From 9adcd2f02f538d8e4e21fccb081f1d8b62eab86b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Nov 2025 20:29:13 +0000 Subject: [PATCH 01/30] Bump solid_cache from 1.0.8 to 1.0.10 Bumps [solid_cache](https://github.com/rails/solid_cache) from 1.0.8 to 1.0.10. - [Release notes](https://github.com/rails/solid_cache/releases) - [Commits](https://github.com/rails/solid_cache/compare/v1.0.8...v1.0.10) --- updated-dependencies: - dependency-name: solid_cache dependency-version: 1.0.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Gemfile.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index d7a3121dc..baef7cf5e 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -290,7 +290,7 @@ GEM logger mini_mime (1.1.5) mini_portile2 (2.8.9) - minitest (5.26.1) + minitest (5.26.2) mission_control-jobs (1.1.0) actioncable (>= 7.1) actionpack (>= 7.1) @@ -475,7 +475,7 @@ GEM activejob (>= 7.2) activerecord (>= 7.2) railties (>= 7.2) - solid_cache (1.0.8) + solid_cache (1.0.10) activejob (>= 7.2) activerecord (>= 7.2) railties (>= 7.2) From c4487581bb521017d0d4c5909634a087960626cc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Nov 2025 20:29:30 +0000 Subject: [PATCH 02/30] Bump yabeda-puma-plugin from 0.8.0 to 0.9.0 Bumps [yabeda-puma-plugin](https://github.com/yabeda-rb/yabeda-puma-plugin) from 0.8.0 to 0.9.0. - [Release notes](https://github.com/yabeda-rb/yabeda-puma-plugin/releases) - [Changelog](https://github.com/yabeda-rb/yabeda-puma-plugin/blob/master/CHANGELOG.md) - [Commits](https://github.com/yabeda-rb/yabeda-puma-plugin/compare/v0.8.0...v0.9.0) --- updated-dependencies: - dependency-name: yabeda-puma-plugin dependency-version: 0.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index d7a3121dc..6c6187fab 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -560,7 +560,7 @@ GEM yabeda-prometheus-mmap (0.4.0) prometheus-client-mmap yabeda (~> 0.10) - yabeda-puma-plugin (0.8.0) + yabeda-puma-plugin (0.9.0) json puma yabeda (~> 0.5) From 9df6919e9e789f902c974c4b28247f9fe5846307 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Nov 2025 20:29:32 +0000 Subject: [PATCH 03/30] Bump the development-dependencies group across 1 directory with 3 updates Bumps the development-dependencies group with 3 updates in the / directory: [brakeman](https://github.com/presidentbeef/brakeman), [webmock](https://github.com/bblimke/webmock) and [mocha](https://github.com/freerange/mocha). Updates `brakeman` from 7.1.0 to 7.1.1 - [Release notes](https://github.com/presidentbeef/brakeman/releases) - [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md) - [Commits](https://github.com/presidentbeef/brakeman/compare/v7.1.0...v7.1.1) Updates `webmock` from 3.26.0 to 3.26.1 - [Release notes](https://github.com/bblimke/webmock/releases) - [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md) - [Commits](https://github.com/bblimke/webmock/compare/3.26.0...v3.26.1) Updates `mocha` from 2.7.1 to 2.8.2 - [Changelog](https://github.com/freerange/mocha/blob/main/RELEASE.md) - [Commits](https://github.com/freerange/mocha/compare/v2.7.1...v2.8.2) --- updated-dependencies: - dependency-name: brakeman dependency-version: 7.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: webmock dependency-version: 3.26.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: mocha dependency-version: 2.8.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] --- Gemfile.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index d7a3121dc..0fa70bc38 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -180,7 +180,7 @@ GEM bindex (0.8.1) bootsnap (1.18.6) msgpack (~> 1.2) - brakeman (7.1.0) + brakeman (7.1.1) racc builder (3.3.0) bundler-audit (0.9.2) @@ -302,7 +302,7 @@ GEM stimulus-rails turbo-rails mittens (0.3.0) - mocha (2.7.1) + mocha (2.8.2) ruby2_keywords (>= 0.0.5) msgpack (1.8.0) net-http-persistent (4.0.6) @@ -530,7 +530,7 @@ GEM web-push (3.0.2) jwt (~> 3.0) openssl (~> 3.0) - webmock (3.26.0) + webmock (3.26.1) addressable (>= 2.8.0) crack (>= 0.3.2) hashdiff (>= 0.4.0, < 2.0.0) From 50332d0a4fa4e6bb5bab6de7ec47e7792b69800e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Nov 2025 20:30:23 +0000 Subject: [PATCH 04/30] Bump prometheus-client-mmap from 1.2.10 to 1.3.0 Bumps [prometheus-client-mmap](https://gitlab.com/gitlab-org/prometheus-client-mmap) from 1.2.10 to 1.3.0. - [Release notes](https://gitlab.com/gitlab-org/prometheus-client-mmap/tags) - [Changelog](https://gitlab.com/gitlab-org/prometheus-client-mmap/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/gitlab-org/prometheus-client-mmap/compare/1.2.10...1.3.0) --- updated-dependencies: - dependency-name: prometheus-client-mmap dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- Gemfile | 2 +- Gemfile.lock | 22 +++++++++++----------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/Gemfile b/Gemfile index a74c6ed43..185c0f977 100644 --- a/Gemfile +++ b/Gemfile @@ -49,7 +49,7 @@ gem "yabeda-prometheus-mmap" gem "yabeda-puma-plugin" gem "yabeda-rails" gem "webrick" # required for yabeda-prometheus metrics server -gem "prometheus-client-mmap", "~> 1.1" +gem "prometheus-client-mmap", "~> 1.3" gem "autotuner" gem "benchmark" # indirect dependency, being removed from Ruby 3.5 stdlib so here to quash warnings diff --git a/Gemfile.lock b/Gemfile.lock index d7a3121dc..cacba4b82 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -346,31 +346,31 @@ GEM prettyprint prettyprint (0.2.0) prism (1.6.0) - prometheus-client-mmap (1.2.10) + prometheus-client-mmap (1.3.0) base64 bigdecimal logger - rb_sys (~> 0.9.109) - prometheus-client-mmap (1.2.10-arm64-darwin) + rb_sys (~> 0.9.117) + prometheus-client-mmap (1.3.0-arm64-darwin) base64 bigdecimal logger - rb_sys (~> 0.9.109) - prometheus-client-mmap (1.2.10-x86_64-darwin) + rb_sys (~> 0.9.117) + prometheus-client-mmap (1.3.0-x86_64-darwin) base64 bigdecimal logger - rb_sys (~> 0.9.109) - prometheus-client-mmap (1.2.10-x86_64-linux-gnu) + rb_sys (~> 0.9.117) + prometheus-client-mmap (1.3.0-x86_64-linux-gnu) base64 bigdecimal logger - rb_sys (~> 0.9.109) - prometheus-client-mmap (1.2.10-x86_64-linux-musl) + rb_sys (~> 0.9.117) + prometheus-client-mmap (1.3.0-x86_64-linux-musl) base64 bigdecimal logger - rb_sys (~> 0.9.109) + rb_sys (~> 0.9.117) propshaft (1.3.1) actionpack (>= 7.0.0) activesupport (>= 7.0.0) @@ -604,7 +604,7 @@ DEPENDENCIES mocha net-http-persistent platform_agent - prometheus-client-mmap (~> 1.1) + prometheus-client-mmap (~> 1.3) propshaft puma (>= 5.0) queenbee! From 41a7d55672015e3ce0e9fb16f8a0e6cfded6ee91 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Nov 2025 20:30:36 +0000 Subject: [PATCH 05/30] Bump autotuner from 1.0.2 to 1.1.0 Bumps [autotuner](https://github.com/Shopify/autotuner) from 1.0.2 to 1.1.0. - [Release notes](https://github.com/Shopify/autotuner/releases) - [Commits](https://github.com/Shopify/autotuner/compare/v1.0.2...v1.1.0) --- updated-dependencies: - dependency-name: autotuner dependency-version: 1.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index d7a3121dc..a58bc341a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -152,7 +152,7 @@ GEM anyway_config (2.7.2) ruby-next-core (~> 1.0) ast (2.4.3) - autotuner (1.0.2) + autotuner (1.1.0) aws-eventstream (1.4.0) aws-partitions (1.1175.0) aws-sdk-core (3.234.0) From 143723a384df52381dcda704b51f82c2d1c077e7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Nov 2025 20:30:51 +0000 Subject: [PATCH 06/30] Bump aws-sdk-s3 from 1.201.0 to 1.205.0 Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.201.0 to 1.205.0. - [Release notes](https://github.com/aws/aws-sdk-ruby/releases) - [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-ruby/commits) --- updated-dependencies: - dependency-name: aws-sdk-s3 dependency-version: 1.205.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- Gemfile.