Auto close
Fizzy doesn’t let stale cards stick around forever. Cards automatically move to “Not now” if no one updates, comments, or moves a card for…
- <%= render "entropy/auto_close", model: board, url: board_entropy_path(board), disabled: !Current.user.can_administer_board?(@board) %>
+ <%= render "entropy/auto_close", model: board, url: board_entropy_path(board), disabled: !Current.user.can_administer_board?(board) %>
<% end %>
diff --git a/app/views/cards/columns/edit.html.erb b/app/views/cards/columns/edit.html.erb
index 586fac20f..162bfbbeb 100644
--- a/app/views/cards/columns/edit.html.erb
+++ b/app/views/cards/columns/edit.html.erb
@@ -5,6 +5,7 @@
<%= button_to "Not now", card_not_now_path(@card),
class: [ "card__column-name btn", { "card__column-name--current": @card.postponed? } ],
style: "--column-color: var(--color-card-complete)",
+ disabled: @card.postponed?,
role: "radio",
aria: { checked: @card.postponed? },
data: { scroll_to_target: @card.postponed? ? "target" : nil },
@@ -12,7 +13,8 @@
<%= button_to "Maybe?", card_triage_path(@card), method: :delete,
class: [ "card__column-name card__column-name--stream btn", { "card__column-name--current": @card.awaiting_triage? } ],
- style: "--column-color: var(--color-card-default)",
+ style: "--column-color: var(--color-card-default)",
+ disabled: @card.awaiting_triage?,
role: "radio",
aria: { checked: @card.awaiting_triage? },
data: { scroll_to_target: @card.awaiting_triage? ? "target" : nil },
@@ -25,6 +27,7 @@
<%= button_to "Done", card_closure_path(@card),
class: [ "card__column-name btn", { "card__column-name--current": @card.closed? } ],
style: "--column-color: var(--color-card-complete)",
+ disabled: @card.closed?,
role: "radio",
aria: { checked: @card.closed? },
data: { scroll_to_target: @card.closed? ? "target" : nil },
diff --git a/app/views/events/event/attachments/_attachment.html.erb b/app/views/events/event/attachments/_attachment.html.erb
index c1eb254d0..fdb3b871b 100644
--- a/app/views/events/event/attachments/_attachment.html.erb
+++ b/app/views/events/event/attachments/_attachment.html.erb
@@ -3,9 +3,9 @@
<% height = attachment.metadata["height"] %>
<% if attachment.previewable? %>
- <%= image_tag url_for(attachment.preview(variant)), class: "attachment attachment--image", width: width, height: height %>
+ <%= image_tag rails_representation_path(attachment.preview(variant)), class: "attachment attachment--image", width: width, height: height %>
<% elsif attachment.variable? %>
- <%= image_tag url_for(attachment.variant(variant)), class: "attachment attachment--image", width: width, height: height %>
+ <%= image_tag rails_representation_path(attachment.variant(variant)), class: "attachment attachment--image", width: width, height: height %>
<% else %>
<%= attachment.filename.extension&.downcase.presence || "unknown" %>
diff --git a/app/views/my/menus/_accounts.html.erb b/app/views/my/menus/_accounts.html.erb
index 2fdf9d8a5..6a25fb233 100644
--- a/app/views/my/menus/_accounts.html.erb
+++ b/app/views/my/menus/_accounts.html.erb
@@ -3,7 +3,7 @@
<%= collapsible_nav_section "Accounts" do %>
<%# Bust cache 1 Dec 2025 %>
<% accounts.each do |account| %>
- <%= filter_place_menu_item landing_url(script_name: account.slug), account.name, "marker", current: account == Current.account, turbo: false %>
+ <%= filter_place_menu_item landing_path(script_name: account.slug), account.name, "marker", current: account == Current.account, turbo: false %>
<% end %>
<% end %>
<% end %>
diff --git a/app/views/my/menus/_settings.html.erb b/app/views/my/menus/_settings.html.erb
index 150b6794a..d1251b7c0 100644
--- a/app/views/my/menus/_settings.html.erb
+++ b/app/views/my/menus/_settings.html.erb
@@ -6,7 +6,7 @@
<%= tag.li class: "popup__item", data: { filter_target: "item", navigable_list_target: "item" } do %>
<%= icon_tag "logout", class: "popup__icon" %>
- <%= button_to session_url(script_name: nil), method: :delete, class: "popup__btn btn", data: { turbo: false } do %>
+ <%= button_to session_path(script_name: nil), method: :delete, class: "popup__btn btn", data: { turbo: false } do %>
Sign out
<% end %>
<% end %>
diff --git a/app/views/prompts/cards/_card.html.erb b/app/views/prompts/cards/_card.html.erb
index 2308bc0c7..1dd4494c4 100644
--- a/app/views/prompts/cards/_card.html.erb
+++ b/app/views/prompts/cards/_card.html.erb
@@ -3,6 +3,6 @@
#<%= card.number %> <%= card.title %>
- <%= link_to "##{card.number} #{card.title}", card_url(card) %>
+ <%= link_to "##{card.number} #{card.title}", card_path(card) %>
diff --git a/app/views/sessions/magic_links/show.html.erb b/app/views/sessions/magic_links/show.html.erb
index c4940e146..aba8411f5 100644
--- a/app/views/sessions/magic_links/show.html.erb
+++ b/app/views/sessions/magic_links/show.html.erb
@@ -3,7 +3,7 @@
">
@@ -15,7 +15,7 @@
data: { magic_link_target: "input", action: "keydown.enter->magic-link#submitOnEnter paste->magic-link#submitOnPaste" } %>
<% end %>
-
The code sent to <%= email_address_pending_authentication %> will work for <%= distance_of_time_in_words(MagicLink::EXPIRATION_TIME) %>.
