none
+#   policy.fullscreen  :self
+#   policy.payment     :self, "https://secure.example.com"
+# end

data/spec/dummy/config/puma.rb

@@ -0,0 +1,34 @@
+# This configuration file will be evaluated by Puma. The top-level methods that
+# are invoked here are part of Puma's configuration DSL. For more information
+# about methods provided by the DSL, see https://puma.io/puma/Puma/DSL.html.
+
+# Puma starts a configurable number of processes (workers) and each process
+# serves each request in a thread from an internal thread pool.
+#
+# The ideal number of threads per worker depends both on how much time the
+# application spends waiting for IO operations and on how much you wish to
+# to prioritize throughput over latency.
+#
+# As a rule of thumb, increasing the number of threads will increase how much
+# traffic a given process can handle (throughput), but due to CRuby's
+# Global VM Lock (GVL) it has diminishing returns and will degrade the
+# response time (latency) of the application.
+#
+# The default is set to 3 threads as it's deemed a decent compromise between
+# throughput and latency for the average Rails application.
+#
+# Any libraries that use a connection pool or another resource pool should
+# be configured to provide at least as many connections as the number of
+# threads. This includes Active Record's `pool` parameter in `database.yml`.
+threads_count = ENV.fetch("RAILS_MAX_THREADS", 3)
+threads threads_count, threads_count
+
+# Specifies the `port` that Puma will listen on to receive requests; default is 3000.
+port ENV.fetch("PORT", 3000)
+
+# Allow puma to be restarted by `bin/rails restart` command.
+plugin :tmp_restart
+
+# Specify the PID file. Defaults to tmp/pids/server.pid in development.
+# In other environments, only set the PID file if requested.
+pidfile ENV["PIDFILE"] if ENV["PIDFILE"]

data/spec/dummy/config/storage.yml

@@ -4,4 +4,31 @@ test:
 
 local:
   service: Disk
-  root: <%= Rails.root.join("storage") %>
+  root: <%= Rails.root.join("storage") %>
+
+# Use bin/rails credentials:edit to set the AWS secrets (as aws:access_key_id|secret_access_key)
+# amazon:
+#   service: S3
+#   access_key_id: <%= Rails.application.credentials.dig(:aws, :access_key_id) %>
+#   secret_access_key: <%= Rails.application.credentials.dig(:aws, :secret_access_key) %>
+#   region: us-east-1
+#   bucket: your_own_bucket-<%= Rails.env %>
+
+# Remember not to checkin your GCS keyfile to a repository
+# google:
+#   service: GCS
+#   project: your_project
+#   credentials: <%= Rails.root.join("path/to/gcs.keyfile") %>
+#   bucket: your_own_bucket-<%= Rails.env %>
+
+# Use bin/rails credentials:edit to set the Azure Storage secret (as azure_storage:storage_access_key)
+# microsoft:
+#   service: AzureStorage
+#   storage_account_name: your_account_name
+#   storage_access_key: <%= Rails.application.credentials.dig(:azure_storage, :storage_access_key) %>
+#   container: your_container_name-<%= Rails.env %>
+
+# mirror:
+#   service: Mirror
+#   primary: local
+#   mirrors: [ amazon, google, microsoft ]

data/spec/dummy/db/migrate/20260729201444_add_service_name_to_active_storage_blobs.active_storage.rb

@@ -0,0 +1,22 @@
+# This migration comes from active_storage (originally 20190112182829)
+class AddServiceNameToActiveStorageBlobs < ActiveRecord::Migration[6.0]
+  def up
+    return unless table_exists?(:active_storage_blobs)
+
+    unless column_exists?(:active_storage_blobs, :service_name)
+      add_column :active_storage_blobs, :service_name, :string
+
+      if configured_service = ActiveStorage::Blob.service.name
+        ActiveStorage::Blob.unscoped.update_all(service_name: configured_service)
+      end
+
+      change_column :active_storage_blobs, :service_name, :string, null: false
+    end
+  end
+
+  def down
+    return unless table_exists?(:active_storage_blobs)
+
+    remove_column :active_storage_blobs, :service_name
+  end
+end

data/spec/dummy/db/migrate/20260729201445_create_active_storage_variant_records.active_storage.rb

@@ -0,0 +1,27 @@
+# This migration comes from active_storage (originally 20191206030411)
+class CreateActiveStorageVariantRecords < ActiveRecord::Migration[6.0]
+  def change
+    return unless table_exists?(:active_storage_blobs)
+
+    # Use Active Record's configured type for primary key
+    create_table :active_storage_variant_records, id: primary_key_type, if_not_exists: true do |t|
+      t.belongs_to :blob, null: false, index: false, type: blobs_primary_key_type
+      t.string :variation_digest, null: false
+
+      t.index %i[ blob_id variation_digest ], name: "index_active_storage_variant_records_uniqueness", unique: true
+      t.foreign_key :active_storage_blobs, column: :blob_id
+    end
+  end
+
+  private
+    def primary_key_type
+      config = Rails.configuration.generators
+      config.options[config.orm][:primary_key_type] || :primary_key
+    end
+
+    def blobs_primary_key_type
+      pkey_name = connection.primary_key(:active_storage_blobs)
+      pkey_column = connection.columns(:active_storage_blobs).find { |c| c.name == pkey_name }
+      pkey_column.bigint? ? :bigint : pkey_column.type
+    end
+end

data/spec/dummy/db/migrate/20260729201446_remove_not_null_on_active_storage_blobs_checksum.active_storage.rb

@@ -0,0 +1,8 @@
+# This migration comes from active_storage (originally 20211119233751)
+class RemoveNotNullOnActiveStorageBlobsChecksum < ActiveRecord::Migration[6.0]
+  def change
+    return unless table_exists?(:active_storage_blobs)
+
+    change_column_null(:active_storage_blobs, :checksum, true)
+  end
+end

data/spec/dummy/public/404.html

@@ -4,7 +4,7 @@
   <title>The page you were looking for doesn't exist (404)</title>
   <meta name="viewport" content="width=device-width,initial-scale=1">
   <style>
-  body {
+  .rails-default-error-page {
     background-color: #EFEFEF;
     color: #2E2F30;
     text-align: center;
@@ -12,13 +12,13 @@
     margin: 0;
   }
 
-  div.dialog {
+  .rails-default-error-page div.dialog {
     width: 95%;
     max-width: 33em;
     margin: 4em auto 0;
   }
 
-  div.dialog > div {
+  .rails-default-error-page div.dialog > div {
     border: 1px solid #CCC;
     border-right-color: #999;
     border-left-color: #999;
@@ -31,13 +31,13 @@
     box-shadow: 0 3px 8px rgba(50, 50, 50, 0.17);
   }
 
-  h1 {
+  .rails-default-error-page h1 {
     font-size: 100%;
     color: #730E15;
     line-height: 1.5em;
   }
 
-  div.dialog > p {
+  .rails-default-error-page div.dialog > p {
     margin: 0 0 1em;
     padding: 1em;
     background-color: #F7F7F7;
@@ -54,7 +54,7 @@
   </style>
 </head>
 
-<body>
+<body class="rails-default-error-page">
   <!-- This file lives in public/404.html -->
   <div class="dialog">
     <div>