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index d7a3121dc..c289b37fb 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -154,8 +154,8 @@ GEM ast (2.4.3) autotuner (1.0.2) aws-eventstream (1.4.0) - aws-partitions (1.1175.0) - aws-sdk-core (3.234.0) + aws-partitions (1.1187.0) + aws-sdk-core (3.239.1) aws-eventstream (~> 1, >= 1.3.0) aws-partitions (~> 1, >= 1.992.0) aws-sigv4 (~> 1.9) @@ -163,10 +163,10 @@ GEM bigdecimal jmespath (~> 1, >= 1.6.1) logger - aws-sdk-kms (1.115.0) - aws-sdk-core (~> 3, >= 3.234.0) + aws-sdk-kms (1.118.0) + aws-sdk-core (~> 3, >= 3.239.1) aws-sigv4 (~> 1.5) - aws-sdk-s3 (1.201.0) + aws-sdk-s3 (1.205.0) aws-sdk-core (~> 3, >= 3.234.0) aws-sdk-kms (~> 1) aws-sigv4 (~> 1.5) From 4e52f9b9a98acbe87eab074065d3c609349feca0 Mon Sep 17 00:00:00 2001 From: "Stanko K.R." Date: Tue, 25 Nov 2025 11:24:21 +0100 Subject: [PATCH 07/30] Show tags the card is tagged with first --- app/controllers/cards/taggings_controller.rb | 3 ++- app/views/cards/taggings/_tag.html.erb | 8 ++++++++ app/views/cards/taggings/new.html.erb | 12 ++---------- 3 files changed, 12 insertions(+), 11 deletions(-) create mode 100644 app/views/cards/taggings/_tag.html.erb diff --git a/app/controllers/cards/taggings_controller.rb b/app/controllers/cards/taggings_controller.rb index d388fae22..9190b20f1 100644 --- a/app/controllers/cards/taggings_controller.rb +++ b/app/controllers/cards/taggings_controller.rb @@ -2,7 +2,8 @@ class Cards::TaggingsController < ApplicationController include CardScoped def new - @tags = Current.account.tags.all.alphabetically + @tagged_with = @card.tags.alphabetically + @tags = Current.account.tags.all.alphabetically.where.not(id: @tagged_with) fresh_when etag: [ @tags, @card.tags ] end diff --git a/app/views/cards/taggings/_tag.html.erb b/app/views/cards/taggings/_tag.html.erb new file mode 100644 index 000000000..ad183bdef --- /dev/null +++ b/app/views/cards/taggings/_tag.html.erb @@ -0,0 +1,8 @@ +
  • + <%= button_to card_taggings_path(card, params: { tag_title: tag.title }), method: :post, + class: "popup__btn btn", + form_class: "max-width flex-item-grow" do %> + <%= tag.hashtag %> + <%= icon_tag "check", size: 18, class: "checked flex-item-no-shrink flex-item-justify-end", style: "--icon-size: 1em" %> + <% end %> +
    • diff --git a/app/views/cards/taggings/new.html.erb b/app/views/cards/taggings/new.html.erb index e348f531f..644b29d2b 100644 --- a/app/views/cards/taggings/new.html.erb +++ b/app/views/cards/taggings/new.html.erb @@ -18,16 +18,8 @@ <% end %>
      - <% @tags.each do |tag| %> -
    • - <%= button_to card_taggings_path(@card, params: { tag_title: tag.title }), method: :post, - class: "popup__btn btn", - form_class: "max-width flex-item-grow" do %> - <%= tag.hashtag %> - <%= icon_tag "check", size: 18, class: "checked flex-item-no-shrink flex-item-justify-end", style: "--icon-size: 1em" %> - <% end %> -
      • - <% end %> + <%= render collection: @tagged_with, partial: "tag", locals: { card: @card } %> + <%= render collection: @tags, partial: "tag", locals: { card: @card } %>
    • <%= button_tag "Create a new tag", type: "submit", form: dom_id(@card, :tags_form), class: "btn popup__btn", data: { form_target: "submit" } do %> From cc49a1b772e2ec9ff66f8664a98aedd641a2bd86 Mon Sep 17 00:00:00 2001 From: "Stanko K.R." Date: Tue, 25 Nov 2025 12:09:02 +0100 Subject: [PATCH 08/30] Allow long user agent strings Copied this from BC and HEY which also use a string with a 4096 character length See: https://app.fizzy.do/5986089/cards/3066 --- db/migrate/20251125110629_increase_user_agent_length.rb | 6 ++++++ db/schema.rb | 6 +++--- 2 files changed, 9 insertions(+), 3 deletions(-) create mode 100644 db/migrate/20251125110629_increase_user_agent_length.rb diff --git a/db/migrate/20251125110629_increase_user_agent_length.rb b/db/migrate/20251125110629_increase_user_agent_length.rb new file mode 100644 index 000000000..b0d6124f2 --- /dev/null +++ b/db/migrate/20251125110629_increase_user_agent_length.rb @@ -0,0 +1,6 @@ +class IncreaseUserAgentLength < ActiveRecord::Migration[8.2] + def change + change_column :sessions, :user_agent, :string, limit: 4096 + change_column :push_subscriptions, :user_agent, :string, limit: 4096 + end +end diff --git a/db/schema.rb b/db/schema.rb index f951af36b..9f01c17e7 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -10,7 +10,7 @@ # # It's strongly recommended that you check this file into your version control system. -ActiveRecord::Schema[8.2].define(version: 2025_11_21_112416) do +ActiveRecord::Schema[8.2].define(version: 2025_11_25_110629) do create_table "accesses", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t| t.datetime "accessed_at" t.uuid "account_id", null: false @@ -378,7 +378,7 @@ ActiveRecord::Schema[8.2].define(version: 2025_11_21_112416) do t.text "endpoint" t.string "p256dh_key" t.datetime "updated_at", null: false - t.string "user_agent" + t.string "user_agent", limit: 4096 t.uuid "user_id", null: false t.index ["account_id"], name: "index_push_subscriptions_on_account_id" t.index ["user_id", "endpoint"], name: "index_push_subscriptions_on_user_id_and_endpoint", unique: true, length: { endpoint: 255 } @@ -653,7 +653,7 @@ ActiveRecord::Schema[8.2].define(version: 2025_11_21_112416) do t.uuid "identity_id", null: false t.string "ip_address" t.datetime "updated_at", null: false - t.string "user_agent" + t.string "user_agent", limit: 4096 t.index ["identity_id"], name: "index_sessions_on_identity_id" end From b6e31a234a5a39aca0c05b3e5f08fdf671506da6 Mon Sep 17 00:00:00 2001 From: Kevin McConnell Date: Tue, 25 Nov 2025 12:58:17 +0000 Subject: [PATCH 09/30] Set MySQL max statement timeout to 5s --- config/database.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/database.yml b/config/database.yml index 2d993c369..fc05ed89c 100644 --- a/config/database.yml +++ b/config/database.yml @@ -2,9 +2,11 @@ if ENV["MIGRATE"].present? mysql_app_user_key = "MYSQL_ALTER_USER" mysql_app_password_key = "MYSQL_ALTER_PASSWORD" + max_execution_time_ms = 0 # No limit else mysql_app_user_key = "MYSQL_APP_USER" mysql_app_password_key = "MYSQL_APP_PASSWORD" + max_execution_time_ms = 5_000 end mysql_app_user = ENV[mysql_app_user_key] @@ -19,6 +21,7 @@ default: &default timeout: 5000 variables: transaction_isolation: READ-COMMITTED + max_execution_time: <%= max_execution_time_ms %> development: primary: From f64a49dcc04835690a1353077b451b38be2e9a13 Mon Sep 17 00:00:00 2001 From: "Stanko K.R." Date: Tue, 25 Nov 2025 14:09:31 +0100 Subject: [PATCH 10/30] Determine staff members based on flag This replaces the old system based on email addresses, the aim is to make it more generic and thus appropriate for OSS/self-hosting See: https://3.basecamp.com/2914079/buckets/37331921/todos/9302705265#__recording_9320051455 --- app/models/identity.rb | 4 ---- app/models/user.rb | 2 -- db/migrate/20251125130010_add_a_staff_flag_to_identities.rb | 5 +++++ db/schema.rb | 3 ++- test/models/identity_test.rb | 6 ------ 5 files changed, 7 insertions(+), 13 deletions(-) create mode 100644 db/migrate/20251125130010_add_a_staff_flag_to_identities.rb diff --git a/app/models/identity.rb b/app/models/identity.rb index fc1c12bcd..e9ff507a1 100644 --- a/app/models/identity.rb +++ b/app/models/identity.rb @@ -18,10 +18,6 @@ class Identity < ApplicationRecord end end - def staff? - email_address.ends_with?("@37signals.com") || email_address.ends_with?("@basecamp.com") - end - private def deactivate_users users.find_each(&:deactivate) diff --git a/app/models/user.rb b/app/models/user.rb index 94380b8d9..6140d41fa 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -19,8 +19,6 @@ class User < ApplicationRecord scope :with_avatars, -> { preload(:account, :avatar_attachment) } - delegate :staff?, to: :identity, allow_nil: true - def deactivate transaction do accesses.destroy_all diff --git a/db/migrate/20251125130010_add_a_staff_flag_to_identities.rb b/db/migrate/20251125130010_add_a_staff_flag_to_identities.rb new file mode 100644 index 000000000..7df018601 --- /dev/null +++ b/db/migrate/20251125130010_add_a_staff_flag_to_identities.rb @@ -0,0 +1,5 @@ +class AddAStaffFlagToIdentities < ActiveRecord::Migration[8.2] + def change + add_column :identities, :staff, :boolean, null: false, default: false + end +end diff --git a/db/schema.rb b/db/schema.rb index 9f01c17e7..b3a9f0503 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -10,7 +10,7 @@ # # It's strongly recommended that you check this file into your version control system. -ActiveRecord::Schema[8.2].define(version: 2025_11_25_110629) do +ActiveRecord::Schema[8.2].define(version: 2025_11_25_130010) do create_table "accesses", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t| t.datetime "accessed_at" t.uuid "account_id", null: false @@ -300,6 +300,7 @@ ActiveRecord::Schema[8.2].define(version: 2025_11_25_110629) do create_table "identities", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t| t.datetime "created_at", null: false t.string "email_address", null: false + t.boolean "staff", default: false, null: false t.datetime "updated_at", null: false t.index ["email_address"], name: "index_identities_on_email_address", unique: true end diff --git a/test/models/identity_test.rb b/test/models/identity_test.rb index 277c0cc1e..2e7687169 100644 --- a/test/models/identity_test.rb +++ b/test/models/identity_test.rb @@ -13,12 +13,6 @@ class IdentityTest < ActiveSupport::TestCase end end - test "staff?" do - assert Identity.new(email_address: "test@37signals.com").staff? - assert Identity.new(email_address: "test@basecamp.com").staff? - assert_not Identity.new(email_address: "test@example.com").staff? - end - test "join" do identity = identities(:david) account = accounts(:initech) From b238a5b45bca655f487d41830a3aac44a1b794ec Mon Sep 17 00:00:00 2001 From: Kevin McConnell Date: Tue, 25 Nov 2025 13:24:07 +0000 Subject: [PATCH 11/30] Don't report ConcurrentMigrationError to Sentry --- config/initializers/sentry.