trusty-cms 7.1.3 → 7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9f50633a419203ee6b0b6e35814de7af711b70dd362d5fe0f712543d31f1fc75
-  data.tar.gz: f5ccf44bd927e9a392e9979388c9d6f65ace4c1f965516d64936ee1da5e50d53
+  metadata.gz: 2378bbe6b853e3290648de1a8a832b61a25303f3078f4903ac70581a031bb3a5
+  data.tar.gz: 3e704c6349a8bf385190cc70ee6cf0021aa8c0cc575d5e033a3c1423a32e5e20
 SHA512:
-  metadata.gz: 8324822cde6d47651420dc28038f51e629e1b411c276a0ddded87dac9587a571de5218e36452f929d0e5c55c4106aa47a21cf72f14e06c78b545c849cfafed6a
-  data.tar.gz: 4e4dc362cd53e8124eaba08331db95eb085fe28b8778776ceef121a7e3b993f379b26d2c56c17538962adca2e2b47eb0e834c16d6f67f4a45b4a6cbab9a33cb3
+  metadata.gz: b4c137e5c84e08a9fc8395282986fe8a7b8b0c7c28d6e3b888b60a4e8a0c19f30d1520bc92a5580c8a3472961470e57558215ff3965546626dbb934863cd9f07
+  data.tar.gz: 42f087dbc0e78b43ffb48ad804b891992eafafe7d8e3ee5589b2d983902eaef2590f5325bb03f1df568227e52ae4a391d7ca8000432e9be82f59710c332f34b4

