- <%= back_link_to "Actvity", root_path, "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
+ <%= back_link_to "Activity", root_path, "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
diff --git a/app/views/layouts/_lightbox.html.erb b/app/views/layouts/_lightbox.html.erb
index 9f0e23ebf..74f5597a9 100644
--- a/app/views/layouts/_lightbox.html.erb
+++ b/app/views/layouts/_lightbox.html.erb
@@ -1,5 +1,5 @@
<%= tag.dialog class:"lightbox", aria: { label: "Image Viewer (Press escape to close)" },
- data: { controller: "dialog", dialog_target: "dialog", dialog_modal_value: "true", lightbox_target: "dialog", action: "keydown.esc->dialog#close:stop" } do %>
+ data: { controller: "dialog", dialog_target: "dialog", dialog_modal_value: "true", lightbox_target: "dialog", action: "keydown.esc->dialog#close:stop transitionend->lightbox#handleTransitionEnd" } do %>
![]()
diff --git a/app/views/searches/_result.html.erb b/app/views/searches/_result.html.erb
index b2b131910..ec110dd80 100644
--- a/app/views/searches/_result.html.erb
+++ b/app/views/searches/_result.html.erb
@@ -15,7 +15,7 @@
<% end %>
- <%= result.card.board.name %>
+ <%= result.card.board.name %> · <%= local_datetime_tag(result.created_at, style: :timeordate) %>
<% end %>
diff --git a/app/views/sessions/magic_links/show.html.erb b/app/views/sessions/magic_links/show.html.erb
index 931156ff6..4e94f411e 100644
--- a/app/views/sessions/magic_links/show.html.erb
+++ b/app/views/sessions/magic_links/show.html.erb
@@ -10,16 +10,18 @@
<%= form.text_field :code, required: true, class: "input center txt-align-enter txt-large",
autofocus: true, autocorrect: "off", autocapitalize: "off", spellcheck: "false", "data-1p-ignore": true,
autocomplete: "one-time-code", maxlength: "6", placeholder: "••••••", value: params[:code],
- data: { magic_link_target: "input", action: "keydown.enter->magic-link#submit paste->magic-link#submit" } %>
+ data: { magic_link_target: "input", action: "keydown.enter->magic-link#submitOnEnter paste->magic-link#submitOnPaste" } %>
<% end %>
The code you receive will work for <%= distance_of_time_in_words(MagicLink::EXPIRATION_TIME) %>.
-<% if Rails.env.development? %>
-
+<% if Rails.env.development? && flash[:magic_link_code].present? %>
+
<% end %>
<% content_for :footer do %>
diff --git a/app/views/signups/completions/new.html.erb b/app/views/signups/completions/new.html.erb
index 971c39b1d..5be760843 100644
--- a/app/views/signups/completions/new.html.erb
+++ b/app/views/signups/completions/new.html.erb
@@ -9,8 +9,9 @@
You're one step away. Just enter your name to get your own Fizzy account.
<% if @signup.errors.any? %>
-
-
+
+ Your changes couldn't be saved:
+
<% @signup.errors.full_messages.each do |message| %>
- <%= message %>
<% end %>
diff --git a/app/views/users/edit.html.erb b/app/views/users/edit.html.erb
index a3b5845e8..c712dac58 100644
--- a/app/views/users/edit.html.erb
+++ b/app/views/users/edit.html.erb
@@ -14,7 +14,7 @@
@@ -38,6 +38,18 @@
<%= link_to "Change email", new_user_email_address_path(user_id: Current.user.id), class: "btn btn--plain txt-link txt-small txt-nowrap" %>
+
+ <% if @user.errors.any? %>
+
+ Your changes couldn't be saved:
+
+ <% @user.errors.full_messages.each do |message| %>
+ - <%= message %>
+ <% end %>
+
+
+ <% end %>
+
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index eec6444a0..17f418e84 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -18,20 +18,25 @@
<%= @user.name %>
- <% if @user.active? %>
- <%= mail_to @user.identity.email_address %>
- <% else %>
+ <% if !@user.active? %>
<%= @user.name %> is no longer on this account
+ <% elsif !@user.verified? %>
+ Unverified
+ A sign-in code has been sent to this email address, but the user has not yet logged in to confirm their identity.
+ <% else %>
+ <%= mail_to @user.identity.email_address %>
<% end %>
-
- <%= link_to "Which cards are assigned to #{me_or_you}?",
- cards_path(assignee_ids: [ @user.id ], sorted_by: "newest"), class: "btn", data: { turbo_frame: "_top" } %>
- <%= link_to "Which cards were added by #{me_or_you}?",
- cards_path(creator_ids: [ @user.id ], sorted_by: "newest"), class: "btn", data: { turbo_frame: "_top" } %>
-
+ <% if @user.verified? %>
+
+ <%= link_to "Which cards are assigned to #{me_or_you}?",
+ cards_path(assignee_ids: [ @user.id ], sorted_by: "newest"), class: "btn", data: { turbo_frame: "_top" } %>
+ <%= link_to "Which cards were added by #{me_or_you}?",
+ cards_path(creator_ids: [ @user.id ], sorted_by: "newest"), class: "btn", data: { turbo_frame: "_top" } %>
+
+ <% end %>
@@ -48,4 +53,6 @@
<% end %>
-<%= turbo_frame_tag "user_events", src: user_events_path(@user) %>
+<% if @user.verified? %>
+ <%= turbo_frame_tag "user_events", src: user_events_path(@user) %>
+<% end %>
diff --git a/app/views/users/verifications/new.html.erb b/app/views/users/verifications/new.html.erb
new file mode 100644
index 000000000..fe830cd28
--- /dev/null
+++ b/app/views/users/verifications/new.html.erb
@@ -0,0 +1 @@
+<%= auto_submit_form_with url: users_verifications_path, method: :post %>
diff --git a/app/views/webhooks/show.html.erb b/app/views/webhooks/show.html.erb
index a98a8acf3..2fe01f070 100644
--- a/app/views/webhooks/show.html.erb
+++ b/app/views/webhooks/show.html.erb
@@ -22,7 +22,7 @@
<% unless @webhook.active? %>
- <%= button_to "Reactivate", board_webhook_activation_path(@webhook), method: :post %>
+ <%= button_to "Reactivate", board_webhook_activation_path(@webhook.board_id, @webhook), method: :post %>
<% end %>
diff --git a/config/ci.rb b/config/ci.rb
index 053fe2682..a99248a93 100644
--- a/config/ci.rb
+++ b/config/ci.rb
@@ -19,6 +19,8 @@ CI.run do
if Fizzy.saas?
step "Tests: SaaS", "#{SAAS_ENV} bin/rails test"
step "Tests: SaaS System", "#{SAAS_ENV} #{SYSTEM_TEST_ENV} bin/rails test:system"
+ step "Tests: OSS", "#{OSS_ENV} bin/rails test"
+ step "Tests: OSS System", "#{OSS_ENV} #{SYSTEM_TEST_ENV} bin/rails test:system"
else
step "Tests: SQLite", "#{OSS_ENV} bin/rails test"
step "Tests: SQLite System", "#{OSS_ENV} #{SYSTEM_TEST_ENV} bin/rails test:system"
diff --git a/config/deploy.yml b/config/deploy.yml
index be1e3c21e..0e855727d 100644
--- a/config/deploy.yml
+++ b/config/deploy.yml
@@ -1,65 +1,45 @@
-# Name of your application. Used to uniquely configure containers.
+# Name of this app
service: fizzy
-
-# Name of the container image (use your-user/app-name on external registries).
image: fizzy
-# Deploy to these servers.
+
+#-- About your deployment --#
+
+# Where to deploy fizzy
servers:
web:
- - 192.168.0.1
- # job:
- # hosts:
- # - 192.168.0.1
- # cmd: bin/jobs
+ - fizzy.example.com # Set your server name here
-# Enable SSL auto certification via Let's Encrypt and allow for multiple apps on a single web server.
-# If used with Cloudflare, set encryption mode in SSL/TLS setting to "Full" to enable CF-to-app encryption.
-#
-# Using an SSL proxy like this requires turning on config.assume_ssl and config.force_ssl in production.rb!
-#
-# Don't use this when deploying to multiple web servers (then you have to terminate SSL at your load balancer).
-#
-# proxy:
-# ssl: true
-# host: app.example.com
+# How you connect to your server
+ssh:
+ user: root # If you use a different username to SSH to your server, specify it here
-# Where you keep your container images.
-registry:
- # Alternatives: hub.docker.com / registry.digitalocean.com / ghcr.io / ...
- server: localhost:5555
+# Automatic SSL
+proxy:
+ ssl: true # Set this to false if you *don't* want SSL
+ host: fizzy.example.com # Set your server name here to use automatic SSL
- # Needed for authenticated registries.
- # username: your-user
-
- # Always use an access token rather than real password when possible.
- # password:
- # - KAMAL_REGISTRY_PASSWORD
-
-# Inject ENV variables into containers (secrets come from .kamal/secrets).