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/config/initializers/sentry.rb b/config/initializers/sentry.rb index 4226de1d9..8d35e2670 100644 --- a/config/initializers/sentry.rb +++ b/config/initializers/sentry.rb @@ -4,5 +4,6 @@ if !Rails.env.local? && ENV["SKIP_TELEMETRY"].blank? config.breadcrumbs_logger = %i[ active_support_logger http_logger ] config.send_default_pii = false config.release = ENV["GIT_REVISION"] + config.excluded_exceptions += [ "ActiveRecord::ConcurrentMigrationError" ] end end From a7df8260c3982be8deea9f2be12afa9b04a39263 Mon Sep 17 00:00:00 2001 From: "Stanko K.R." Date: Tue, 25 Nov 2025 15:36:13 +0100 Subject: [PATCH 12/30] Fix cards getting stuck in edit mode --- app/views/cards/update.turbo_stream.erb | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/app/views/cards/update.turbo_stream.erb b/app/views/cards/update.turbo_stream.erb index e2a796afd..fea57d238 100644 --- a/app/views/cards/update.turbo_stream.erb +++ b/app/views/cards/update.turbo_stream.erb @@ -1 +1,9 @@ <%= turbo_stream.replace dom_id(@card, :card_container), partial: "cards/container", method: :morph, locals: { card: @card.reload } %> + +<%= turbo_stream.update dom_id(@card, :edit) do %> + <%= render "cards/container/content_display", card: @card %> +<% end %> + +<%= turbo_stream.update dom_id(@card, :card_closure_toggle) do %> + <%= render "cards/container/closure_buttons", card: @card %> +<% end %> From e2f5eaa93fe9694debfbf203005b53bbd2ff4f2c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Nov 2025 15:14:12 +0000 Subject: [PATCH 13/30] Bump rails from `077c3ad` to `17f6e00` Bumps [rails](https://github.com/rails/rails) from `077c3ad` to `17f6e00`. - [Release notes](https://github.com/rails/rails/releases) - [Commits](https://github.com/rails/rails/compare/077c3ad60db4c43cccb8f4637b53b8d8eb7a3c19...17f6e00bce8c35b6c5355450331da170c768e3e0) --- updated-dependencies: - dependency-name: rails dependency-version: 17f6e00bce8c35b6c5355450331da170c768e3e0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- Gemfile.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 3beded8dd..5a481e819 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -27,7 +27,7 @@ GIT GIT remote: https://github.com/rails/rails.git - revision: 077c3ad60db4c43cccb8f4637b53b8d8eb7a3c19 + revision: b22cb0c0cb39b103d816a66d560991acf0a57163 branch: main specs: actioncable (8.2.0.alpha) @@ -199,7 +199,7 @@ GEM logger (~> 1.5) chunky_png (1.4.0) concurrent-ruby (1.3.5) - connection_pool (2.5.4) + connection_pool (2.5.5) crack (1.0.1) bigdecimal rexml @@ -405,7 +405,7 @@ GEM rake-compiler-dock (1.9.1) rb_sys (0.9.117) rake-compiler-dock (= 1.9.1) - rdoc (6.15.1) + rdoc (6.16.0) erb psych (>= 4.0.0) tsort From 62dbae568b2aa5232ea5b838beaacf62016ee5a3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Nov 2025 15:16:29 +0000 Subject: [PATCH 14/30] Bump bootsnap from 1.18.6 to 1.19.0 Bumps [bootsnap](https://github.com/rails/bootsnap) from 1.18.6 to 1.19.0. - [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md) - [Commits](https://github.com/rails/bootsnap/compare/v1.18.6...v1.19.0) --- updated-dependencies: - dependency-name: bootsnap dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index 5342c81ef..fbf10e55b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -178,7 +178,7 @@ GEM benchmark (0.5.0) bigdecimal (3.3.1) bindex (0.8.1) - bootsnap (1.18.6) + bootsnap (1.19.0) msgpack (~> 1.2) brakeman (7.1.1) racc From f0a22ea608597a6b349a18202f78a5f26fd91810 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Tue, 25 Nov 2025 10:28:12 -0500 Subject: [PATCH 15/30] bundle update --- Gemfile.lock | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index d7a3121dc..09230afa3 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -147,8 +147,8 @@ GEM activemodel (>= 7.0) activemodel-serializers-xml (~> 1.0) activesupport (>= 7.0) - addressable (2.8.7) - public_suffix (>= 2.0.2, < 7.0) + addressable (2.8.8) + public_suffix (>= 2.0.2, < 8.0) anyway_config (2.7.2) ruby-next-core (~> 1.0) ast (2.4.3) @@ -333,10 +333,10 @@ GEM racc (~> 1.4) nokogiri (1.18.10-x86_64-linux-musl) racc (~> 1.4) - openssl (3.3.1) + openssl (3.3.2) ostruct (0.6.3) parallel (1.27.0) - parser (3.3.9.0) + parser (3.3.10.0) ast (~> 2.4.1) racc platform_agent (1.0.1) @@ -378,7 +378,7 @@ GEM psych (5.2.6) date stringio - public_suffix (6.0.2) + public_suffix (7.0.0) puma (7.1.0) nio4r (~> 2.0) raabro (1.4.0) @@ -418,8 +418,8 @@ GEM rqrcode (3.1.0) chunky_png (~> 1.0) rqrcode_core (~> 2.0) - rqrcode_core (2.0.0) - rubocop (1.81.1) + rqrcode_core (2.0.1) + rubocop (1.81.7) json (~> 2.3) language_server-protocol (~> 3.17.0.2) lint_roller (~> 1.1.0) @@ -430,14 +430,14 @@ GEM rubocop-ast (>= 1.47.1, < 2.0) ruby-progressbar (~> 1.7) unicode-display_width (>= 2.4.0, < 4.0) - rubocop-ast (1.47.1) + rubocop-ast (1.48.0) parser (>= 3.3.7.2) prism (~> 1.4) - rubocop-performance (1.26.0) + rubocop-performance (1.26.1) lint_roller (~> 1.1) rubocop (>= 1.75.0, < 2.0) - rubocop-ast (>= 1.44.0, < 2.0) - rubocop-rails (2.33.4) + rubocop-ast (>= 1.47.1, < 2.0) + rubocop-rails (2.34.1) activesupport (>= 4.2.0) lint_roller (~> 1.1) rack (>= 1.1) @@ -453,7 +453,7 @@ GEM ffi (~> 1.12) logger ruby2_keywords (0.0.5) - rubyzip (3.2.1) + rubyzip (3.2.2) securerandom (0.4.1) selenium-webdriver (4.38.0) base64 (~> 0.2) @@ -461,10 +461,10 @@ GEM rexml (~> 3.2, >= 3.2.5) rubyzip (>= 1.2.2, < 4.0) websocket (~> 1.0) - sentry-rails (6.0.0) + sentry-rails (6.1.2) railties (>= 5.2.0) - sentry-ruby (~> 6.0.0) - sentry-ruby (6.0.0) + sentry-ruby (~> 6.1.2) + sentry-ruby (6.1.2) bigdecimal concurrent-ruby (~> 1.0, >= 1.0.2) sniffer (0.5.0) @@ -479,19 +479,19 @@ GEM activejob (>= 7.2) activerecord (>= 7.2) railties (>= 7.2) - solid_queue (1.2.2) + solid_queue (1.2.4) activejob (>= 7.1) activerecord (>= 7.1) concurrent-ruby (>= 1.3.1) fugit (~> 1.11) railties (>= 7.1) thor (>= 1.3.1) - sqlite3 (2.7.4) + sqlite3 (2.8.0) mini_portile2 (~> 2.8.0) - sqlite3 (2.7.4-arm64-darwin) - sqlite3 (2.7.4-x86_64-darwin) - sqlite3 (2.7.4-x86_64-linux-gnu) - sqlite3 (2.7.4-x86_64-linux-musl) + sqlite3 (2.8.0-arm64-darwin) + sqlite3 (2.8.0-x86_64-darwin) + sqlite3 (2.8.0-x86_64-linux-gnu) + sqlite3 (2.8.0-x86_64-linux-musl) sshkit (1.24.0) base64 logger From d88949288c253d3e50da8f30daa2ffe1359cbf64 Mon Sep 17 00:00:00 2001 From: Rosa Gutierrez Date: Wed, 19 Nov 2025 22:26:17 +0100 Subject: [PATCH 16/30] Check and report on Sec-Fetch-Site header for forgery protection This is a great, solid alternative to CSRF tokens for CSRF protection when we aren't worried about older browsers or other kind of actors doing modifying requests in our app, and could be a good test for future upstreaming to Rails (although there we'd need to continue using CSRF tokens or at least letting people opt out manually). Let's start checking the header and reporting on it when CSRF fails or when it doesn't match the other checks Rails does, and then promote this to be the only way to defend from CSRF. --- app/controllers/application_controller.rb | 1 + .../concerns/request_forgery_protection.rb | 54 +++++++ .../request_forgery_protection_test.rb | 148 ++++++++++++++++++ 3 files changed, 203 insertions(+) create mode 100644 app/controllers/concerns/request_forgery_protection.rb create mode 100644 test/controllers/concerns/request_forgery_protection_test.rb diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 0ade45a66..89b94f079 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -2,6 +2,7 @@ class ApplicationController < ActionController::Base include Authentication include Authorization include CurrentRequest, CurrentTimezone, SetPlatform + include RequestForgeryProtection include TurboFlash, ViewTransitions include Saas include RoutingHeaders diff --git a/app/controllers/concerns/request_forgery_protection.rb b/app/controllers/concerns/request_forgery_protection.rb new file mode 100644 index 000000000..b3ca6ceed --- /dev/null +++ b/app/controllers/concerns/request_forgery_protection.rb @@ -0,0 +1,54 @@ +module RequestForgeryProtection + extend ActiveSupport::Concern + + included do + after_action :append_set_fetch_site_to_vary_header + end + + private + def append_set_fetch_site_to_vary_header + vary_header = response.headers["Vary"].to_s.split(",").map(&:strip).reject(&:blank?) + response.headers["Vary"] = (vary_header + [ "Sec-Fetch-Site" ]).join(",") + end + + def verified_request? + return true if request.get? || request.head? || !protect_against_forgery? + + origin = valid_request_origin? + token = any_authenticity_token_valid? + sec_fetch_site = safe_fetch_site? + report_on_forgery_protection_results(origin:, token:, sec_fetch_site:) + + origin && token + end + + SAFE_FETCH_SITES = %w[ same-origin same-site ] + + def safe_fetch_site? + SAFE_FETCH_SITES.include?(safe_fetch_site_value) + end + + def safe_fetch_site_value + request.headers["Sec-Fetch-Site"].to_s.downcase + end + + def report_on_forgery_protection_results(origin:, token:, sec_fetch_site:) + unless [ origin, token, sec_fetch_site ].all? + info = { + origin: "#{pass_or_fail_value(origin)} (#{request.origin})", + token: "#{pass_or_fail_value(token)}", + sec_fetch_site: "#{pass_or_fail_value(sec_fetch_site)} (#{safe_fetch_site_value})" + } + + Rails.logger.info "CSRF protection check: " + info.map { it.join(" ") }.join(", ") + + if (origin && token) != sec_fetch_site + Sentry.capture_message "CSRF protection mismatch", level: :info, extra: { info: info } + end + end + end + + def pass_or_fail_value(result) + result ? "pass" : "fail" + end +end diff --git a/test/controllers/concerns/request_forgery_protection_test.rb b/test/controllers/concerns/request_forgery_protection_test.rb new file mode 100644 index 000000000..797c2039a --- /dev/null +++ b/test/controllers/concerns/request_forgery_protection_test.rb @@ -0,0 +1,148 @@ +require "test_helper" + +class RequestForgeryProtectionTest < ActionDispatch::IntegrationTest + setup do + sign_in_as :kevin + + # Forgery protection is disabled in test environment so we need to + # enable it here + @original_allow_forgery_protection = ActionController::Base.allow_forgery_protection + ActionController::Base.allow_forgery_protection = true + end + + teardown do + ActionController::Base.allow_forgery_protection = @original_allow_forgery_protection + end + + test "don't report when Sec-Fetch-Site is same-origin and CSRF token matches" do + assert_log(excludes: "CSRF protection check") do + post boards_path, + params: { board: { name: "Test Board" }, authenticity_token: csrf_token }, + headers: { "Sec-Fetch-Site" => "same-origin" } + end + end + + test "don't report when Sec-Fetch-Site is same-site and CSRF token matches" do + assert_log(excludes: "CSRF protection check") do + post boards_path, + params: { board: { name: "Test Board" }, authenticity_token: csrf_token }, + headers: { "Sec-Fetch-Site" => "same-site" } + end + end + + test "fail and report when token doesn't match, regardless of Sec-Fetch-Site" do + assert_report + + assert_log(includes: [ "CSRF protection check", "sec_fetch_site pass (same-origin)", "token fail" ]) do + assert_no_difference -> { Board.count } do + post boards_path, + params: { board: { name: "Test Board" }, authenticity_token: "invalid-token" }, + headers: { "Sec-Fetch-Site" => "same-origin" } + end + end + end + + test "fail and report when Origin doesn't match, regardless of Sec-Fetch-Site" do + assert_report + + assert_log(includes: [ "CSRF protection check", "sec_fetch_site pass (same-origin)", + "token pass", "origin fail (evil-site.com)" ]) do + assert_no_difference -> { Board.count } do + post boards_path, + params: { board: { name: "Test Board" }, authenticity_token: csrf_token }, + headers: { "Sec-Fetch-Site" => "same-origin", Origin: "evil-site.com" } + end + end + end + + test "succeed and report when Sec-Fetch-Site is cross-site and CSRF token matches" do + assert_report + + assert_log(includes: [ "CSRF protection check", "sec_fetch_site fail (cross-site)", "token pass" ]) do + assert_difference -> { Board.count }, +1 do + post boards_path, + params: { board: { name: "Test Board" }, authenticity_token: csrf_token }, + headers: { "Sec-Fetch-Site" => "cross-site" } + end + end + end + + test "succeed and report when Sec-Fetch-Site is none" do + assert_report + + assert_log(includes: [ "CSRF protection check", "sec_fetch_site fail (none)", "token pass" ]) do + assert_difference -> { Board.count }, +1 do + post boards_path, + params: { board: { name: "Test Board" }, authenticity_token: csrf_token }, + headers: { "Sec-Fetch-Site" => "none" } + end + end + end + + test "succeed and report when Sec-Fetch-Site is missing" do + assert_report + + assert_log(includes: [ "CSRF protection check", "sec_fetch_site fail ()", "token pass" ]) do + assert_difference -> { Board.count }, +1 do + post boards_path, params: { board: { name: "Test Board" }, authenticity_token: csrf_token } + end + end + end + + test "don't report and succeed for GET requests" do + assert_log(excludes: "CSRF protection check") do + get board_url(boards(:writebook)), headers: { "Sec-Fetch-Site" => "cross-site" } + assert_response :success + end + end + + test "GET requests succeed regardless of Sec-Fetch-Site header" do + get board_url(boards(:writebook)), headers: { "Sec-Fetch-Site" => "cross-site" } + + assert_response :success + end + + test "appends Sec-Fetch-Site to existing Vary header" do + get board_url(boards(:writebook)), headers: { "Accept" => "text/html" } + + assert_response :success + vary_values = response.headers["Vary"].split(",").map(&:strip) + assert_includes vary_values, "Sec-Fetch-Site" + end + + test "appends Sec-Fetch-Site to Vary header on POST requests" do + post boards_path, + params: { board: { name: "Test Board" }, authenticity_token: csrf_token }, + headers: { "Sec-Fetch-Site" => "same-origin" } + + assert_response :redirect + assert_includes response.headers["Vary"], "Sec-Fetch-Site" + end + + private + def assert_log(includes: [], excludes: [], &block) + original_logger = Rails.logger + log_output = StringIO.new + Rails.logger = ActiveSupport::TaggedLogging.new(ActiveSupport::Logger.new(log_output)) + + yield + + Array(includes).each { assert_includes(log_output.string, it) } + Array(excludes).each { assert_not_includes(log_output.string, it) } + ensure + Rails.logger = original_logger + end + + def assert_report + Sentry.expects(:capture_message).with do |message, **kwargs| + message == "CSRF protection mismatch" && kwargs[:level] == :info + end + end + + def csrf_token + @csrf_token ||= begin + get new_board_url + response.body[/name="authenticity_token" value="([^"]+)"/, 1] + end + end +end From 3811088db357cce26a6e3a5ec190d713fd4831d9 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Tue, 25 Nov 2025 13:46:14 -0500 Subject: [PATCH 17/30] Prioritize current user and assigned users in assignment dropdown MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- app/controllers/cards/assignments_controller.rb | 3 ++- app/views/cards/assignments/_user.html.erb | 7 +++++++ app/views/cards/assignments/new.html.erb | 12 +++--------- 3 files changed, 12 insertions(+), 10 deletions(-) create mode 100644 app/views/cards/assignments/_user.html.erb diff --git a/app/controllers/cards/assignments_controller.rb b/app/controllers/cards/assignments_controller.rb index fdd2a86dc..886537fa1 100644 --- a/app/controllers/cards/assignments_controller.rb +++ b/app/controllers/cards/assignments_controller.rb @@ -2,7 +2,8 @@ class Cards::AssignmentsController < ApplicationController include CardScoped def new - @users = @board.users.active.alphabetically + @assigned_to = @card.assignees.active.alphabetically.where.not(id: Current.user) + @users = @board.users.active.alphabetically.where.not(id: @card.assignees).where.not(id: Current.user) fresh_when etag: [ @users, @card.assignees ] end diff --git a/app/views/cards/assignments/_user.html.erb b/app/views/cards/assignments/_user.html.erb new file mode 100644 index 000000000..4dad5a9f7 --- /dev/null +++ b/app/views/cards/assignments/_user.html.erb @@ -0,0 +1,7 @@ +