+
The code sent to <%= email_address_pending_authentication %> will work for <%= distance_of_time_in_words(MagicLink::EXPIRATION_TIME) %>.
<% if Rails.env.development? && flash[:magic_link_code].present? %>
diff --git a/app/views/sessions/menus/show.html.erb b/app/views/sessions/menus/show.html.erb
index 9c6867740..09383b72a 100644
--- a/app/views/sessions/menus/show.html.erb
+++ b/app/views/sessions/menus/show.html.erb
@@ -13,7 +13,7 @@
<% @accounts.each do |account| %>
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index 7cf5bdf7c..771a8e924 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -41,7 +41,7 @@
<% if Current.user == @user %>
- <%= button_to session_url(script_name: nil), method: :delete, class: "btn txt-x-small center", data: { turbo: false } do %>
+ <%= button_to session_path(script_name: nil), method: :delete, class: "btn txt-x-small center", data: { turbo: false } do %>
Sign out of Fizzy on this device
<% end %>
<% end %>
diff --git a/app/views/webhooks/event.html.erb b/app/views/webhooks/event.html.erb
index f2920e8d0..7766020a1 100644
--- a/app/views/webhooks/event.html.erb
+++ b/app/views/webhooks/event.html.erb
@@ -1,4 +1,4 @@
<%= @event.description_for(Current.user).to_plain_text %>
<% if @event.eventable %>
-<%= link_to "↗︎", polymorphic_url(@event.eventable) %>
+<%= link_to "↗︎", polymorphic_url(@event.eventable, only_path: true) %>
<% end %>
diff --git a/config/initializers/active_storage.rb b/config/initializers/active_storage.rb
index 3edd75cc8..586c292a1 100644
--- a/config/initializers/active_storage.rb
+++ b/config/initializers/active_storage.rb
@@ -8,6 +8,17 @@ ActiveSupport.on_load(:active_storage_blob) do
end
end
+ActiveSupport.on_load(:action_text_content) do
+ # Install our extensions after ActionText::Engine's
+ ActiveSupport.on_load(:active_storage_blob) do
+ # Ensure all
s have a "url" attribute that's a relative
+ # path (for portability across host name changes, beta environments, etc).
+ def to_rich_text_attributes(*)
+ super.merge url: Rails.application.routes.url_helpers.polymorphic_url(self, only_path: true)
+ end
+ end
+end
+
# Don't configure replica connections for ActiveStorage::Record.
# When ActiveStorage uses `connects_to`, it creates a separate connection pool
# from ApplicationRecord. This causes after_commit callbacks to fire in
diff --git a/script/migrations/convert-absolute-attachment-urls-to-relative.rb b/script/migrations/convert-absolute-attachment-urls-to-relative.rb
new file mode 100644
index 000000000..009b6c4cb
--- /dev/null
+++ b/script/migrations/convert-absolute-attachment-urls-to-relative.rb
@@ -0,0 +1,132 @@
+#!/usr/bin/env ruby
+
+# Convert absolute attachment URLs in rich text content to relative paths.
+# This fixes URLs that were stored with full hostnames (e.g., https://app.fizzy.do/...)
+# making them portable across beta environments and host changes.