+# Your application configuration (secrets come from .kamal/secrets).
env:
secret:
- - RAILS_MASTER_KEY
+ - SECRET_KEY_BASE
+ - VAPID_PUBLIC_KEY
+ - VAPID_PRIVATE_KEY
+ - SMTP_USERNAME
+ - SMTP_PASSWORD
clear:
- # Run the Solid Queue Supervisor inside the web server's Puma process to do jobs.
- # When you start using multiple servers, you should split out job processing to a dedicated machine.
- SOLID_QUEUE_IN_PUMA: true
+ MAILER_FROM_ADDRESS: support@example.com # The email address that Fizzy sends email from
+ SOLID_QUEUE_IN_PUMA: true # Run background jobs in the app container
- # Set number of processes dedicated to Solid Queue (default: 1)
- # JOB_CONCURRENCY: 3
- # Set number of cores available to the application on each server (default: 1).
- # WEB_CONCURRENCY: 2
+#-- General configuration --#
- # Match this to any external database server to configure Active Record correctly
- # Use fizzy-db for a db accessory server on same machine via local kamal docker network.
- # DB_HOST: 192.168.0.2
+# Use a local registry to deploy
+registry:
+ server: localhost:5555
- # Log everything from Rails
- # RAILS_LOG_LEVEL: debug
-
-# Aliases are triggered with "bin/kamal ". You can overwrite arguments on invocation:
-# "bin/kamal logs -r job" will tail logs from the first server in the job section.
+# Handy aliases for interacting with your deployment. For eaxmple: `bin/kamal console` will connect to a
+# Rails console in production.
aliases:
console: app exec --interactive --reuse "bin/rails console"
shell: app exec --interactive --reuse "bash"
@@ -76,45 +56,6 @@ volumes:
# version inside the asset_path.
asset_path: /rails/public/assets
-
# Configure the image builder.
builder:
arch: amd64
-
- # # Build image via remote server (useful for faster amd64 builds on arm64 computers)
- # remote: ssh://docker@docker-builder-server
- #
- # # Pass arguments and secrets to the Docker build process
- # args:
- # RUBY_VERSION: ruby-3.4.7
- # secrets:
- # - GITHUB_TOKEN
- # - RAILS_MASTER_KEY
-
-# Use a different ssh user than root
-# ssh:
-# user: app
-
-# Use accessory services (secrets come from .kamal/secrets).
-# accessories:
-# db:
-# image: mysql:8.0
-# host: 192.168.0.2
-# # Change to 3306 to expose port to the world instead of just local network.
-# port: "127.0.0.1:3306:3306"
-# env:
-# clear:
-# MYSQL_ROOT_HOST: '%'
-# secret:
-# - MYSQL_ROOT_PASSWORD
-# files:
-# - config/mysql/production.cnf:/etc/mysql/my.cnf
-# - db/production.sql:/docker-entrypoint-initdb.d/setup.sql
-# directories:
-# - data:/var/lib/mysql
-# redis:
-# image: valkey/valkey:8
-# host: 192.168.0.2
-# port: 6379
-# directories:
-# - data:/data
diff --git a/config/environments/production.rb b/config/environments/production.rb
index bdb274efb..7b29a00d1 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -3,6 +3,21 @@ require "active_support/core_ext/integer/time"
Rails.application.configure do
# Settings specified here will take precedence over those in config/application.rb.
+ # Email provider Settings
+ #
+ # Configure these according to whichever email provider you use. An example setup
+ # using SMTP looks like the following:
+ #
+ # config.action_mailer.smtp_settings = {
+ # address: 'smtp.example.com', # The address of your email provider's SMTP server
+ # port: 2525,
+ # domain: 'example.com', # Your domain, which Fizzy will send email from
+ # user_name: ENV["SMTP_USERNAME"],
+ # password: ENV["SMTP_PASSWORD"],
+ # authentication: :plain,
+ # enable_starttls_auto: true
+ # }
+
# Code is not reloaded between requests.
config.enable_reloading = false
diff --git a/config/initializers/action_text.rb b/config/initializers/action_text.rb
index b2724b1c7..eee87de0d 100644
--- a/config/initializers/action_text.rb
+++ b/config/initializers/action_text.rb
@@ -7,7 +7,7 @@ module ActionText
# This overrides the default :embeds association!
has_many_attached :embeds do |attachable|
::Attachments::VARIANTS.each do |variant_name, variant_options|
- attachable.variant variant_name, variant_options.merge(preprocessed: true)
+ attachable.variant variant_name, **variant_options, process: :immediately
end
end
end
diff --git a/config/initializers/active_storage.rb b/config/initializers/active_storage.rb
index d00bd74bf..4a4a0343d 100644
--- a/config/initializers/active_storage.rb
+++ b/config/initializers/active_storage.rb
@@ -4,9 +4,17 @@ ActiveSupport.on_load(:active_storage_blob) do
end
end
-ActiveSupport.on_load(:active_storage_record) do
- configure_replica_connections
-end
+# Don't configure replica connections for ActiveStorage::Record.
+# When ActiveStorage uses `connects_to`, it creates a separate connection pool
+# from ApplicationRecord. This causes after_commit callbacks to fire in
+# non-deterministic order - the Attachment's create_variants callback can fire
+# before the User model's upload callback, causing FileNotFoundError when
+# using `process: :immediately` for variants.
+# See: https://github.com/rails/rails/issues/53694
+#
+# ActiveSupport.on_load(:active_storage_record) do
+# configure_replica_connections
+# end
module ActiveStorageControllerExtensions
extend ActiveSupport::Concern
diff --git a/config/initializers/autotuner.rb b/config/initializers/autotuner.rb
index ec8572b11..33eab9a05 100644
--- a/config/initializers/autotuner.rb
+++ b/config/initializers/autotuner.rb
@@ -3,12 +3,14 @@
Autotuner.enabled = true
# This callback is called whenever a suggestion is provided by this gem.
-# You can output this report to your logging pipeline, stdout, a file,
-# or somewhere else!
-Autotuner.reporter = proc do |report|
+# Log to structured logging for query/analysis in Loki. This is called
+# once per autotuner heuristic.
+Autotuner.reporter = proc do |heuristic_report|
+ report = heuristic_report.to_s
+
Rails.logger.info "GCAUTOTUNE: #{report}"
- if Fizzy.saas?
- Sentry.capture_message "Autotuner suggestion", level: :info, extra: { report: report.to_s }
- end
+ RailsStructuredLogging.instrument_script "autotuner" do
+ Rails.logger.info report.to_s
+ end if defined? RailsStructuredLogging
end
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index b3076b38f..fe37a5cde 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -1,25 +1,45 @@
# Be sure to restart your server when you modify this file.
-# Define an application-wide content security policy.
-# See the Securing Rails Applications Guide for more information:
-# https://guides.rubyonrails.org/security.html#content-security-policy-header
+# Define an application-wide Content Security Policy.
+# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
-# Rails.application.configure do
-# config.content_security_policy do |policy|
-# policy.default_src :self, :https
-# policy.font_src :self, :https, :data
-# policy.img_src :self, :https, :data
-# policy.object_src :none
-# policy.script_src :self, :https
-# policy.style_src :self, :https
-# # Specify URI for violation reports
-# # policy.report_uri "/csp-violation-report-endpoint"
-# end
-#
-# # Generate session nonces for permitted importmap, inline scripts, and inline styles.
-# config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
-# config.content_security_policy_nonce_directives = %w(script-src style-src)
-#
-# # Report violations without enforcing the policy.
-# # config.content_security_policy_report_only = true
-# end
+Rails.application.configure do
+ # Configure with environment variables with fallback to config.x values (via fizzy-sass)
+ report_uri = ENV.fetch("CSP_REPORT_URI") { config.x.content_security_policy.report_uri }
+ report_only =
+ if ENV.key?("CSP_REPORT_ONLY")
+ ENV["CSP_REPORT_ONLY"] == "true"
+ else
+ config.x.content_security_policy.report_only
+ end
+
+ # Generate nonces for importmap and inline scripts
+ config.content_security_policy_nonce_generator = ->(request) { SecureRandom.base64(16) }
+ config.content_security_policy_nonce_directives = %w[ script-src ]
+
+ config.content_security_policy do |policy|
+ policy.default_src :self
+ policy.script_src :self, "https://challenges.cloudflare.com"
+ policy.connect_src :self, "https://storage.basecamp.com"
+ policy.frame_src :self, "https://challenges.cloudflare.com"
+
+ # Don't fight user tools: permit inline styles, data:/https: sources, and
+ # blob: workers for accessibility extensions, privacy tools, and custom fonts.
+ policy.style_src :self, :unsafe_inline
+ policy.img_src :self, "blob:", "data:", "https:"
+ policy.font_src :self, "data:", "https:"
+ policy.media_src :self, "blob:", "data:", "https:"
+ policy.worker_src :self, "blob:"
+
+ policy.object_src :none
+ policy.base_uri :none
+ policy.form_action :self
+ policy.frame_ancestors :self
+
+ # Specify URI for violation reports (e.g., Sentry CSP endpoint)
+ policy.report_uri report_uri if report_uri
+ end
+
+ # Report violations without enforcing the policy.