    • + <%= button_to card_assignments_path(card, params: { assignee_id: user.id }), method: :post, + class: "popup__btn btn", form_class: "max-width flex-item-grow" do %> + <%= local_assigns.fetch(:user_label, user.name) %> + <%= icon_tag "check", size: 18, class: "checked flex-item-no-shrink flex-item-justify-end", style: "--icon-size: 1em" %> + <% end %> +
      • diff --git a/app/views/cards/assignments/new.html.erb b/app/views/cards/assignments/new.html.erb index ee7f38c2d..cb690da23 100644 --- a/app/views/cards/assignments/new.html.erb +++ b/app/views/cards/assignments/new.html.erb @@ -15,15 +15,9 @@ type: "search", autocorrect: "off", autocomplete: "off", data: { "1p-ignore": "true", filter_target: "input", action: "input->filter#filter" } %>
        - <% @users.each do |user| %> -
      • - <%= button_to card_assignments_path(@card, params: { assignee_id: user.id }), method: :post, - class: "popup__btn btn", form_class: "max-width flex-item-grow" do %> - <%= user.name %> - <%= icon_tag "check", size: 18, class: "checked flex-item-no-shrink flex-item-justify-end", style: "--icon-size: 1em" %> - <% end %> -
        • - <% end %> + <%= render partial: "user", locals: { card: @card, user: Current.user, user_label: "Me" } %> + <%= render collection: @assigned_to, partial: "user", locals: { card: @card } %> + <%= render collection: @users, partial: "user", locals: { card: @card } %>
      <% end %> <% end %> From 3d429c1dea68b215b6d2189b95c77f18f9fe53e0 Mon Sep 17 00:00:00 2001 From: Jason Zimdars Date: Tue, 25 Nov 2025 13:19:33 -0600 Subject: [PATCH 18/30] Include full name string so you can type your name to filter --- app/views/cards/assignments/_user.html.erb | 1 + app/views/cards/assignments/new.html.erb | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/app/views/cards/assignments/_user.html.erb b/app/views/cards/assignments/_user.html.erb index 4dad5a9f7..0d4eff888 100644 --- a/app/views/cards/assignments/_user.html.erb +++ b/app/views/cards/assignments/_user.html.erb @@ -2,6 +2,7 @@ <%= button_to card_assignments_path(card, params: { assignee_id: user.id }), method: :post, class: "popup__btn btn", form_class: "max-width flex-item-grow" do %> <%= local_assigns.fetch(:user_label, user.name) %> + <%= yield if block_given? %> <%= icon_tag "check", size: 18, class: "checked flex-item-no-shrink flex-item-justify-end", style: "--icon-size: 1em" %> <% end %> diff --git a/app/views/cards/assignments/new.html.erb b/app/views/cards/assignments/new.html.erb index cb690da23..6692a53f0 100644 --- a/app/views/cards/assignments/new.html.erb +++ b/app/views/cards/assignments/new.html.erb @@ -15,7 +15,9 @@ type: "search", autocorrect: "off", autocomplete: "off", data: { "1p-ignore": "true", filter_target: "input", action: "input->filter#filter" } %>
        - <%= render partial: "user", locals: { card: @card, user: Current.user, user_label: "Me" } %> + <%= render "user", card: @card, user: Current.user, user_label: "Me" do %> + + <% end %> <%= render collection: @assigned_to, partial: "user", locals: { card: @card } %> <%= render collection: @users, partial: "user", locals: { card: @card } %>
      From ca10e4ba4e7e122580d59a7b1135c058e13a9dfc Mon Sep 17 00:00:00 2001 From: Jorge Manrubia Date: Tue, 25 Nov 2025 21:01:18 +0100 Subject: [PATCH 19/30] Prevent autoscroll to the root columns container to prevent jump on page load https://app.fizzy.do/5986089/cards/3160 --- app/javascript/controllers/navigable_list_controller.js | 7 ++++--- app/views/boards/show/_columns.html.erb | 1 + 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/app/javascript/controllers/navigable_list_controller.js b/app/javascript/controllers/navigable_list_controller.js index fe5fca86c..f1d22e92d 100644 --- a/app/javascript/controllers/navigable_list_controller.js +++ b/app/javascript/controllers/navigable_list_controller.js @@ -14,6 +14,7 @@ export default class extends Controller { hasNestedNavigation: { type: Boolean, default: false }, preventHandledKeys: { type: Boolean, default: false }, autoSelect: { type: Boolean, default: true }, + autoScroll: { type: Boolean, default: true }, onlyActOnFocusedItems: { type: Boolean, default: false } } @@ -80,10 +81,10 @@ export default class extends Controller { await nextFrame() - this.currentItem.scrollIntoView({ block: "nearest", inline: "nearest" }) + if (this.autoScrollValue) { this.currentItem.scrollIntoView({ block: "nearest", inline: "nearest" }) } if (this.hasNestedNavigationValue) { this.#activateNestedNavigableList() } - if (!skipFocus && this.focusOnSelectionValue) { this.currentItem.focus() } + if (!skipFocus && this.focusOnSelectionValue) { this.currentItem.focus({ preventScroll: !this.autoScrollValue }) } } isSelected(item) { @@ -160,7 +161,7 @@ export default class extends Controller { #relayNavigationToParentNavigableList(event) { const parentController = this.#parentNavigableListController if (parentController) { - parentController.element.focus() + parentController.element.focus({ preventScroll: !this.autoScrollValue }) parentController.navigate(event) } } diff --git a/app/views/boards/show/_columns.html.erb b/app/views/boards/show/_columns.html.erb index a7f8502e3..a6001da79 100644 --- a/app/views/boards/show/_columns.html.erb +++ b/app/views/boards/show/_columns.html.erb @@ -10,6 +10,7 @@ navigable_list_has_nested_navigation_value: true, navigable_list_prevent_handled_keys_value: true, navigable_list_auto_select_value: false, + navigable_list_auto_scroll_value: false, action: " keydown->navigable-list#navigate dragstart->drag-and-drop#dragStart From 525efb2de85f414e8d05d6e2fd9d885192b9f62c Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Tue, 25 Nov 2025 12:23:01 -0800 Subject: [PATCH 20/30] Claude: production observability guidance (#1725) --- CLAUDE.md | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index a7141f6a6..eb881cf25 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -137,6 +137,43 @@ Key recurring tasks (via `config/recurring.yml`): - Search records denormalized for performance - Models in `app/models/search/` +## Production Observability + +Grafana MCP tools provide access to production metrics and logs for performance analysis. + +### Datasources +| Name | UID | Use | +|------|-----|-----| +| Thanos (Prometheus) | `PC96415006F908B67` | Metrics, latencies | +| Loki | `e38bdfea-097e-47fa-a7ab-774fd2487741` | Application logs | + +### Key Metrics +- `rails_request_duration_seconds_bucket:rate1m:sum_by_app:quantiles{app="fizzy"}` - Request latency percentiles +- `rails_request_total:rate1m:sum_by_controller_action{app="fizzy"}` - Request rates by endpoint +- `fizzy_replica_wait_seconds` - Database replica consistency wait times + +### Loki Log Labels +Query: `{service_namespace="fizzy", deployment_environment_name="production", service_name="rails"}` + +Useful fields: `event_duration_ms`, `performance_time_db_ms`, `performance_time_cpu_ms`, `rails_endpoint`, `rails_controller` + +### Instrumentation +Yabeda-based metrics exported at `:9394/metrics`. Config in `config/initializers/yabeda.rb`. + +### Chrome MCP (Local Dev) +URL: `http://fizzy.localhost:3006` +Login: david@37signals.com (passwordless magic link auth - check rails console for link) + +Use Chrome MCP tools to interact with the running dev app for UI testing and debugging. + +### Sentry Error Tracking +Organization: `basecamp` | Project: `fizzy` | Region: `https://us.sentry.io` + +Use Sentry MCP tools to investigate production errors: +- `search_issues` - Find grouped issues by natural language query +- `get_issue_details` - Get full stacktrace and context for a specific