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    trusty-cms (7.1.3)
+    trusty-cms (7.2)
       RedCloth (= 4.3.4)
       activestorage-validator
       acts_as_list (>= 0.9.5, < 1.3.0)
@@ -29,7 +29,7 @@ PATH
       rack (>= 2.0.1, < 3.2.0)
       rack-cache (~> 1.7)
       radius (~> 0.8)
-      rails (~> 7.2.2.1)
+      rails (>= 7.2, < 8.0)
       rake (< 14.0)
       ransack (~> 4.2.1)
       rdoc (>= 5.1, < 9.0)
@@ -46,68 +46,70 @@ GEM
   remote: https://rubygems.org/
   specs:
     RedCloth (4.3.4)
-    actioncable (7.2.2.1)
-      actionpack (= 7.2.2.1)
-      activesupport (= 7.2.2.1)
+    actioncable (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (7.2.2.1)
-      actionpack (= 7.2.2.1)
-      activejob (= 7.2.2.1)
-      activerecord (= 7.2.2.1)
-      activestorage (= 7.2.2.1)
-      activesupport (= 7.2.2.1)
+    actionmailbox (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activestorage (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       mail (>= 2.8.0)
-    actionmailer (7.2.2.1)
-      actionpack (= 7.2.2.1)
-      actionview (= 7.2.2.1)
-      activejob (= 7.2.2.1)
-      activesupport (= 7.2.2.1)
+    actionmailer (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      actionview (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (7.2.2.1)
-      actionview (= 7.2.2.1)
-      activesupport (= 7.2.2.1)
+    actionpack (7.2.3.2)
+      actionview (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
+      cgi
       nokogiri (>= 1.8.5)
       racc
-      rack (>= 2.2.4, < 3.2)
+      rack (>= 2.2.4, < 3.3)
       rack-session (>= 1.0.1)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
-    actiontext (7.2.2.1)
-      actionpack (= 7.2.2.1)
-      activerecord (= 7.2.2.1)
-      activestorage (= 7.2.2.1)
-      activesupport (= 7.2.2.1)
+    actiontext (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activestorage (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.2.2.1)
-      activesupport (= 7.2.2.1)
+    actionview (7.2.3.2)
+      activesupport (= 7.2.3.2)
       builder (~> 3.1)
+      cgi
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (7.2.2.1)
-      activesupport (= 7.2.2.1)
+    activejob (7.2.3.2)
+      activesupport (= 7.2.3.2)
       globalid (>= 0.3.6)
-    activemodel (7.2.2.1)
-      activesupport (= 7.2.2.1)
-    activerecord (7.2.2.1)
-      activemodel (= 7.2.2.1)
-      activesupport (= 7.2.2.1)
+    activemodel (7.2.3.2)
+      activesupport (= 7.2.3.2)
+    activerecord (7.2.3.2)
+      activemodel (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       timeout (>= 0.4.0)
-    activestorage (7.2.2.1)
-      actionpack (= 7.2.2.1)
-      activejob (= 7.2.2.1)
-      activerecord (= 7.2.2.1)
-      activesupport (= 7.2.2.1)
+    activestorage (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       marcel (~> 1.0)
     activestorage-validator (0.4.0)
       rails (>= 6.1.0)
-    activesupport (7.2.2.1)
+    activesupport (7.2.3.2)
       base64
       benchmark (>= 0.3)
       bigdecimal
@@ -116,7 +118,7 @@ GEM
       drb
       i18n (>= 1.6, < 2)
       logger (>= 1.4.2)
-      minitest (>= 5.1)
+      minitest (>= 5.1, < 6)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
     acts_as_list (1.2.6)
@@ -142,12 +144,13 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    cgi (0.5.2)
     childprocess (5.1.0)
       logger (~> 1.5)
     chunky_png (1.4.0)
     cliver (0.3.2)
     coderay (1.1.3)
-    concurrent-ruby (1.3.7)
+    concurrent-ruby (1.3.8)
     connection_pool (3.0.2)
     crass (1.0.7)
     css_parser (3.0.0)
@@ -180,7 +183,7 @@ GEM
     diffy (3.4.4)
     docile (1.4.1)
     drb (2.2.3)
-    erb (6.0.4)
+    erb (6.0.6)
     erubi (1.13.1)
     execjs (2.10.0)
     factory_bot (6.6.0)
@@ -201,7 +204,7 @@ GEM
     file_validators (3.0.0)
       activemodel (>= 3.2)
       mime-types (>= 1.0)
-    globalid (1.2.1)
+    globalid (1.4.0)
       activesupport (>= 6.1)
     haml (6.3.0)
       temple (>= 0.8.2)
@@ -251,12 +254,13 @@ GEM
     loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    mail (2.8.1)
+    mail (2.9.1)
+      logger
       mini_mime (>= 0.1.1)
       net-imap
       net-pop
       net-smtp
-    marcel (1.0.4)
+    marcel (1.2.1)
     matrix (0.4.2)
     method_source (1.1.0)
     mime-types (3.6.0)
@@ -268,15 +272,13 @@ GEM
     mini_portile2 (2.8.9)
     mini_racer (0.16.0)
       libv8-node (~> 18.19.0.0)
-    minitest (6.0.6)
-      drb (~> 2.0)
-      prism (~> 1.5)
+    minitest (5.27.0)
     multi_xml (0.9.1)
       bigdecimal (>= 3.1, < 5)
     multipart-post (2.4.1)
     mutex_m (0.3.0)
     mysql2 (0.5.6)
-    net-imap (0.5.15)
+    net-imap (0.6.6)
       date
       net-protocol
     net-pop (0.1.2)
@@ -285,7 +287,7 @@ GEM
       timeout
     net-smtp (0.5.1)
       net-protocol
-    nio4r (2.7.4)
+    nio4r (2.7.5)
     nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
@@ -342,20 +344,20 @@ GEM
     rackup (2.3.1)
       rack (>= 3)
     radius (0.8.0)
-    rails (7.2.2.1)
-      actioncable (= 7.2.2.1)
-      actionmailbox (= 7.2.2.1)
-      actionmailer (= 7.2.2.1)
-      actionpack (= 7.2.2.1)
-      actiontext (= 7.2.2.1)
-      actionview (= 7.2.2.1)
-      activejob (= 7.2.2.1)
-      activemodel (= 7.2.2.1)
-      activerecord (= 7.2.2.1)
-      activestorage (= 7.2.2.1)
-      activesupport (= 7.2.2.1)
+    rails (7.2.3.2)
+      actioncable (= 7.2.3.2)
+      actionmailbox (= 7.2.3.2)
+      actionmailer (= 7.2.3.2)
+      actionpack (= 7.2.3.2)
+      actiontext (= 7.2.3.2)
+      actionview (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activemodel (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activestorage (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       bundler (>= 1.15.0)
-      railties (= 7.2.2.1)
+      railties (= 7.2.3.2)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
@@ -365,20 +367,22 @@ GEM
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     rails-observers (0.1.5)
       activemodel (>= 4.0)
-    railties (7.2.2.1)
-      actionpack (= 7.2.2.1)
-      activesupport (= 7.2.2.1)
+    railties (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
+      cgi
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
       thor (~> 1.0, >= 1.2.2)
+      tsort (>= 0.2)
       zeitwerk (~> 2.6)
     rake (13.4.2)
     ransack (4.2.1)
       activerecord (>= 6.1.5)
       activesupport (>= 6.1.5)
       i18n
-    rbs (4.0.3)
+    rbs (4.1.0)
       logger
       prism (>= 1.6.0)
       tsort