+ config.content_security_policy_report_only = report_only
+end unless ENV["DISABLE_CSP"]
diff --git a/config/initializers/error_context.rb b/config/initializers/error_context.rb
new file mode 100644
index 000000000..a1b207b6e
--- /dev/null
+++ b/config/initializers/error_context.rb
@@ -0,0 +1,7 @@
+# Lazily add identity and account context to error reports.
+# Only evaluated when an error is actually reported.
+Rails.error.add_middleware ->(error, context:, **) do
+ context.merge \
+ identity_id: Current.identity&.id,
+ account_id: Current.account&.external_account_id
+end
diff --git a/config/initializers/web_push.rb b/config/initializers/web_push.rb
index ac960468e..6914dae22 100644
--- a/config/initializers/web_push.rb
+++ b/config/initializers/web_push.rb
@@ -17,7 +17,15 @@ end
module WebPush::PersistentRequest
def perform
- if @options[:connection]
+ endpoint_ip = @options[:endpoint_ip]
+
+ if endpoint_ip
+ http = Net::HTTP.new(uri.host, uri.port, ipaddr: endpoint_ip)
+ http.use_ssl = true
+ http.ssl_timeout = @options[:ssl_timeout] unless @options[:ssl_timeout].nil?
+ http.open_timeout = @options[:open_timeout] unless @options[:open_timeout].nil?
+ http.read_timeout = @options[:read_timeout] unless @options[:read_timeout].nil?
+ elsif @options[:connection]
http = @options[:connection]
else
http = Net::HTTP.new(uri.host, uri.port, *proxy_options)
diff --git a/config/puma.rb b/config/puma.rb
index 8d09b00ac..489ae0779 100644
--- a/config/puma.rb
+++ b/config/puma.rb
@@ -25,7 +25,7 @@ if !Rails.env.local?
# worker per CPU, 1 thread per worker and tune it from there.
#
# https://edgeguides.rubyonrails.org/tuning_performance_for_deployment.html#puma
- workers Concurrent.physical_processor_count
+ workers Integer(ENV.fetch("WEB_CONCURRENCY") { Concurrent.physical_processor_count })
threads 1, 1
# Tell the Ruby VM that we're finished booting up.
diff --git a/config/queue.yml b/config/queue.yml
index 130b0d9bd..3f5615fa8 100644
--- a/config/queue.yml
+++ b/config/queue.yml
@@ -5,7 +5,7 @@ default: &default
workers:
- queues: [ "default", "solid_queue_recurring", "backend", "webhooks" ]
threads: 3
- processes: <%= ENV.fetch("JOB_CONCURRENCY", Concurrent.physical_processor_count) %>
+ processes: <%= Integer(ENV.fetch("JOB_CONCURRENCY") { Concurrent.physical_processor_count }) %>
polling_interval: 0.1
development: *default
diff --git a/config/routes.rb b/config/routes.rb
index 9fa8f81bf..e67e4ef7c 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -138,6 +138,7 @@ Rails.application.routes.draw do
namespace :users do
resources :joins
+ resources :verifications, only: %i[ new create ]
end
resource :session do
diff --git a/db/migrate/20251205010536_add_verified_at_to_users.rb b/db/migrate/20251205010536_add_verified_at_to_users.rb
new file mode 100644
index 000000000..b853cb952
--- /dev/null
+++ b/db/migrate/20251205010536_add_verified_at_to_users.rb
@@ -0,0 +1,5 @@
+class AddVerifiedAtToUsers < ActiveRecord::Migration[8.2]
+ def change
+ add_column :users, :verified_at, :datetime
+ end
+end
diff --git a/db/schema.rb b/db/schema.rb
index b84d3c160..42458db17 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
#
# It's strongly recommended that you check this file into your version control system.
-ActiveRecord::Schema[8.2].define(version: 2025_12_01_100607) do
+ActiveRecord::Schema[8.2].define(version: 2025_12_05_010536) do
create_table "accesses", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
t.datetime "accessed_at"
t.uuid "account_id", null: false
@@ -726,6 +726,7 @@ ActiveRecord::Schema[8.2].define(version: 2025_12_01_100607) do
t.string "name", null: false
t.string "role", default: "member", null: false
t.datetime "updated_at", null: false
+ t.datetime "verified_at"
t.index ["account_id", "identity_id"], name: "index_users_on_account_id_and_identity_id", unique: true
t.index ["account_id", "role"], name: "index_users_on_account_id_and_role"
t.index ["identity_id"], name: "index_users_on_identity_id"
diff --git a/db/schema_sqlite.rb b/db/schema_sqlite.rb
index 6f6d6cf53..1dd2b3e00 100644
--- a/db/schema_sqlite.rb
+++ b/db/schema_sqlite.rb
@@ -10,7 +10,7 @@
#
# It's strongly recommended that you check this file into your version control system.
-ActiveRecord::Schema[8.2].define(version: 2025_12_01_100607) do
+ActiveRecord::Schema[8.2].define(version: 2025_12_05_010536) do
create_table "accesses", id: :uuid, force: :cascade do |t|
t.datetime "accessed_at"
t.uuid "account_id", null: false
@@ -499,6 +499,7 @@ ActiveRecord::Schema[8.2].define(version: 2025_12_01_100607) do
t.string "name", limit: 255, null: false
t.string "role", limit: 255, default: "member", null: false
t.datetime "updated_at", null: false
+ t.datetime "verified_at"
t.index ["account_id", "identity_id"], name: "index_users_on_account_id_and_identity_id", unique: true
t.index ["account_id", "role"], name: "index_users_on_account_id_and_role"
t.index ["identity_id"], name: "index_users_on_identity_id"
diff --git a/db/seeds.rb b/db/seeds.rb
index bb8db7db8..7cba1b5f9 100644
--- a/db/seeds.rb
+++ b/db/seeds.rb
@@ -36,7 +36,7 @@ else
if user = identity.users.find_by(account: Current.account)
user
else
- User.create!(name: full_name, identity: identity, account: Current.account)
+ User.create!(name: full_name, identity: identity, account: Current.account, verified_at: Time.current)
end
end
diff --git a/lib/web_push/notification.rb b/lib/web_push/notification.rb
index d2865ff46..4c873fb48 100644
--- a/lib/web_push/notification.rb
+++ b/lib/web_push/notification.rb
@@ -1,13 +1,13 @@
class WebPush::Notification
- def initialize(title:, body:, path:, badge:, endpoint:, p256dh_key:, auth_key:)
+ def initialize(title:, body:, path:, badge:, endpoint:, endpoint_ip:, p256dh_key:, auth_key:)
@title, @body, @path, @badge = title, body, path, badge
- @endpoint, @p256dh_key, @auth_key = endpoint, p256dh_key, auth_key
+ @endpoint, @endpoint_ip, @p256dh_key, @auth_key = endpoint, endpoint_ip, p256dh_key, auth_key
end
def deliver(connection: nil)
WebPush.payload_send \
message: encoded_message,
- endpoint: @endpoint, p256dh: @p256dh_key, auth: @auth_key,
+ endpoint: @endpoint, endpoint_ip: @endpoint_ip, p256dh: @p256dh_key, auth: @auth_key,
vapid: vapid_identification,
connection: connection,
urgency: "high"
diff --git a/script/migrations/20251205-backfill-verified-at.rb b/script/migrations/20251205-backfill-verified-at.rb
new file mode 100755
index 000000000..7cd4f0030
--- /dev/null
+++ b/script/migrations/20251205-backfill-verified-at.rb
@@ -0,0 +1,112 @@
+#!/usr/bin/env ruby
+
+require_relative "../../config/environment"
+
+BACKFILL_TIMESTAMP = Time.parse("2025-12-02 12:00:00 UTC")
+
+def collect_verified_user_ids
+ verified_ids = Set.new
+
+ # Owners (they created the account)
+ verified_ids.merge(User.where(role: :owner).pluck(:id))
+ puts "After owners: #{verified_ids.size} users"
+
+ # Card creators
+ verified_ids.merge(Card.distinct.pluck(:creator_id).compact)
+ puts "After card creators: #{verified_ids.size} users"
+
+ # Comment creators
+ verified_ids.merge(Comment.distinct.pluck(:creator_id).compact)
+ puts "After comment creators: #{verified_ids.size} users"
+
+ # Board creators
+ verified_ids.merge(Board.distinct.pluck(:creator_id).compact)
+ puts "After board creators: #{verified_ids.size} users"
+
+ # Event creators
+ verified_ids.merge(Event.distinct.pluck(:creator_id).compact)
+ puts "After event creators: #{verified_ids.size} users"
+
+ # Assigners (not assignees - they could be assigned without logging in)
+ verified_ids.merge(Assignment.distinct.pluck(:assigner_id).compact)
+ puts "After assigners: #{verified_ids.size} users"
+
+ # Manual closers (user_id is nil for automatic closures)
+ verified_ids.merge(Closure.where.not(user_id: nil).distinct.pluck(:user_id).compact)
+ puts "After closers: #{verified_ids.size} users"
+
+ # Manual postponers (user_id is nil for automatic entropy postponements)
+ verified_ids.merge(Card::NotNow.where.not(user_id: nil).distinct.pluck(:user_id).compact)
+ puts "After postponers: #{verified_ids.size} users"
+
+ # Reactors
+ verified_ids.merge(Reaction.distinct.pluck(:reacter_id).compact)
+ puts "After reactors: #{verified_ids.size} users"
+
+ # Filter creators
+ verified_ids.merge(Filter.distinct.pluck(:creator_id).compact)
+ puts "After filter creators: #{verified_ids.size} users"
+
+ # Pinners
+ verified_ids.merge(Pin.distinct.pluck(:user_id).compact)
+ puts "After pinners: #{verified_ids.size} users"
+
+ # Board accessors (accessed_at is touched when viewing boards)
+ verified_ids.merge(Access.where.not(accessed_at: nil).distinct.pluck(:user_id).compact)
+ puts "After board accessors: #{verified_ids.size} users"
+
+ # Export requesters
+ verified_ids.merge(Account::Export.distinct.pluck(:user_id).compact)
+ puts "After export requesters: #{verified_ids.size} users"
+
+ # Push subscribers
+ verified_ids.merge(Push::Subscription.distinct.pluck(:user_id).compact)
+ puts "After push subscribers: #{verified_ids.size} users"
+
+ # Users who completed setup (name != email)
+ verified_ids.merge(
+ User.joins(:identity)
+ .where.not("users.name = identities.email_address")
+ .pluck(:id)
+ )
+ puts "After setup completers: #{verified_ids.size} users"
+
+ # Users whose identity has at least one session
+ verified_ids.merge(
+ User.where(identity_id: Session.distinct.select(:identity_id)).pluck(:id)
+ )
+ puts "After identity sessions: #{verified_ids.size} users"
+
+ verified_ids
+end
+
+puts "Collecting verified user IDs..."