issue +- `analyze_issue_with_seer` - AI-powered root cause analysis with code fix suggestions + ## Coding style Please read the separate file `STYLE.md` for some guidance on coding style. From fac9f3c369e08e1bdae17d737ab42e1288ef2620 Mon Sep 17 00:00:00 2001 From: Rosa Gutierrez Date: Tue, 25 Nov 2025 21:07:51 +0100 Subject: [PATCH 21/30] Clean up a little bit the CSRF reporting code Small follow-up to https://github.com/basecamp/fizzy/pull/1721 --- .../concerns/request_forgery_protection.rb | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/app/controllers/concerns/request_forgery_protection.rb b/app/controllers/concerns/request_forgery_protection.rb index b3ca6ceed..682e88a7d 100644 --- a/app/controllers/concerns/request_forgery_protection.rb +++ b/app/controllers/concerns/request_forgery_protection.rb @@ -33,12 +33,12 @@ module RequestForgeryProtection end def report_on_forgery_protection_results(origin:, token:, sec_fetch_site:) - unless [ origin, token, sec_fetch_site ].all? - info = { - origin: "#{pass_or_fail_value(origin)} (#{request.origin})", - token: "#{pass_or_fail_value(token)}", - sec_fetch_site: "#{pass_or_fail_value(sec_fetch_site)} (#{safe_fetch_site_value})" - } + results = { origin:, token:, sec_fetch_site: } + + unless results.values.all? + info = results.transform_values { it ? "pass" : "fail" } + info[:origin] += " (#{request.origin})" + info[:sec_fetch_site] += " (#{safe_fetch_site_value})" Rails.logger.info "CSRF protection check: " + info.map { it.join(" ") }.join(", ") @@ -47,8 +47,4 @@ module RequestForgeryProtection end end end - - def pass_or_fail_value(result) - result ? "pass" : "fail" - end end From 0bf62ba4cfedb83267e7eedd8947dd8326d0de6c Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Tue, 25 Nov 2025 16:18:23 -0500 Subject: [PATCH 22/30] Update to basecamp's useragent fork and assert it's working by testing for Baidu --- Gemfile | 1 + Gemfile.lock | 8 ++++- test/controllers/allow_browser_test.rb | 44 ++++++++++++++++++++++++++ 3 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 test/controllers/allow_browser_test.rb diff --git a/Gemfile b/Gemfile index 185c0f977..d008f4907 100644 --- a/Gemfile +++ b/Gemfile @@ -34,6 +34,7 @@ gem "aws-sdk-s3", require: false gem "web-push" gem "net-http-persistent" gem "mittens" +gem "useragent", bc: "useragent" # Telemetry, logging, and operations gem "mission_control-jobs" diff --git a/Gemfile.lock b/Gemfile.lock index 4ad05f969..de664bea5 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -16,6 +16,12 @@ GIT json rails (>= 6.0.0) +GIT + remote: https://github.com/basecamp/useragent + revision: 746e37ba93cef6399920d18ad88903db92ba4e30 + specs: + useragent (0.16.10) + GIT remote: https://github.com/basecamp/yabeda-activejob.git revision: 684973f77ff01d8b3dd75874538fae55961e15e6 @@ -519,7 +525,6 @@ GEM unicode-emoji (~> 4.1) unicode-emoji (4.1.0) uri (1.1.1) - useragent (0.16.11) vcr (6.3.1) base64 web-console (4.2.1) @@ -626,6 +631,7 @@ DEPENDENCIES thruster trilogy (~> 2.9) turbo-rails + useragent! vcr web-console web-push diff --git a/test/controllers/allow_browser_test.rb b/test/controllers/allow_browser_test.rb new file mode 100644 index 000000000..470087d51 --- /dev/null +++ b/test/controllers/allow_browser_test.rb @@ -0,0 +1,44 @@ +require "test_helper" + +class AllowBrowserTest < ActionDispatch::IntegrationTest + test "Baidu browser is allowed" do + sign_in_as :kevin + + get cards_path, headers: { + "User-Agent" => "Mozilla/5.0 (Linux; Android 7.0; HUAWEI NXT-AL10 Build/HUAWEINXT-AL10; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/48.0.2564.116 Mobile Safari/537.36 baidubrowser/7.9.12.0 (Baidu; P1 7.0)NULL" + } + + assert_response :success + end + + test "nonsense user agent with bot in name is allowed" do + sign_in_as :kevin + + get cards_path, headers: { + "User-Agent" => "TotallyFakeBot/1.0 (NonsenseBrowser; Testing)" + } + + assert_response :success + end + + test "nonsense user agent is allowed" do + sign_in_as :kevin + + get cards_path, headers: { + "User-Agent" => "just some random nonsense text" + } + + assert_response :success + end + + test "old Chrome browser is rejected with 406" do + sign_in_as :kevin + + # Chrome 118 is below the modern threshold of Chrome 120 + get cards_path, headers: { + "User-Agent" => "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118 Safari/537.36" + } + + assert_response :not_acceptable + end +end From b767d6edcb7819074e8c95cf14f47385ca5ee12d Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Tue, 25 Nov 2025 16:26:15 -0500 Subject: [PATCH 23/30] Allow requests from Google Image Proxy which should fix email notifications' avatars rendering as broken images in GMail. ref: https://app.fizzy.do/5986089/cards/1740 --- Gemfile.lock | 4 ++-- test/controllers/allow_browser_test.rb | 10 ++++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index de664bea5..e0d7c83a5 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -18,9 +18,9 @@ GIT GIT remote: https://github.com/basecamp/useragent - revision: 746e37ba93cef6399920d18ad88903db92ba4e30 + revision: b253635dc649394c72b761f09234bfd6dc87516a specs: - useragent (0.16.10) + useragent (0.16.11) GIT remote: https://github.com/basecamp/yabeda-activejob.git diff --git a/test/controllers/allow_browser_test.rb b/test/controllers/allow_browser_test.rb index 470087d51..bb0e0b416 100644 --- a/test/controllers/allow_browser_test.rb +++ b/test/controllers/allow_browser_test.rb @@ -41,4 +41,14 @@ class AllowBrowserTest < ActionDispatch::IntegrationTest assert_response :not_acceptable end + + test "Google Image Proxy is allowed" do + sign_in_as :kevin + + get cards_path, headers: { + "User-Agent" => "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko Firefox/11.0 (via ggpht.com GoogleImageProxy)" + } + + assert_response :success + end end From 92199c4ae702dea1d9a3213b445a4f3bce9b98b9 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Tue, 25 Nov 2025 13:33:07 -0800 Subject: [PATCH 24/30] AI: configure MCP servers for Chrome, Grafana, and Sentry (#1727) --- .mcp.json | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .mcp.json diff --git a/.mcp.json b/.mcp.json new file mode 100644 index 000000000..13beab928 --- /dev/null +++ b/.mcp.json @@ -0,0 +1,18 @@ +{ + "mcpServers": { + "chrome-devtools": { + "type": "stdio", + "command": "npx", + "args": ["-y", "chrome-devtools-mcp@latest"] + }, + "sentry": { + "type": "stdio", + "command": "npx", + "args": ["-y", "mcp-remote@latest", "https://mcp.sentry.dev/mcp"] + }, + "grafana": { + "type": "http", + "url": "https://grafana.37signals.com/mcp" + } + } +} From 154cbf0cdeaf8c459a97ca2e6229bdd848610954 Mon Sep 17 00:00:00 2001 From: Jason Zimdars Date: Tue, 25 Nov 2025 16:08:11 -0600 Subject: [PATCH 25/30] Make it clear this is just notifications, not comprehensive activity --- app/mailers/notification/bundle_mailer.rb | 2 +- .../mailers/notification/bundle_mailer/notification.html.erb | 2 +- .../mailers/notification/bundle_mailer/notification.text.erb | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/app/mailers/notification/bundle_mailer.rb b/app/mailers/notification/bundle_mailer.rb index db3c81bc7..89fea208a 100644 --- a/app/mailers/notification/bundle_mailer.rb +++ b/app/mailers/notification/bundle_mailer.rb @@ -11,6 +11,6 @@ class Notification::BundleMailer < ApplicationMailer mail \ to: bundle.user.identity.email_address, - subject: "Fizzy#{ " (#{ Current.account.name })" if @user.identity.accounts.many? }: Latest Activity" + subject: "Fizzy#{ " (#{ Current.account.name })" if @user.identity.accounts.many? }: New notifications" end end diff --git a/app/views/mailers/notification/bundle_mailer/notification.html.erb b/app/views/mailers/notification/bundle_mailer/notification.html.erb index a2353af5d..e1fec4895 100644 --- a/app/views/mailers/notification/bundle_mailer/notification.html.erb +++ b/app/views/mailers/notification/bundle_mailer/notification.html.erb @@ -1,6 +1,6 @@ -

      Everything since <%= @bundle.starts_at.strftime("%-l%P on %A, %B %-d") %>

      +

      Notifications since <%= @bundle.starts_at.strftime("%-l%P on %A, %B %-d") %>

      You have <%= link_to pluralize(@notifications.count, "new notification"), notifications_url %><%= " in #{ Current.account.name }" if @user.identity.accounts.many? %>.