+#
+# MUST BE RUN AFTER `decrypt!` when using ActiveRecord Encryption
+#
+# Run locally:
+# bin/rails runner script/migrations/convert-absolute-attachment-urls-to-relative.rb --help
+#
+# Run via Kamal:
+# kamal app exec -d -p --reuse "bin/rails runner script/migrations/convert-absolute-attachment-urls-to-relative.rb --help"
+#
+# Safe to re-run: won't modify already-relative URLs
+
+class ConvertAbsoluteAttachmentUrlsToRelative
+ # Match absolute URLs pointing to Active Storage routes, keeping the account slug
+ ABSOLUTE_URL_PATTERN = %r{https?://[^/]+(/\d+/rails/active_storage/[^"']+)}
+
+ attr_reader :account, :dry_run
+
+ def initialize(account_id: nil, dry_run: false)
+ @account = Account.find_by(external_account_id: account_id)
+ @dry_run = dry_run
+ end
+
+ def run
+ puts "Converting absolute attachment URLs to relative paths"
+ puts dry_run ? "DRY RUN MODE - no changes will be saved" : "LIVE MODE - changes will be saved"
+ puts account ? "Only account: #{account.external_account_id} - #{account.name}" : "For **ALL ACCOUNTS**"
+
+ puts "\nPress ENTER to continue running or CTRL-C to bail..."
+ gets
+
+ puts "\nRunning..."
+
+ # Suppress SQL logs
+ Rails.event.debug_mode = false
+
+ seconds = Benchmark.realtime do
+ suppressing_turbo_broadcasts do
+ convert_urls
+ end
+ end
+
+ puts "\n\n"
+ puts "Finished in %.2f seconds." % seconds
+ end
+
+ private
+ def suppressing_turbo_broadcasts
+ Board.suppressing_turbo_broadcasts do
+ Card.suppressing_turbo_broadcasts do
+ yield
+ end
+ end
+ end
+
+ def convert_urls
+ scanned = 0
+ fixed = 0
+ urls_converted = 0
+
+ action_texts_scope.find_each do |rich_text|
+ scanned += 1
+
+ body = rich_text.body
+
+ edited = false
+ conversions = 0
+
+ body.send(:attachment_nodes).each do |node|
+ url = node["url"]
+ next unless url
+
+ if url.match?(ABSOLUTE_URL_PATTERN)
+ node["url"] = url.gsub(ABSOLUTE_URL_PATTERN, '\1')
+ edited = true
+ conversions += 1
+ end
+ end
+
+ if edited
+ record = rich_text.record
+ puts " - modifying #{record.class.name} #{record.to_param} (account: #{record.account&.external_account_id}) - #{conversions} URL(s)"
+
+ unless dry_run
+ rich_text.update! body: body.fragment.to_html
+ end
+
+ fixed += 1
+ urls_converted += conversions
+ end
+ end
+
+ puts "\n\nConversion complete!"
+ puts " Rich texts examined: #{scanned}"
+ puts " Rich texts modified: #{fixed}"
+ puts " URLs converted: #{urls_converted}"
+ end
+
+ def action_texts_scope
+ # Only examine rich texts that have embedded attachments
+ scope = ActionText::RichText.joins(:embeds_attachments)
+ scope = scope.where(account: account) if account
+ scope
+ end
+end
+
+require "optparse"
+
+options = { account_id: nil, dry_run: true }
+
+OptionParser.new do |opts|
+ opts.banner = "Usage: bin/rails runner #{__FILE__} [options]"
+
+ opts.on("-a", "--account ACCOUNT_ID", "Restrict to a specific account (external_account_id)") do |id|
+ options[:account_id] = id
+ end
+
+ opts.on("--[no-]dry-run", "Run in dry-run mode (default: --dry-run)") do |v|
+ options[:dry_run] = v
+ end
+
+ opts.on("-h", "--help", "Show this help message") do
+ puts opts
+ exit
+ end
+end.parse!
+
+ConvertAbsoluteAttachmentUrlsToRelative.new(**options).run
diff --git a/script/migrations/convert-relative-attachment-urls-to-absolute.rb b/script/migrations/convert-relative-attachment-urls-to-absolute.rb
new file mode 100644
index 000000000..4b201f34f
--- /dev/null
+++ b/script/migrations/convert-relative-attachment-urls-to-absolute.rb
@@ -0,0 +1,127 @@
+#!/usr/bin/env ruby
+
+# Rollback script: Convert relative attachment URLs back to absolute URLs.
+# Use this if you need to rollback the relative URL changes and want to
+# convert rich texts created during the rollout back to absolute URLs.