+verified_user_ids = collect_verified_user_ids
+
+puts "\nFiltering to unverified users only..."
+users_to_update = User.where(id: verified_user_ids.to_a)
+ .where(verified_at: nil)
+ .where(active: true)
+ .where.not(identity_id: nil)
+ .where.not(role: :system)
+
+update_count = users_to_update.count
+puts "Found #{update_count} users to backfill"
+
+# Report remaining unverified users (before update)
+remaining_before = User.where(verified_at: nil, active: true)
+ .where.not(identity_id: nil)
+ .where.not(role: :system)
+ .count
+remaining_after = remaining_before - update_count
+puts "\nCurrently unverified active users: #{remaining_before}"
+puts "After backfill, remaining unverified: #{remaining_after}"
+puts "These users will need to verify on next login."
+
+if update_count > 0
+ puts "\nBackfilling verified_at..."
+ updated = users_to_update.update_all(verified_at: BACKFILL_TIMESTAMP)
+ puts "Updated #{updated} users"
+end
+
+puts "\nDone!"
diff --git a/test/controllers/boards_controller_test.rb b/test/controllers/boards_controller_test.rb
index 816a2e7b3..a7e3580de 100644
--- a/test/controllers/boards_controller_test.rb
+++ b/test/controllers/boards_controller_test.rb
@@ -145,4 +145,49 @@ class BoardsControllerTest < ActionDispatch::IntegrationTest
assert_response :forbidden
end
+
+ test "disables select all/none buttons for non-privileged user" do
+ logout_and_sign_in_as :jz
+ assert_not users(:jz).can_administer_board?(boards(:writebook))
+
+ get edit_board_path(boards(:writebook))
+
+ assert_response :success
+ assert_select "button[disabled]", text: "Select all"
+ assert_select "button[disabled]", text: "Select none"
+ end
+
+ test "enables select all/none buttons for privileged user" do
+ assert users(:kevin).can_administer_board?(boards(:writebook))
+
+ get edit_board_path(boards(:writebook))
+
+ assert_response :success
+ assert_select "button:not([disabled])", text: "Select all"
+ assert_select "button:not([disabled])", text: "Select none"
+ end
+
+ test "access toggle disabled state is cached correctly" do
+ board = boards(:writebook)
+ david = users(:david)
+
+ with_actionview_partial_caching do
+ # privileged user
+ assert users(:kevin).can_administer_board?(board)
+
+ get edit_board_path(board)
+
+ assert_response :success
+ assert_select "input.switch__input[name='user_ids[]'][value='#{david.id}']:not([disabled])"
+
+ # unprivileged user
+ logout_and_sign_in_as :jz
+ assert_not users(:jz).can_administer_board?(board)
+
+ get edit_board_path(board)
+
+ assert_response :success
+ assert_select "input.switch__input[name='user_ids[]'][value='#{david.id}'][disabled]"
+ end
+ end
end
diff --git a/test/controllers/join_codes_controller_test.rb b/test/controllers/join_codes_controller_test.rb
index fe8c820d9..415bde3e5 100644
--- a/test/controllers/join_codes_controller_test.rb
+++ b/test/controllers/join_codes_controller_test.rb
@@ -36,7 +36,7 @@ class JoinCodesControllerTest < ActionDispatch::IntegrationTest
end
assert_redirected_to session_magic_link_url(script_name: nil)
- assert_equal new_users_join_url(script_name: @account.slug), session[:return_to_after_authenticating]
+ assert_equal new_users_verification_url(script_name: @account.slug), session[:return_to_after_authenticating]
end
test "create for existing identity" do
@@ -55,7 +55,7 @@ class JoinCodesControllerTest < ActionDispatch::IntegrationTest
assert_redirected_to landing_url(script_name: @account.slug)
end
- test "create for signed-in identity without a user in the account redirects to user setup" do
+ test "create for signed-in identity without a user in the account redirects to verification" do
identity = identities(:mike)
sign_in_as :mike
@@ -67,6 +67,31 @@ class JoinCodesControllerTest < ActionDispatch::IntegrationTest
end
end
- assert_redirected_to new_users_join_url(script_name: @account.slug)
+ assert_redirected_to new_users_verification_url(script_name: @account.slug)
+ end
+
+ test "create for different identity terminates existing session" do
+ sign_in_as :kevin
+
+ assert_difference -> { Identity.count }, 1 do
+ assert_difference -> { User.count }, 1 do
+ post join_path(code: @join_code.code, script_name: @account.slug), params: { email_address: "new_user@example.com" }
+ end
+ end
+
+ assert_redirected_to session_magic_link_url(script_name: nil)
+ assert_not_predicate cookies[:session_token], :present?
+ end
+
+ test "create with invalid email address" do
+ # Avoid Sentry exceptions when attackers try to stuff invalid emails into the system
+ without_action_dispatch_exception_handling do
+ assert_no_difference -> { Identity.count } do
+ assert_no_difference -> { User.count } do
+ post join_path(code: @join_code.code, script_name: @account.slug), params: { email_address: "not-a-valid-email" }
+ end
+ end
+ assert_response :unprocessable_entity
+ end
end
end
diff --git a/test/controllers/notifications/settings_controller_test.rb b/test/controllers/notifications/settings_controller_test.rb
new file mode 100644
index 000000000..d8472bb02
--- /dev/null
+++ b/test/controllers/notifications/settings_controller_test.rb
@@ -0,0 +1,24 @@
+require "test_helper"
+
+class Notifications::SettingsControllerTest < ActionDispatch::IntegrationTest
+ setup do
+ @user = users(:david)
+
+ sign_in_as @user
+ end
+
+ test "show" do
+ get notifications_settings_path
+
+ assert_response :success
+ end
+
+ test "update email frequency" do
+ assert_changes -> { @user.reload.settings.bundle_email_frequency }, from: "never", to: "every_few_hours" do
+ put notifications_settings_path, params: { user_settings: { bundle_email_frequency: "every_few_hours" } }
+ end
+
+ assert_redirected_to notifications_settings_path
+ assert_equal "Settings updated", flash[:notice]
+ end
+end
diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb
index f2318bf46..7ebe4d518 100644
--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -36,15 +36,29 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
end
end
- private
- test "destroy" do
- sign_in_as :kevin
-
+ test "create with invalid email address" do
+ # Avoid Sentry exceptions when attackers try to stuff invalid emails. The browser performs form
+ # field validation that should normally prevent this from occurring, so I'm not worried about
+ # returning proper validation errors.
+ without_action_dispatch_exception_handling do
untenanted do
- delete session_path
+ assert_no_difference -> { Identity.count } do
+ post session_path, params: { email_address: "not-a-valid-email" }
+ end
- assert_redirected_to new_session_path
- assert_not cookies[:session_token].present?
+ assert_response :unprocessable_entity
end
end
+ end
+
+ test "destroy" do
+ sign_in_as :kevin
+
+ untenanted do
+ delete session_path
+
+ assert_redirected_to new_session_path
+ assert_not cookies[:session_token].present?