      diff --git a/app/views/mailers/notification/bundle_mailer/notification.text.erb b/app/views/mailers/notification/bundle_mailer/notification.text.erb index 4a6f84d30..7c5798262 100644 --- a/app/views/mailers/notification/bundle_mailer/notification.text.erb +++ b/app/views/mailers/notification/bundle_mailer/notification.text.erb @@ -1,4 +1,4 @@ -Everything since <%= @bundle.starts_at.strftime("%-l%P on %A, %B %-d") %> +Notifications since <%= @bundle.starts_at.strftime("%-l%P on %A, %B %-d") %> You have <%= pluralize @notifications.count, "new notification" %><%= " in #{ Current.account.name }" if @user.identity.accounts.many? %>. <% @notifications.group_by(&:card).each do |card, notifications| %> From 62fb1a46af93b14e623f9d35ef0fa1db0598d93e Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Tue, 25 Nov 2025 14:09:53 -0800 Subject: [PATCH 26/30] AI: standardize on https://agents.md --- CLAUDE.md | 180 +----------------------------------------------------- 1 file changed, 1 insertion(+), 179 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index eb881cf25..43c994c2d 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,179 +1 @@ -# CLAUDE.md - -This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. - -## What is Fizzy? - -Fizzy is a collaborative project management and issue tracking application built by 37signals/Basecamp. It's a kanban-style tool for teams to create and manage cards (tasks/issues) across boards, organize work into columns representing workflow stages, and collaborate via comments, mentions, and assignments. - -## Development Commands - -### Setup and Server -```bash -bin/setup # Initial setup (installs gems, creates DB, loads schema) -bin/dev # Start development server (runs on port 3006) -``` - -Development URL: http://fizzy.localhost:3006 -Login with: david@37signals.com (development fixtures), password will appear in the browser console - -### Testing -```bash -bin/rails test # Run unit tests (fast) -bin/rails test test/path/file_test.rb # Run single test file -bin/rails test:system # Run system tests (Capybara + Selenium) -bin/ci # Run full CI suite (style, security, tests) - -# For parallel test execution issues, use: -PARALLEL_WORKERS=1 bin/rails test -``` - -CI pipeline (`bin/ci`) runs: -1. Rubocop (style) -2. Bundler audit (gem security) -3. Importmap audit -4. Brakeman (security scan) -5. Application tests -6. System tests - -### Database -```bash -bin/rails db:fixtures:load # Load fixture data -bin/rails db:migrate # Run migrations -bin/rails db:reset # Drop, create, and load schema -``` - -### Other Utilities -```bash -bin/rails dev:email # Toggle letter_opener for email preview -bin/jobs # Manage Solid Queue jobs -bin/kamal deploy # Deploy (requires 1Password CLI for secrets) -``` - -## Architecture Overview - -### Multi-Tenancy (URL-Based) - -Fizzy uses **URL path-based multi-tenancy**: -- Each Account (tenant) has a unique `external_account_id` (7+ digits) -- URLs are prefixed: `/{account_id}/boards/...` -- Middleware (`AccountSlug::Extractor`) extracts the account ID from the URL and sets `Current.account` -- The slug is moved from `PATH_INFO` to `SCRIPT_NAME`, making Rails think it's "mounted" at that path -- All models include `account_id` for data isolation -- Background jobs automatically serialize and restore account context - -**Key insight**: This architecture allows multi-tenancy without subdomains or separate databases, making local development and testing simpler. - -### Authentication & Authorization - -**Passwordless magic link authentication**: -- Global `Identity` (email-based) can have `Users` in multiple Accounts -- Users belong to an Account and have roles: admin, member, system -- Sessions managed via signed cookies -- Board-level access control via `Access` records - -### Core Domain Models - -**Account** → The tenant/organization -- Has users, boards, cards, tags, webhooks -- Has entropy configuration for auto-postponement - -**Identity** → Global user (email) -- Can have Users in multiple Accounts -- Session management tied to Identity - -**User** → Account membership -- Belongs to Account and Identity -- Has role (admin/member/system) -- Board access via explicit `Access` records - -**Board** → Primary organizational unit -- Has columns for workflow stages -- Can be "all access" or selective -- Can be published publicly with shareable key - -**Card** → Main work item (task/issue) -- Sequential number within each Account -- Rich text description and attachments -- Lifecycle: triage → columns → closed/not_now -- Automatically postpones after inactivity ("entropy") - -**Event** → Records all significant actions -- Polymorphic association to changed object -- Drives activity timeline, notifications, webhooks -- Has JSON `particulars` for action-specific data - -### Entropy System - -Cards automatically "postpone" (move to "not now") after inactivity: -- Account-level default entropy period -- Board-level entropy override -- Prevents endless todo lists from accumulating -- Configurable via Account/Board settings - -### UUID Primary Keys - -All tables use UUIDs (UUIDv7 format, base36-encoded as 25-char strings): -- Custom fixture UUID generation maintains deterministic ordering for tests -- Fixtures are always "older" than runtime records -- `.first`/`.last` work correctly in tests - -### Background Jobs (Solid Queue) - -Database-backed job queue (no Redis): -- Custom `FizzyActiveJobExtensions` prepended to ActiveJob -- Jobs automatically capture/restore `Current.account` -- Mission Control::Jobs for monitoring - -Key recurring tasks (via `config/recurring.yml`): -- Deliver bundled notifications (every 30 min) -- Auto-postpone stale cards (hourly) -- Cleanup jobs for expired links, deliveries - -### Sharded Full-Text Search - -16-shard MySQL full-text search instead of Elasticsearch: -- Shards determined by account ID hash (CRC32) -- Search records denormalized for performance -- Models in `app/models/search/` - -## Production Observability - -Grafana MCP tools provide access to production metrics and logs for performance analysis. - -### Datasources -| Name | UID | Use | -|------|-----|-----| -| Thanos (Prometheus) | `PC96415006F908B67` | Metrics, latencies | -| Loki | `e38bdfea-097e-47fa-a7ab-774fd2487741` | Application logs | - -### Key Metrics -- `rails_request_duration_seconds_bucket:rate1m:sum_by_app:quantiles{app="fizzy"}` - Request latency percentiles -- `rails_request_total:rate1m:sum_by_controller_action{app="fizzy"}` - Request rates by endpoint -- `fizzy_replica_wait_seconds` - Database replica consistency wait times - -### Loki Log Labels -Query: `{service_namespace="fizzy", deployment_environment_name="production", service_name="rails"}` - -Useful fields: `event_duration_ms`, `performance_time_db_ms`, `performance_time_cpu_ms`, `rails_endpoint`, `rails_controller` - -### Instrumentation -Yabeda-based metrics exported at `:9394/metrics`. Config in `config/initializers/yabeda.rb`. - -### Chrome MCP (Local Dev) -URL: `http://fizzy.localhost:3006` -Login: david@37signals.com (passwordless magic link auth - check rails console for link) - -Use Chrome MCP tools to interact with the running dev app for UI testing and debugging. - -### Sentry Error Tracking -Organization: `basecamp` | Project: `fizzy` | Region: `https://us.sentry.io` - -Use Sentry MCP tools to investigate production errors: -- `search_issues` - Find grouped issues by natural language query -- `get_issue_details` - Get full stacktrace and context for a specific issue -- `analyze_issue_with_seer` - AI-powered root cause analysis with code fix suggestions - -## Coding style - -Please read the separate file `STYLE.md` for some guidance on coding style. +@AGENTS.md From 426420a4068455207fb7c6315acc4d8c1d2fb017 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Tue, 25 Nov 2025 14:10:26 -0800 Subject: [PATCH 27/30] Missed commit --- AGENTS.md | 179 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 179 insertions(+) create mode 100644 AGENTS.