data/lib/string_extensions/string_extensions.rb

@@ -14,8 +14,10 @@ class String
   end
 
   unless methods.include?('parameterize')
-    def parameterize(sep = '-')
-      remove_formatting.downcase.replace_whitespace(sep).collapse(sep)
+    def parameterize(separator = '-', preserve_case: false, locale: nil)
+      separator = '-' unless separator.is_a?(String)
+      slug = remove_formatting.replace_whitespace(separator).collapse(separator)
+      preserve_case ? slug : slug.downcase
     end
   end
 

data/lib/trusty_cms/version.rb

@@ -1,3 +1,3 @@
 module TrustyCms
-  VERSION = '7.1.3'.freeze
+  VERSION = '7.2'.freeze
 end

data/spec/controllers/admin/assets_controller_spec.rb

@@ -0,0 +1,124 @@
+require 'spec_helper'
+require 'rack/test'
+
+# Exercises Admin::AssetsController, which overrides the ResourceController CRUD
+# with custom upload handling (process_uploaded_asset, maybe_compress,
+# failure_response, set_owner_or_editor). Uses the JSON/partial endpoints so the
+# specs don't depend on the asset-pipeline-heavy admin HTML layout. High-value
+# regression net for a Rails/Ruby upgrade — file uploads and content-type
+# negotiation are common breakage points.
+RSpec.describe Admin::AssetsController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:user) { create(:admin) }
+  let(:fixtures_path) { TrustyCms::Engine.root.join('spec', 'fixtures', 'files') }
+
+  before do
+    # approved_content_types derives from the AssetType registry, which is empty
+    # by default; register the canonical set (shared with asset_spec) so uploads
+    # of text/plain, images, etc. can be approved. See AssetTypeRegistry.
+    register_standard_asset_types
+
+    # public_url generation needs a host; controller specs don't set one on the
+    # Disk service the way a real request would.
+    @previous_active_storage_url_options = ActiveStorage::Current.url_options
+    ActiveStorage::Current.url_options = { host: 'test.host', protocol: 'http' }
+
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(user)
+  end
+
+  after do
+    ActiveStorage::Current.url_options = @previous_active_storage_url_options
+  end
+
+  # A plain stub (not an rspec double) so it can be assigned in an `around`
+  # hook, which runs outside the per-test double lifecycle. api_key: nil makes
+  # should_compress? false, so uploads skip Kraken compression.
+  around do |example|
+    original_kraken = defined?($kraken) ? $kraken : nil
+    $kraken = Struct.new(:api_key).new(nil)
+    example.run
+    $kraken = original_kraken
+  end
+
+  def upload(filename, content_type)
+    Rack::Test::UploadedFile.new(fixtures_path.join(filename), content_type)
+  end
+
+  describe 'POST #uploader' do
+    it 'returns the asset url when the upload succeeds' do
+      expect {
+        post :uploader, params: { upload: upload('sample.txt', 'text/plain') }, format: :json
+      }.to change(Asset, :count).by(1)
+
+      expect(response).to have_http_status(:ok)
+      expect(JSON.parse(response.body)).to have_key('url')
+    end
+
+    it 'records the uploading user as owner/editor' do
+      post :uploader, params: { upload: upload('sample.txt', 'text/plain') }, format: :json
+
+      asset = Asset.last
+      expect(asset.created_by_id).to eq(user.id)
+      expect(asset.updated_by_id).to eq(user.id)
+    end
+
+    it 'returns unsupported media type for disallowed content types' do
+      expect(Asset).not_to receive(:create)
+
+      post :uploader, params: { upload: upload('sample.txt', 'application/x-unsupported') }, format: :json
+
+      expect(response).to have_http_status(:unsupported_media_type)
+      expect(JSON.parse(response.body)['error']).to eq('Unsupported file type.')
+      expect(flash[:error]).to eq('Unsupported file type.')
+    end
+
+    it 'rejects the generic octet-stream content type with a notice' do
+      post :uploader, params: { upload: upload('sample.txt', 'application/octet-stream') }, format: :json
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(JSON.parse(response.body)['error']).to match(/valid extension/)
+      expect(flash[:notice]).to match(/valid extension/)
+    end
+
+    it 'returns unprocessable entity when no file is provided' do
+      post :uploader, params: {}, format: :json
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(JSON.parse(response.body)['error']).to eq('No file uploaded.')
+      expect(flash[:error]).to eq('No file uploaded.')
+    end
+  end
+
+  describe 'POST #create' do
+    it 'creates an asset from an uploaded file and redirects (HTML)' do
+      expect {
+        post :create, params: { asset: { asset: [upload('sample.txt', 'text/plain')] } }
+      }.to change(Asset, :count).by(1)
+
+      expect(response).to be_redirect
+    end
+
+    it 'redirects back to new with a flash error when the upload is unsupported' do
+      expect {
+        post :create, params: { asset: { asset: [upload('sample.txt', 'application/x-unsupported')] } }
+      }.not_to change(Asset, :count)
+
+      expect(response).to redirect_to(new_admin_asset_path)
+      expect(flash[:error]).to eq('Unsupported file type.')
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    it 'destroys the asset and redirects' do
+      asset = Asset.create!(asset: upload('sample.txt', 'text/plain'), caption: '')
+
+      expect {
+        delete :destroy, params: { id: asset.id }
+      }.to change(Asset, :count).by(-1)
+
+      expect(response).to be_redirect
+    end
+  end
+end