+ end
+ end
end
diff --git a/test/controllers/signups_controller_test.rb b/test/controllers/signups_controller_test.rb
index 83fea8882..17314ee90 100644
--- a/test/controllers/signups_controller_test.rb
+++ b/test/controllers/signups_controller_test.rb
@@ -34,15 +34,17 @@ class SignupsControllerTest < ActionDispatch::IntegrationTest
end
end
- test "create with email address containing blanks" do
- untenanted do
- assert_no_difference -> { Identity.count } do
- assert_no_difference -> { MagicLink.count } do
- post signup_path, params: { signup: { email_address: "sam smith@example.com" } }
+ test "create with invalid email address" do
+ without_action_dispatch_exception_handling do
+ untenanted do
+ assert_no_difference -> { Identity.count } do
+ assert_no_difference -> { MagicLink.count } do
+ post signup_path, params: { signup: { email_address: "not-a-valid-email" } }
+ end
end
- end
- assert_response :unprocessable_entity
+ assert_response :unprocessable_entity
+ end
end
end
diff --git a/test/controllers/users/push_subscriptions_controller_test.rb b/test/controllers/users/push_subscriptions_controller_test.rb
index 9c77dec9d..c41d8313e 100644
--- a/test/controllers/users/push_subscriptions_controller_test.rb
+++ b/test/controllers/users/push_subscriptions_controller_test.rb
@@ -1,12 +1,15 @@
require "test_helper"
class Users::PushSubscriptionsControllerTest < ActionDispatch::IntegrationTest
+ PUBLIC_TEST_IP = "142.250.185.206"
+
setup do
sign_in_as :david
+ stub_dns_resolution(PUBLIC_TEST_IP)
end
test "create new push subscription" do
- subscription_params = { "endpoint" => "https://apple", "p256dh_key" => "123", "auth_key" => "456" }
+ subscription_params = { "endpoint" => "https://fcm.googleapis.com/fcm/send/abc123", "p256dh_key" => "123", "auth_key" => "456" }
post user_push_subscriptions_path(users(:david)),
params: { push_subscription: subscription_params }, headers: { "HTTP_USER_AGENT" => "Mozilla/5.0" }
@@ -19,7 +22,7 @@ class Users::PushSubscriptionsControllerTest < ActionDispatch::IntegrationTest
test "touch existing subscription" do
existing_subscription = users(:david).push_subscriptions.create!(
- endpoint: "https://apple",
+ endpoint: "https://fcm.googleapis.com/fcm/send/abc123",
p256dh_key: "123",
auth_key: "456"
)
@@ -37,7 +40,7 @@ class Users::PushSubscriptionsControllerTest < ActionDispatch::IntegrationTest
test "destroy a push subscription" do
subscription = users(:david).push_subscriptions.create!(
- endpoint: "https://apple",
+ endpoint: "https://fcm.googleapis.com/fcm/send/abc123",
p256dh_key: "123",
auth_key: "456"
)
@@ -47,4 +50,35 @@ class Users::PushSubscriptionsControllerTest < ActionDispatch::IntegrationTest
assert_redirected_to user_push_subscriptions_path(users(:david))
end
end
+
+ test "rejects subscription with non-permitted endpoint" do
+ subscription_params = { "endpoint" => "https://attacker.example.com/steal", "p256dh_key" => "123", "auth_key" => "456" }
+
+ assert_no_difference -> { Push::Subscription.count } do
+ post user_push_subscriptions_path(users(:david)),
+ params: { push_subscription: subscription_params }
+ end
+
+ assert_response :unprocessable_entity
+ end
+
+ test "rejects subscription with endpoint resolving to private IP" do
+ stub_dns_resolution("192.168.1.1")
+
+ subscription_params = { "endpoint" => "https://fcm.googleapis.com/fcm/send/abc123", "p256dh_key" => "123", "auth_key" => "456" }
+
+ assert_no_difference -> { Push::Subscription.count } do
+ post user_push_subscriptions_path(users(:david)),
+ params: { push_subscription: subscription_params }
+ end
+
+ assert_response :unprocessable_entity
+ end
+
+ private
+ def stub_dns_resolution(*ips)
+ dns_mock = mock("dns")
+ dns_mock.stubs(:each_address).multiple_yields(*ips)
+ Resolv::DNS.stubs(:open).yields(dns_mock)
+ end
end
diff --git a/test/controllers/users/verifications_controller_test.rb b/test/controllers/users/verifications_controller_test.rb
new file mode 100644
index 000000000..25ecdba1c
--- /dev/null
+++ b/test/controllers/users/verifications_controller_test.rb
@@ -0,0 +1,24 @@
+require "test_helper"
+
+class Users::VerificationsControllerTest < ActionDispatch::IntegrationTest
+ test "new renders the auto-submit form" do
+ sign_in_as :david
+
+ get new_users_verification_path
+
+ assert_response :ok
+ end
+
+ test "create verifies the user and redirects to join" do
+ sign_in_as :david
+
+ user = users(:david)
+ user.update_column(:verified_at, nil)
+ assert_not user.verified?
+
+ post users_verifications_path
+
+ assert_redirected_to new_users_join_path
+ assert user.reload.verified?
+ end
+end
diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index 081579dfc..385bacaf3 100644
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -64,4 +64,26 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
delete user_path(users(:david))
assert_response :forbidden
end
+
+ test "update with invalid avatar shows validation error" do
+ sign_in_as :kevin
+
+ svg_file = fixture_file_upload("avatar.svg", "image/svg+xml")
+
+ put user_path(users(:kevin)), params: { user: { avatar: svg_file } }
+ assert_response :unprocessable_entity
+ assert_select "form[action='#{user_path(users(:kevin))}']"
+ assert_select ".txt-negative", text: /must be a JPEG, PNG, GIF, or WebP image/
+ end
+
+ test "update with valid avatar" do
+ sign_in_as :kevin
+
+ png_file = fixture_file_upload("avatar.png", "image/png")
+
+ put user_path(users(:kevin)), params: { user: { avatar: png_file } }
+ assert_redirected_to user_path(users(:kevin))
+ assert users(:kevin).reload.avatar.attached?
+ assert_equal "image/png", users(:kevin).avatar.content_type
+ end
end
diff --git a/test/controllers/webhooks_controller_test.rb b/test/controllers/webhooks_controller_test.rb
index 2cd427b5b..c9316172d 100644
--- a/test/controllers/webhooks_controller_test.rb
+++ b/test/controllers/webhooks_controller_test.rb
@@ -14,6 +14,10 @@ class WebhooksControllerTest < ActionDispatch::IntegrationTest
webhook = webhooks(:active)
get board_webhook_path(webhook.board, webhook)
assert_response :success
+
+ webhook = webhooks(:inactive)
+ get board_webhook_path(webhook.board, webhook)
+ assert_response :success
end
test "new" do
@@ -63,6 +67,11 @@ class WebhooksControllerTest < ActionDispatch::IntegrationTest
get edit_board_webhook_path(webhook.board, webhook)
assert_response :success
assert_select "form"
+
+ webhook = webhooks(:inactive)
+ get edit_board_webhook_path(webhook.board, webhook)
+ assert_response :success
+ assert_select "form"
end
test "update with valid params" do
diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml
index 4c7dad414..cf4d9e6d0 100644
--- a/test/fixtures/users.yml
+++ b/test/fixtures/users.yml
@@ -4,6 +4,7 @@ david:
role: member
identity: david
account: 37s_uuid
+ verified_at: <%= Time.current.to_fs(:db) %>
jz:
id: <%= ActiveRecord::FixtureSet.identify("jz", :uuid) %>
@@ -11,6 +12,7 @@ jz:
role: member
identity: jz
account: 37s_uuid
+ verified_at: <%= Time.current.to_fs(:db) %>
jason:
id: <%= ActiveRecord::FixtureSet.identify("jason", :uuid) %>
@@ -18,6 +20,7 @@ jason:
role: owner
identity: jason
account: 37s_uuid
+ verified_at: <%= Time.current.to_fs(:db) %>
kevin:
id: <%= ActiveRecord::FixtureSet.identify("kevin", :uuid) %>
@@ -25,6 +28,7 @@ kevin:
role: admin
identity: kevin
account: 37s_uuid
+ verified_at: <%= Time.current.to_fs(:db) %>
system:
id: <%= ActiveRecord::FixtureSet.identify("system", :uuid) %>
@@ -38,6 +42,7 @@ mike:
role: admin
identity: mike
account: initech_uuid
+ verified_at: <%= Time.current.to_fs(:db) %>
system_initech:
id: <%= ActiveRecord::FixtureSet.identify("system_initech", :uuid) %>
diff --git a/test/models/account_test.rb b/test/models/account_test.rb
index 490d6e32e..75da41fb9 100644
--- a/test/models/account_test.rb
+++ b/test/models/account_test.rb
@@ -44,6 +44,8 @@ class AccountTest < ActiveSupport::TestCase
assert owner.admin?, "owner should also be considered an admin"
assert_predicate account.system_user, :present?