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 000000000..e8d1f5d63 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,179 @@ +# Fizzy + +This file provides guidance to AI coding agents working with this repository. + +## What is Fizzy? + +Fizzy is a collaborative project management and issue tracking application built by 37signals/Basecamp. It's a kanban-style tool for teams to create and manage cards (tasks/issues) across boards, organize work into columns representing workflow stages, and collaborate via comments, mentions, and assignments. + +## Development Commands + +### Setup and Server +```bash +bin/setup # Initial setup (installs gems, creates DB, loads schema) +bin/dev # Start development server (runs on port 3006) +``` + +Development URL: http://fizzy.localhost:3006 +Login with: david@37signals.com (development fixtures), password will appear in the browser console + +### Testing +```bash +bin/rails test # Run unit tests (fast) +bin/rails test test/path/file_test.rb # Run single test file +bin/rails test:system # Run system tests (Capybara + Selenium) +bin/ci # Run full CI suite (style, security, tests) + +# For parallel test execution issues, use: +PARALLEL_WORKERS=1 bin/rails test +``` + +CI pipeline (`bin/ci`) runs: +1. Rubocop (style) +2. Bundler audit (gem security) +3. Importmap audit +4. Brakeman (security scan) +5. Application tests +6. System tests + +### Database +```bash +bin/rails db:fixtures:load # Load fixture data +bin/rails db:migrate # Run migrations +bin/rails db:reset # Drop, create, and load schema +``` + +### Other Utilities +```bash +bin/rails dev:email # Toggle letter_opener for email preview +bin/jobs # Manage Solid Queue jobs +bin/kamal deploy # Deploy (requires 1Password CLI for secrets) +``` + +## Architecture Overview + +### Multi-Tenancy (URL-Based) + +Fizzy uses **URL path-based multi-tenancy**: +- Each Account (tenant) has a unique `external_account_id` (7+ digits) +- URLs are prefixed: `/{account_id}/boards/...` +- Middleware (`AccountSlug::Extractor`) extracts the account ID from the URL and sets `Current.account` +- The slug is moved from `PATH_INFO` to `SCRIPT_NAME`, making Rails think it's "mounted" at that path +- All models include `account_id` for data isolation +- Background jobs automatically serialize and restore account context + +**Key insight**: This architecture allows multi-tenancy without subdomains or separate databases, making local development and testing simpler. + +### Authentication & Authorization + +**Passwordless magic link authentication**: +- Global `Identity` (email-based) can have `Users` in multiple Accounts +- Users belong to an Account and have roles: admin, member, system +- Sessions managed via signed cookies +- Board-level access control via `Access` records + +### Core Domain Models + +**Account** → The tenant/organization +- Has users, boards, cards, tags, webhooks +- Has entropy configuration for auto-postponement + +**Identity** → Global user (email) +- Can have Users in multiple Accounts +- Session management tied to Identity + +**User** → Account membership +- Belongs to Account and Identity +- Has role (admin/member/system) +- Board access via explicit `Access` records + +**Board** → Primary organizational unit +- Has columns for workflow stages +- Can be "all access" or selective +- Can be published publicly with shareable key + +**Card** → Main work item (task/issue) +- Sequential number within each Account +- Rich text description and attachments +- Lifecycle: triage → columns → closed/not_now +- Automatically postpones after inactivity ("entropy") + +**Event** → Records all significant actions +- Polymorphic association to changed object +- Drives activity timeline, notifications, webhooks +- Has JSON `particulars` for action-specific data + +### Entropy System + +Cards automatically "postpone" (move to "not now") after inactivity: +- Account-level default entropy period +- Board-level entropy override +- Prevents endless todo lists from accumulating +- Configurable via Account/Board settings + +### UUID Primary Keys + +All tables use UUIDs (UUIDv7 format, base36-encoded as 25-char strings): +- Custom fixture UUID generation maintains deterministic ordering for tests +- Fixtures are always "older" than runtime records +- `.first`/`.last` work correctly in tests + +### Background Jobs (Solid Queue) + +Database-backed job queue (no Redis): +- Custom `FizzyActiveJobExtensions` prepended to ActiveJob +- Jobs automatically capture/restore `Current.account` +- Mission Control::Jobs for monitoring + +Key recurring tasks (via `config/recurring.yml`): +- Deliver bundled notifications (every 30 min) +- Auto-postpone stale cards (hourly) +- Cleanup jobs for expired links, deliveries + +### Sharded Full-Text Search + +16-shard MySQL full-text search instead of Elasticsearch: +- Shards determined by account ID hash (CRC32) +- Search records denormalized for performance +- Models in `app/models/search/` + +## Production Observability + +Grafana MCP tools provide access to production metrics and logs for performance analysis. + +### Datasources +| Name | UID | Use | +|------|-----|-----| +| Thanos (Prometheus) | `PC96415006F908B67` | Metrics, latencies | +| Loki | `e38bdfea-097e-47fa-a7ab-774fd2487741` | Application logs | + +### Key Metrics +- `rails_request_duration_seconds_bucket:rate1m:sum_by_app:quantiles{app="fizzy"}` - Request latency percentiles +- `rails_request_total:rate1m:sum_by_controller_action{app="fizzy"}` - Request rates by endpoint +- `fizzy_replica_wait_seconds` - Database replica consistency wait times + +### Loki Log Labels +Query: `{service_namespace="fizzy", deployment_environment_name="production", service_name="rails"}` + +Useful fields: `event_duration_ms`, `performance_time_db_ms`, `performance_time_cpu_ms`, `rails_endpoint`, `rails_controller` + +### Instrumentation +Yabeda-based metrics exported at `:9394/metrics`. Config in `config/initializers/yabeda.rb`. + +### Chrome MCP (Local Dev) +URL: `http://fizzy.localhost:3006` +Login: david@37signals.com (passwordless magic link auth - check rails console for link) + +Use Chrome MCP tools to interact with the running dev app for UI testing and debugging. + +### Sentry Error Tracking +Organization: `basecamp` | Project: `fizzy` | Region: `https://us.sentry.io` + +Use Sentry MCP tools to investigate production errors: +- `search_issues` - Find grouped issues by natural language query +- `get_issue_details` - Get full stacktrace and context for a specific issue +- `analyze_issue_with_seer` - AI-powered root cause analysis with code fix suggestions + +## Coding style + +Please read the separate file `STYLE.md` for some guidance on coding style. From 88765f5244147472f8517d1fb40ebfc3ff1ae82c Mon Sep 17 00:00:00 2001 From: Jason Zimdars Date: Tue, 25 Nov 2025 16:10:34 -0600 Subject: [PATCH 28/30] Update test for copy changes --- test/models/notification/bundle_test.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/models/notification/bundle_test.rb b/test/models/notification/bundle_test.rb index dc4bf9e43..612087682 100644 --- a/test/models/notification/bundle_test.rb +++ b/test/models/notification/bundle_test.rb @@ -142,7 +142,7 @@ class Notification::BundleTest < ActiveSupport::TestCase assert_not_nil email # Time in Madrid should be 15:30 (UTC+1 in winter) - assert_match /everything since 3pm/i, email.text_part&.body&.to_s + assert_match /notifications since 3pm/i, email.text_part&.body&.to_s end end From d825447e6bac1986abc8b315aa052fb976b4085b Mon Sep 17 00:00:00 2001 From: Jason Zimdars Date: Tue, 25 Nov 2025 16:51:07 -0600 Subject: [PATCH 29/30] Add defensive styles for non-square avatar images --- app/views/layouts/mailer.html.erb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/views/layouts/mailer.html.erb b/app/views/layouts/mailer.html.erb index f878fba23..51acf3ea0 100644 --- a/app/views/layouts/mailer.html.erb +++ b/app/views/layouts/mailer.html.erb @@ -49,13 +49,15 @@ } .avatar { - border-radius: 50%; + aspect-ratio: 1; + border-radius: 2.5em; color: white; display: block; font-weight: 600; height: 2.5em; line-height: 2.5em; mso-line-height-rule: exactly; + object-fit: cover; overflow: hidden; text-align: center; width: 2.5em; From 60e1751cac03d90c789cdfefc0fbc4d28f614583 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Tue, 25 Nov 2025 18:04:46 -0500 Subject: [PATCH 30/30] Update useragent to recognize twitterbot/facebot This UA was pulled from our logs. ref: https://app.fizzy.do/5986089/cards/1775 --- Gemfile.lock | 2 +- test/controllers/allow_browser_test.rb | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index e0d7c83a5..f8001333c 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -18,7 +18,7 @@ GIT GIT remote: https://github.com/basecamp/useragent - revision: b253635dc649394c72b761f09234bfd6dc87516a + revision: 433ca320a42db1266c4b89df74d0abdb9a880c5e specs: useragent (0.16.11) diff --git a/test/controllers/allow_browser_test.rb b/test/controllers/allow_browser_test.rb index bb0e0b416..529caa840 100644 --- a/test/controllers/allow_browser_test.rb +++ b/test/controllers/allow_browser_test.rb @@ -51,4 +51,14 @@ class AllowBrowserTest < ActionDispatch::IntegrationTest assert_response :success end + + test "Facebook/Twitter bot is allowed" do + sign_in_as :kevin + + get cards_path, headers: { + "User-Agent" => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.4 facebookexternalhit/1.1 Facebot Twitterbot/1.0" + } + + assert_response :success + end end