+#
+# Run locally:
+# bin/rails runner script/migrations/convert-relative-attachment-urls-to-absolute.rb --help
+#
+# Run via Kamal:
+# kamal app exec -d -p --reuse "bin/rails runner script/migrations/convert-relative-attachment-urls-to-absolute.rb --help"
+
+class ConvertRelativeAttachmentUrlsToAbsolute
+ # Match relative URLs pointing to Active Storage routes (with account slug)
+ RELATIVE_URL_PATTERN = %r{\A(/\d+/rails/active_storage/[^"']+)\z}
+
+ attr_reader :host, :since
+
+ def initialize(host:, since:)
+ @host = host
+ @since = since
+ end
+
+ def run
+ puts "Converting relative attachment URLs to absolute URLs"
+ puts "Host: #{host}"
+ puts "Processing rich texts created since: #{since}"
+
+ puts "\nPress ENTER to continue running or CTRL-C to bail..."
+ gets
+
+ puts "\nRunning..."
+
+ seconds = Benchmark.realtime do
+ suppressing_turbo_broadcasts do
+ convert_urls
+ end
+ end
+
+ puts "\n\n"
+ puts "Finished in %.2f seconds." % seconds
+ end
+
+ private
+ def suppressing_turbo_broadcasts
+ Board.suppressing_turbo_broadcasts do
+ Card.suppressing_turbo_broadcasts do
+ yield
+ end
+ end
+ end
+
+ def convert_urls
+ scanned = 0
+ fixed = 0
+ urls_converted = 0
+
+ action_texts_scope.find_each do |rich_text|
+ scanned += 1
+
+ body = rich_text.body
+
+ edited = false
+ conversions = 0
+
+ body.send(:attachment_nodes).each do |node|
+ url = node["url"]
+ next unless url
+
+ if url.match?(RELATIVE_URL_PATTERN)
+ node["url"] = "#{host}#{url}"
+ edited = true
+ conversions += 1
+ end
+ end
+
+ if edited
+ record = rich_text.record
+ puts " - modifying #{record.class.name} #{record.to_param} (account: #{record.account&.external_account_id}) - #{conversions} URL(s)"
+
+ rich_text.update! body: body.fragment.to_html
+
+ fixed += 1
+ urls_converted += conversions
+ end
+ end
+
+ puts "\n\nConversion complete!"
+ puts " Rich texts examined: #{scanned}"
+ puts " Rich texts modified: #{fixed}"
+ puts " URLs converted: #{urls_converted}"
+ end
+
+ def action_texts_scope
+ ActionText::RichText.joins(:embeds_attachments).where("action_text_rich_texts.created_at >= ?", since)
+ end
+end
+
+require "optparse"
+require "time"
+
+options = {}
+
+OptionParser.new do |opts|
+ opts.banner = "Usage: bin/rails runner #{__FILE__} [options]"
+
+ opts.on("--host HOST", "Host to prepend (e.g., https://app.fizzy.do)") do |host|
+ options[:host] = host
+ end
+
+ opts.on("--since TIME", "Process rich texts created since this time (ISO 8601 format)") do |time|
+ options[:since] = Time.parse(time)
+ end
+
+ opts.on("-h", "--help", "Show this help message") do
+ puts opts
+ exit
+ end
+end.parse!
+
+if options[:host].nil? || options[:since].nil?
+ puts "Error: --host and --since are required"
+ puts "Example: bin/rails runner #{__FILE__} --host https://app.fizzy.do --since 2026-01-14T10:00:00Z"
+ exit 1
+end
+
+ConvertRelativeAttachmentUrlsToAbsolute.new(**options).run
diff --git a/test/models/access_test.rb b/test/models/access_test.rb
index 10787e5d3..b4580420d 100644
--- a/test/models/access_test.rb
+++ b/test/models/access_test.rb
@@ -80,4 +80,27 @@ class AccessTest < ActiveSupport::TestCase
assert_not card.watched_by?(kevin)
end
+
+ test "pins are destroyed when access is lost" do
+ kevin = users(:kevin)
+ board = boards(:writebook)
+ card = cards(:logo) # Kevin has pinned this card
+
+ other_board = boards(:miltons_wish_list)
+ other_card = cards(:radio)
+ other_board.accesses.grant_to(kevin)
+ other_card.pin_by(kevin)
+
+ assert card.pinned_by?(kevin)
+ assert other_card.pinned_by?(kevin)
+
+ kevin_access = accesses(:writebook_kevin)
+
+ perform_enqueued_jobs only: Board::CleanInaccessibleDataJob do
+ kevin_access.destroy
+ end
+
+ assert_not card.pinned_by?(kevin)
+ assert other_card.pinned_by?(kevin), "Pin on other board should not be destroyed"
+ end
end