data/spec/controllers/admin/changes_controller_spec.rb

@@ -0,0 +1,72 @@
+require 'spec_helper'
+
+# Exercises Admin::ChangesController, which builds a PaperTrail-backed diff view
+# of recent page changes. Controller specs (views not rendered) let us drive the
+# action and its private diff-building helpers without the admin HTML layout.
+# PaperTrail behaviour is a plausible upgrade casualty, so this pins it down.
+RSpec.describe Admin::ChangesController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:user) { create(:admin) }
+  let!(:site) { create(:site) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(user)
+    # The multi-site extension (which provides #current_site) isn't loaded in the
+    # dummy app, so stub it to the site our fixtures are scoped to.
+    allow(controller).to receive(:current_site).and_return(site)
+  end
+
+  # Create a page scoped to the current site and give it a versioned change so
+  # the controller has something to diff.
+  def page_with_change
+    page = create(:home, title: 'Original', site_id: site.id)
+    PaperTrail.request(whodunnit: user.id.to_s) do
+      page.update!(title: 'Updated Title')
+    end
+    page
+  end
+
+  # rails-controller-testing (which provides `assigns`) isn't in the bundle, so
+  # read the controller's assigned ivars directly.
+  def changes
+    controller.instance_variable_get(:@changes)
+  end
+
+  describe 'GET #show' do
+    it 'succeeds and assigns recent changes' do
+      page_with_change
+
+      get :show
+
+      expect(response).to have_http_status(:ok)
+      expect(changes).to be_present
+    end
+
+    it 'loads a single change when a version_id is given' do
+      page = page_with_change
+      version = PaperTrail::Version.where(item_type: 'Page', item_id: page.id).last
+
+      get :show, params: { version_id: version.id }
+
+      expect(response).to have_http_status(:ok)
+      expect(changes.size).to eq(1)
+      expect(changes.first[:id]).to eq(version.id)
+    end
+
+    it 'reports an error when the version_id is unknown' do
+      get :show, params: { version_id: 0 }
+
+      expect(changes).to be_empty
+      expect(controller.instance_variable_get(:@change_error)).to eq('Version ID not found.')
+    end
+
+    it 'succeeds with no changes present' do
+      get :show
+
+      expect(response).to have_http_status(:ok)
+      expect(changes).to eq([])
+    end
+  end
+end