+
+ assert owner.verified?, "owner should be verified on account creation"
end
end
diff --git a/test/models/comment_test.rb b/test/models/comment_test.rb
index c519f8fbd..13a5e36c3 100644
--- a/test/models/comment_test.rb
+++ b/test/models/comment_test.rb
@@ -4,4 +4,24 @@ class CommentTest < ActiveSupport::TestCase
setup do
Current.session = sessions(:david)
end
+
+ test "rich text embed variants are processed immediately on attachment" do
+ comment = cards(:logo).comments.create!(body: "Check this out")
+ comment.body.body.attachables # force load
+
+ blob = ActiveStorage::Blob.create_and_upload! \
+ io: File.open(file_fixture("moon.jpg")),
+ filename: "moon.jpg",
+ content_type: "image/jpeg"
+
+ comment.body.body = ActionText::Content.new(comment.body.body.to_html).append_attachables(blob)
+ comment.save!
+
+ embed = comment.body.embeds.sole
+
+ Attachments::VARIANTS.each_key do |variant_name|
+ variant = embed.variant(variant_name)
+ assert variant.processed?, "Expected #{variant_name} variant to be processed immediately"
+ end
+ end
end
diff --git a/test/models/identity_test.rb b/test/models/identity_test.rb
index 1c6c6b258..5b5763ffd 100644
--- a/test/models/identity_test.rb
+++ b/test/models/identity_test.rb
@@ -46,4 +46,19 @@ class IdentityTest < ActiveSupport::TestCase
assert_equal identity.email_address, user.name
end
end
+
+ test "destroy deactivates users before nullifying identity" do
+ identity = identities(:kevin)
+ user = users(:kevin)
+
+ assert_predicate user, :active?
+ assert_predicate user.accesses, :any?
+
+ identity.destroy!
+ user.reload
+
+ assert_nil user.identity_id, "identity should be nullified"
+ assert_not_predicate user, :active?
+ assert_empty user.accesses, "user accesses should be removed"
+ end
end
diff --git a/test/models/push/subscription_test.rb b/test/models/push/subscription_test.rb
new file mode 100644
index 000000000..9f4650614
--- /dev/null
+++ b/test/models/push/subscription_test.rb
@@ -0,0 +1,124 @@
+require "test_helper"
+
+class Push::SubscriptionTest < ActiveSupport::TestCase
+ PUBLIC_TEST_IP = "142.250.185.206" # google.com IP
+
+ setup do
+ stub_dns_resolution(PUBLIC_TEST_IP)
+ end
+
+ test "valid subscription with permitted endpoint" do
+ subscription = Push::Subscription.new(
+ user: users(:david),
+ endpoint: "https://fcm.googleapis.com/fcm/send/abc123",
+ p256dh_key: "test_key",
+ auth_key: "test_auth"
+ )
+
+ assert subscription.valid?
+ end
+
+ test "rejects endpoint with non-https scheme" do
+ subscription = Push::Subscription.new(
+ user: users(:david),
+ endpoint: "http://fcm.googleapis.com/fcm/send/abc123",
+ p256dh_key: "test_key",
+ auth_key: "test_auth"
+ )
+
+ assert_not subscription.valid?
+ assert_includes subscription.errors[:endpoint], "must use HTTPS"
+ end
+
+ test "rejects endpoint with non-permitted host" do
+ subscription = Push::Subscription.new(
+ user: users(:david),
+ endpoint: "https://attacker.example.com/webhook",
+ p256dh_key: "test_key",
+ auth_key: "test_auth"
+ )
+
+ assert_not subscription.valid?
+ assert_includes subscription.errors[:endpoint], "is not a permitted push service"
+ end
+
+ test "rejects endpoint that resolves to private IP" do
+ stub_dns_resolution("192.168.1.1")
+
+ subscription = Push::Subscription.new(
+ user: users(:david),
+ endpoint: "https://fcm.googleapis.com/fcm/send/abc123",
+ p256dh_key: "test_key",
+ auth_key: "test_auth"
+ )
+
+ assert_not subscription.valid?
+ assert_includes subscription.errors[:endpoint], "resolves to a private or invalid IP address"
+ end
+
+ test "rejects endpoint that resolves to loopback IP" do
+ stub_dns_resolution("127.0.0.1")
+
+ subscription = Push::Subscription.new(
+ user: users(:david),
+ endpoint: "https://fcm.googleapis.com/fcm/send/abc123",
+ p256dh_key: "test_key",
+ auth_key: "test_auth"
+ )
+
+ assert_not subscription.valid?
+ assert_includes subscription.errors[:endpoint], "resolves to a private or invalid IP address"
+ end
+
+ test "rejects endpoint that resolves to link-local IP (AWS IMDS)" do
+ stub_dns_resolution("169.254.169.254")
+
+ subscription = Push::Subscription.new(
+ user: users(:david),
+ endpoint: "https://fcm.googleapis.com/fcm/send/abc123",
+ p256dh_key: "test_key",
+ auth_key: "test_auth"
+ )
+
+ assert_not subscription.valid?
+ assert_includes subscription.errors[:endpoint], "resolves to a private or invalid IP address"
+ end
+
+ test "resolved_endpoint_ip returns pinned public IP" do
+ subscription = Push::Subscription.new(
+ user: users(:david),
+ endpoint: "https://fcm.googleapis.com/fcm/send/abc123",
+ p256dh_key: "test_key",
+ auth_key: "test_auth"
+ )
+
+ assert_equal PUBLIC_TEST_IP, subscription.resolved_endpoint_ip
+ end
+
+ test "accepts all permitted push service domains" do
+ permitted_endpoints = [
+ "https://fcm.googleapis.com/fcm/send/token123",
+ "https://updates.push.services.mozilla.com/wpush/v2/token123",
+ "https://web.push.apple.com/QaBC123",
+ "https://wns2-db5p.notify.windows.com/w/?token=abc123"
+ ]
+
+ permitted_endpoints.each do |endpoint|
+ subscription = Push::Subscription.new(
+ user: users(:david),
+ endpoint: endpoint,
+ p256dh_key: "test_key",
+ auth_key: "test_auth"
+ )
+
+ assert subscription.valid?, "Expected #{endpoint} to be valid, got errors: #{subscription.errors.full_messages}"
+ end
+ end
+
+ private
+ def stub_dns_resolution(*ips)
+ dns_mock = mock("dns")
+ dns_mock.stubs(:each_address).multiple_yields(*ips)
+ Resolv::DNS.stubs(:open).yields(dns_mock)
+ end
+end
diff --git a/test/models/signup_test.rb b/test/models/signup_test.rb
index 30910bf81..589bcd49a 100644
--- a/test/models/signup_test.rb
+++ b/test/models/signup_test.rb
@@ -1,15 +1,26 @@
require "test_helper"
class SignupTest < ActiveSupport::TestCase
+ test "validates email format for identity creation" do
+ signup = Signup.new(email_address: "not-an-email")
+ assert_not signup.valid?(:identity_creation)
+ assert signup.errors[:email_address].any?
+
+ signup = Signup.new(email_address: "valid@example.com")
+ assert signup.valid?(:identity_creation)
+ end
+
test "#create_identity" do
signup = Signup.new(email_address: "brian@example.com")
+ magic_link = nil
assert_difference -> { Identity.count }, 1 do
assert_difference -> { MagicLink.count }, 1 do
- assert signup.create_identity
+ magic_link = signup.create_identity
end
end
+ assert_kind_of MagicLink, magic_link
assert_empty signup.errors
assert signup.identity
assert signup.identity.persisted?
@@ -18,10 +29,12 @@ class SignupTest < ActiveSupport::TestCase
assert_no_difference -> { Identity.count } do
assert_difference -> { MagicLink.count }, 1 do
- assert signup_existing.create_identity, "Should send magic link for existing identity"
+ magic_link = signup_existing.create_identity
end
end
+ assert_kind_of MagicLink, magic_link
+
signup_invalid = Signup.new(email_address: "")
assert_raises do
signup_invalid.create_identity
@@ -48,4 +61,15 @@ class SignupTest < ActiveSupport::TestCase
assert_not_empty signup_invalid.errors[:full_name]
end
end
+
+ test "#complete with invalid data" do
+ Current.without_account do
+ signup = Signup.new
+ assert_not signup.complete
+ assert signup.errors[:full_name].any?
+ assert signup.errors[:identity].any?