data/spec/controllers/admin/configuration_controller_spec.rb

@@ -0,0 +1,49 @@
+require 'spec_helper'
+
+# Exercises Admin::ConfigurationController, which batch-updates TrustyCms::Config
+# entries inside a transaction and is admin-gated. Config plumbing is easy to
+# break in a framework upgrade, so pin the happy path and the auth gate.
+RSpec.describe Admin::ConfigurationController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:admin) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(admin)
+  end
+
+  describe 'GET #show' do
+    it 'succeeds' do
+      get :show
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #edit' do
+    it 'succeeds for an admin' do
+      get :edit
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'persists the submitted config values and redirects to show' do
+      put :update, params: { trusty_config: { 'admin.title' => 'Renamed CMS' } }
+
+      expect(response).to redirect_to(action: :show)
+      expect(TrustyCms::Config['admin.title']).to eq('Renamed CMS')
+    end
+  end
+
+  describe 'authorization' do
+    it 'denies a non-admin access to edit' do
+      allow(controller).to receive(:current_user).and_return(create(:non_admin, email: 'plain@example.com'))
+
+      get :edit
+
+      expect(response).to be_redirect
+      expect(flash[:error]).to be_present
+    end
+  end
+end

data/spec/controllers/admin/page_attachments_controller_spec.rb

@@ -0,0 +1,54 @@
+require 'spec_helper'
+require 'rack/test'
+
+# Exercises Admin::PageAttachmentsController, whose custom #load_model builds a
+# PageAttachment from an asset_id (+ optional page_id) and rescues a missing
+# asset. Controller spec (views not rendered) drives the action and its
+# before-action without needing the admin HTML layout.
+RSpec.describe Admin::PageAttachmentsController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:user) { create(:admin) }
+  let(:fixtures_path) { TrustyCms::Engine.root.join('spec', 'fixtures', 'files') }
+  let(:asset) do
+    Asset.create!(asset: Rack::Test::UploadedFile.new(fixtures_path.join('sample.txt'), 'text/plain'), caption: '')
+  end
+
+  before do
+    register_standard_asset_types # shared canonical AssetTypes (see AssetTypeRegistry)
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(user)
+  end
+
+  describe 'GET #new' do
+    it 'builds a PageAttachment for the asset with a new (unsaved) page' do
+      get :new, params: { asset_id: asset.id }
+
+      expect(response).to have_http_status(:ok)
+      model = controller.instance_variable_get(:@page_attachment)
+      expect(model).to be_a(PageAttachment)
+      expect(model.asset).to eq(asset)
+      expect(model.page).to be_a(Page).and be_new_record
+    end
+
+    it 'associates an existing page when a page_id is given' do
+      page = create(:home, title: 'Attach Target')
+
+      get :new, params: { asset_id: asset.id, page_id: page.id }
+
+      expect(controller.instance_variable_get(:@page)).to eq(page)
+    end
+
+    # NOTE: latent bug — load_model rescues a missing asset with
+    # `render nothing: true`, but the `nothing:` option was removed in Rails 5.1.
+    # It's now ignored, so Rails falls through to rendering the (nonexistent)
+    # `new` template and raises MissingTemplate instead of returning an empty
+    # body. Characterizing current behavior; the fix is `head :no_content`.
+    # This is exactly the kind of breakage a Rails 8 upgrade should clean up.
+    it 'raises MissingTemplate for a missing asset (broken rescue path)' do
+      expect {
+        get :new, params: { asset_id: 0 }
+      }.to raise_error(ActionView::MissingTemplate)
+    end
+  end
+end