+ assert_nil signup.account
+ assert_nil signup.user
+ end
+ end
end
diff --git a/test/models/ssrf_protection_test.rb b/test/models/ssrf_protection_test.rb
new file mode 100644
index 000000000..d56f7390a
--- /dev/null
+++ b/test/models/ssrf_protection_test.rb
@@ -0,0 +1,60 @@
+require "test_helper"
+
+class SsrfProtectionTest < ActiveSupport::TestCase
+ test "blocks loopback addresses" do
+ stub_dns_resolution("127.0.0.1")
+ assert_nil SsrfProtection.resolve_public_ip("localhost")
+ end
+
+ test "blocks private 10.x.x.x addresses" do
+ stub_dns_resolution("10.0.0.1")
+ assert_nil SsrfProtection.resolve_public_ip("internal.example.com")
+ end
+
+ test "blocks private 172.16.x.x addresses" do
+ stub_dns_resolution("172.16.0.1")
+ assert_nil SsrfProtection.resolve_public_ip("internal.example.com")
+ end
+
+ test "blocks private 192.168.x.x addresses" do
+ stub_dns_resolution("192.168.1.1")
+ assert_nil SsrfProtection.resolve_public_ip("internal.example.com")
+ end
+
+ test "blocks link-local addresses (AWS metadata endpoint)" do
+ stub_dns_resolution("169.254.169.254")
+ assert_nil SsrfProtection.resolve_public_ip("metadata.example.com")
+ end
+
+ test "blocks carrier-grade NAT addresses" do
+ stub_dns_resolution("100.64.0.1")
+ assert_nil SsrfProtection.resolve_public_ip("cgnat.example.com")
+ end
+
+ test "blocks benchmark testing addresses" do
+ stub_dns_resolution("198.18.0.1")
+ assert_nil SsrfProtection.resolve_public_ip("benchmark.example.com")
+ end
+
+ test "blocks broadcast addresses" do
+ stub_dns_resolution("0.0.0.1")
+ assert_nil SsrfProtection.resolve_public_ip("broadcast.example.com")
+ end
+
+ test "allows public addresses" do
+ stub_dns_resolution("93.184.216.34")
+ assert_equal "93.184.216.34", SsrfProtection.resolve_public_ip("example.com")
+ end
+
+ test "returns first public IP when multiple addresses resolve" do
+ stub_dns_resolution("10.0.0.1", "93.184.216.34", "192.168.1.1")
+ assert_equal "93.184.216.34", SsrfProtection.resolve_public_ip("multi.example.com")
+ end
+
+ private
+ def stub_dns_resolution(*ips)
+ dns_mock = mock("dns")
+ dns_mock.stubs(:each_address).multiple_yields(*ips)
+ Resolv::DNS.stubs(:open).yields(dns_mock)
+ end
+end
diff --git a/test/models/user/avatar_test.rb b/test/models/user/avatar_test.rb
index 96ea5bac7..ed502d7ab 100644
--- a/test/models/user/avatar_test.rb
+++ b/test/models/user/avatar_test.rb
@@ -16,7 +16,7 @@ class User::AvatarTest < ActiveSupport::TestCase
end
test "allows valid image content types" do
- users(:david).avatar.attach(io: File.open(file_fixture("moon.jpg")), filename: "test.jpg")
+ users(:david).avatar.attach(io: File.open(file_fixture("moon.jpg")), filename: "test.jpg", content_type: "image/jpeg")
assert users(:david).valid?
end
@@ -27,4 +27,10 @@ class User::AvatarTest < ActiveSupport::TestCase
assert_not users(:david).valid?
assert_includes users(:david).errors[:avatar], "must be a JPEG, PNG, GIF, or WebP image"
end
+
+ test "thumb variant is processed immediately on attachment" do
+ users(:david).avatar.attach(io: File.open(file_fixture("avatar.png")), filename: "avatar.png", content_type: "image/png")
+
+ assert users(:david).avatar.variant(:thumb).processed?
+ end
end
diff --git a/test/models/user/settings_test.rb b/test/models/user/settings_test.rb
index b72de92c5..69145c419 100644
--- a/test/models/user/settings_test.rb
+++ b/test/models/user/settings_test.rb
@@ -49,5 +49,9 @@ class User::SettingsTest < ActiveSupport::TestCase
@user.update!(role: :member, active: false)
assert_not @user.settings.bundling_emails?, "Inactive users should not receive bundled emails"
+
+ @user.update!(active: true)
+ @user.update_column(:verified_at, nil)
+ assert_not @user.settings.bundling_emails?, "Unverified users should not receive bundled emails"
end
end
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index 36b0e7986..645e3a386 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -48,4 +48,36 @@ class UserTest < ActiveSupport::TestCase
user.update!(name: "Kevin")
assert user.setup?
end
+
+ test "verified? returns true when verified_at is present" do
+ user = users(:david)
+ user.update_column(:verified_at, Time.current)
+
+ assert user.verified?
+ end
+
+ test "verified? returns false when verified_at is nil" do
+ user = users(:david)
+ user.update_column(:verified_at, nil)
+
+ assert_not user.verified?
+ end
+
+ test "verify sets verified_at when not already verified" do
+ user = users(:david)
+ user.update_column(:verified_at, nil)
+
+ assert_nil user.verified_at
+ user.verify
+ assert_not_nil user.reload.verified_at
+ end
+
+ test "verify does not update verified_at when already verified" do
+ user = users(:david)
+ original_time = 1.day.ago
+ user.update_column(:verified_at, original_time)
+
+ user.verify
+ assert_equal original_time.to_i, user.reload.verified_at.to_i
+ end
end
diff --git a/test/models/webhook/delivery_test.rb b/test/models/webhook/delivery_test.rb
index c28666752..30f91390e 100644
--- a/test/models/webhook/delivery_test.rb
+++ b/test/models/webhook/delivery_test.rb
@@ -298,11 +298,12 @@ class Webhook::DeliveryTest < ActiveSupport::TestCase
# Verify Net::HTTP.new is called with the pinned IP
http_mock = mock("http")
http_mock.stubs(:use_ssl=)
+ http_mock.stubs(:ipaddr=)
http_mock.stubs(:open_timeout=)
http_mock.stubs(:read_timeout=)
http_mock.stubs(:request).returns(stub(code: "200"))
- Net::HTTP.expects(:new).with("example.com", 443, ipaddr: PUBLIC_TEST_IP).returns(http_mock)
+ Net::HTTP.expects(:new).with("example.com", 443).returns(http_mock)
delivery.deliver
diff --git a/test/system/smoke_test.rb b/test/system/smoke_test.rb
index e4bc9cae9..14c7a7116 100644
--- a/test/system/smoke_test.rb
+++ b/test/system/smoke_test.rb
@@ -1,6 +1,27 @@
require "application_system_test_case"
class SmokeTest < ApplicationSystemTestCase
+ test "joining an account" do
+ account = accounts("37s")
+
+ visit join_url(code: account.join_code.code, script_name: account.slug)
+ fill_in "Email address", with: "newbie@example.com"
+ click_on "Continue"
+
+ assert_selector "h1", text: "Check your email"
+ identity = Identity.find_by!(email_address: "newbie@example.com")
+ code = identity.magic_links.active.first.code
+ fill_in "code", with: code
+ send_keys :enter
+
+ assert_selector "input[id=user_name]"
+ assert account.users.find_by!(identity:).verified?, "User was not properly verified"
+ fill_in "Full name", with: "New Bee"
+ click_on "Continue"
+
+ assert_selector "h1", text: "Writebook"
+ end
+
test "create a card" do
sign_in_as(users(:david))
@@ -24,7 +45,7 @@ class SmokeTest < ApplicationSystemTestCase
within("form lexxy-editor figure.attachment[data-content-type='image/jpeg']") do
assert_selector "img[src*='/rails/active_storage']"
- assert_selector "figcaption input[placeholder='moon.jpg']"
+ assert_selector "figcaption textarea[placeholder='moon.jpg']"
end
click_on "Post"
diff --git a/test/test_helper.rb b/test/test_helper.rb
index 03cda99db..d18f4c9c4 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -44,7 +44,7 @@ module ActiveSupport
fixtures :all
include ActiveJob::TestHelper
- include ActionTextTestHelper, CardTestHelper, ChangeTestHelper, SessionTestHelper
+ include ActionTextTestHelper, CachingTestHelper, CardTestHelper, ChangeTestHelper, SessionTestHelper
include Turbo::Broadcastable::TestHelper
setup do
@@ -61,6 +61,17 @@ class ActionDispatch::IntegrationTest
setup do
integration_session.default_url_options[:script_name] = "/#{ActiveRecord::FixtureSet.identify("37signals")}"
end
+
+ private
+ def without_action_dispatch_exception_handling
+ original = Rails.application.config.action_dispatch.show_exceptions
+ Rails.application.config.action_dispatch.show_exceptions = :none
+ Rails.application.instance_variable_set(:@app_env_config, nil) # Clear memoized env_config
+ yield
+ ensure
+ Rails.application.config.action_dispatch.show_exceptions = original
+ Rails.application.instance_variable_set(:@app_env_config, nil) # Reset env_config
+ end
end
class ActionDispatch::SystemTestCase
diff --git a/test/test_helpers/caching_test_helper.rb b/test/test_helpers/caching_test_helper.rb
new file mode 100644
index 000000000..90dab64d5
--- /dev/null
+++ b/test/test_helpers/caching_test_helper.rb
@@ -0,0 +1,14 @@
+module CachingTestHelper
+ def with_actionview_partial_caching
+ was_cache = ActionView::PartialRenderer.collection_cache
+ was_perform_caching = ApplicationController.perform_caching
+ begin
+ ActionView::PartialRenderer.collection_cache = ActiveSupport::Cache.lookup_store(:memory_store)
+ ApplicationController.perform_caching = true
+ yield
+ ensure
+ ActionView::PartialRenderer.collection_cache = was_cache
+ ApplicationController.perform_caching = was_perform_caching
+ end
+ end
+end
- <%= result.card.board.name %>
+ <%= result.card.board.name %> · <%= local_datetime_tag(result.created_at, style: :timeordate) %>
<% end %>
diff --git a/app/views/sessions/magic_links/show.html.erb b/app/views/sessions/magic_links/show.html.erb
index 931156ff6..4e94f411e 100644
--- a/app/views/sessions/magic_links/show.html.erb
+++ b/app/views/sessions/magic_links/show.html.erb
@@ -10,16 +10,18 @@
<%= form.text_field :code, required: true, class: "input center txt-align-enter txt-large",
autofocus: true, autocorrect: "off", autocapitalize: "off", spellcheck: "false", "data-1p-ignore": true,
autocomplete: "one-time-code", maxlength: "6", placeholder: "••••••", value: params[:code],
- data: { magic_link_target: "input", action: "keydown.enter->magic-link#submit paste->magic-link#submit" } %>
+ data: { magic_link_target: "input", action: "keydown.enter->magic-link#submitOnEnter paste->magic-link#submitOnPaste" } %>
<% end %>
The code you receive will work for <%= distance_of_time_in_words(MagicLink::EXPIRATION_TIME) %>.
-<% if Rails.env.development? %> - +<% if Rails.env.development? && flash[:magic_link_code].present? %> + <% end %> <% content_for :footer do %> diff --git a/app/views/signups/completions/new.html.erb b/app/views/signups/completions/new.html.erb index 971c39b1d..5be760843 100644 --- a/app/views/signups/completions/new.html.erb +++ b/app/views/signups/completions/new.html.erb @@ -9,8 +9,9 @@You're one step away. Just enter your name to get your own Fizzy account.
<% if @signup.errors.any? %> -
-
+
+ <% if @user.errors.any? %>
+ -
+
- <%= message %> <% end %> diff --git a/app/views/users/edit.html.erb b/app/views/users/edit.html.erb index a3b5845e8..c712dac58 100644 --- a/app/views/users/edit.html.erb +++ b/app/views/users/edit.html.erb @@ -14,7 +14,7 @@ @@ -38,6 +38,18 @@ <%= link_to "Change email", new_user_email_address_path(user_id: Current.user.id), class: "btn btn--plain txt-link txt-small txt-nowrap" %>
+
Your changes couldn't be saved:
+-
<% @signup.errors.full_messages.each do |message| %>
+
+ <% end %>
+
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index eec6444a0..17f418e84 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -18,20 +18,25 @@
Your changes couldn't be saved:
+-
+ <% @user.errors.full_messages.each do |message| %>
+
- <%= message %> + <% end %> +
<%= @user.name %>
- <% if @user.active? %>
- <%= mail_to @user.identity.email_address %>
- <% else %>
+ <% if !@user.active? %>
<%= @user.name %> is no longer on this account
+ <% elsif !@user.verified? %>
+ Unverified
+
A sign-in code has been sent to this email address, but the user has not yet logged in to confirm their identity.
+ <% else %>
+ <%= mail_to @user.identity.email_address %>
<% end %>
- <%= link_to "Which cards are assigned to #{me_or_you}?",
- cards_path(assignee_ids: [ @user.id ], sorted_by: "newest"), class: "btn", data: { turbo_frame: "_top" } %>
- <%= link_to "Which cards were added by #{me_or_you}?",
- cards_path(creator_ids: [ @user.id ], sorted_by: "newest"), class: "btn", data: { turbo_frame: "_top" } %>
-
+ <% if @user.verified? %>
+
+ <%= link_to "Which cards are assigned to #{me_or_you}?",
+ cards_path(assignee_ids: [ @user.id ], sorted_by: "newest"), class: "btn", data: { turbo_frame: "_top" } %>
+ <%= link_to "Which cards were added by #{me_or_you}?",
+ cards_path(creator_ids: [ @user.id ], sorted_by: "newest"), class: "btn", data: { turbo_frame: "_top" } %>
+
+ <% end %>
@@ -48,4 +53,6 @@
<% end %>
-<%= turbo_frame_tag "user_events", src: user_events_path(@user) %>
+<% if @user.verified? %>
+ <%= turbo_frame_tag "user_events", src: user_events_path(@user) %>
+<% end %>
diff --git a/app/views/users/verifications/new.html.erb b/app/views/users/verifications/new.html.erb
new file mode 100644
index 000000000..fe830cd28
--- /dev/null
+++ b/app/views/users/verifications/new.html.erb
@@ -0,0 +1 @@
+<%= auto_submit_form_with url: users_verifications_path, method: :post %>
diff --git a/app/views/webhooks/show.html.erb b/app/views/webhooks/show.html.erb
index a98a8acf3..2fe01f070 100644
--- a/app/views/webhooks/show.html.erb
+++ b/app/views/webhooks/show.html.erb
@@ -22,7 +22,7 @@
<% unless @webhook.active? %>
- <%= button_to "Reactivate", board_webhook_activation_path(@webhook), method: :post %>
+ <%= button_to "Reactivate", board_webhook_activation_path(@webhook.board_id, @webhook), method: :post %>
<% end %>
diff --git a/config/ci.rb b/config/ci.rb
index 053fe2682..a99248a93 100644
--- a/config/ci.rb
+++ b/config/ci.rb
@@ -19,6 +19,8 @@ CI.run do
if Fizzy.saas?
step "Tests: SaaS", "#{SAAS_ENV} bin/rails test"
step "Tests: SaaS System", "#{SAAS_ENV} #{SYSTEM_TEST_ENV} bin/rails test:system"
+ step "Tests: OSS", "#{OSS_ENV} bin/rails test"
+ step "Tests: OSS System", "#{OSS_ENV} #{SYSTEM_TEST_ENV} bin/rails test:system"
else
step "Tests: SQLite", "#{OSS_ENV} bin/rails test"
step "Tests: SQLite System", "#{OSS_ENV} #{SYSTEM_TEST_ENV} bin/rails test:system"
diff --git a/config/deploy.yml b/config/deploy.yml
index be1e3c21e..0e855727d 100644
--- a/config/deploy.yml
+++ b/config/deploy.yml
@@ -1,65 +1,45 @@
-# Name of your application. Used to uniquely configure containers.
+# Name of this app
service: fizzy
-
-# Name of the container image (use your-user/app-name on external registries).
image: fizzy
-# Deploy to these servers.
+
+#-- About your deployment --#
+
+# Where to deploy fizzy
servers:
web:
- - 192.168.0.1
- # job:
- # hosts:
- # - 192.168.0.1
- # cmd: bin/jobs
+ - fizzy.example.com # Set your server name here
-# Enable SSL auto certification via Let's Encrypt and allow for multiple apps on a single web server.
-# If used with Cloudflare, set encryption mode in SSL/TLS setting to "Full" to enable CF-to-app encryption.
-#
-# Using an SSL proxy like this requires turning on config.assume_ssl and config.force_ssl in production.rb!
-#
-# Don't use this when deploying to multiple web servers (then you have to terminate SSL at your load balancer).
-#
-# proxy:
-# ssl: true
-# host: app.example.com
+# How you connect to your server
+ssh:
+ user: root # If you use a different username to SSH to your server, specify it here
-# Where you keep your container images.
-registry:
- # Alternatives: hub.docker.com / registry.digitalocean.com / ghcr.io / ...
- server: localhost:5555
+# Automatic SSL
+proxy:
+ ssl: true # Set this to false if you *don't* want SSL
+ host: fizzy.example.com # Set your server name here to use automatic SSL
- # Needed for authenticated registries.
- # username: your-user
-
- # Always use an access token rather than real password when possible.
- # password:
- # - KAMAL_REGISTRY_PASSWORD
-
-# Inject ENV variables into containers (secrets come from .kamal/secrets).
+# Your application configuration (secrets come from .kamal/secrets).
env:
secret:
- - RAILS_MASTER_KEY
+ - SECRET_KEY_BASE
+ - VAPID_PUBLIC_KEY
+ - VAPID_PRIVATE_KEY
+ - SMTP_USERNAME
+ - SMTP_PASSWORD
clear:
- # Run the Solid Queue Supervisor inside the web server's Puma process to do jobs.
- # When you start using multiple servers, you should split out job processing to a dedicated machine.
- SOLID_QUEUE_IN_PUMA: true
+ MAILER_FROM_ADDRESS: support@example.com # The email address that Fizzy sends email from
+ SOLID_QUEUE_IN_PUMA: true # Run background jobs in the app container
- # Set number of processes dedicated to Solid Queue (default: 1)
- # JOB_CONCURRENCY: 3
- # Set number of cores available to the application on each server (default: 1).
- # WEB_CONCURRENCY: 2
+#-- General configuration --#
- # Match this to any external database server to configure Active Record correctly
- # Use fizzy-db for a db accessory server on same machine via local kamal docker network.
- # DB_HOST: 192.168.0.2
+# Use a local registry to deploy
+registry:
+ server: localhost:5555
- # Log everything from Rails
- # RAILS_LOG_LEVEL: debug
-
-# Aliases are triggered with "bin/kamal