Merge branch 'main' into mobile-columns-pt-iii

* main:
  Only hide the blank slate when there are no cards present
  Support local installations where the app is loaded over HTTP
  Revert "Make sure new card drafts are refreshed when reused"
  Make sure new card drafts are refreshed when reused
  Add a "*" to the queues handled by the solid queue worker pool
  Remove unnecessary recurring execution cleanup task
  Refactor: Replace pluck(:id) with ids method

app/assets/stylesheets/blank-slates.css

@@ -24,12 +24,12 @@
     border: 2px dashed var(--color-ink-light);
     border-radius: 1ch;
     color: var(--color-ink-dark);
-    margin-block-start: 5dvh;
+    margin-block-start: 2dvh;
     padding: 1ch 2ch;
     rotate: -3deg;
     font-weight: 500;
 
-    .cards:not(.cards--grid) & {
+    .cards:has(.card) & {
       display: none;
     }
   }

app/controllers/boards_controller.rb

@@ -30,7 +30,7 @@ class BoardsController < ApplicationController
   end
 
   def edit
-    selected_user_ids = @board.users.pluck :id
+    selected_user_ids = @board.users.ids
     @selected_users, @unselected_users = \
       @board.account.users.active.alphabetically.includes(:identity).partition { |user| selected_user_ids.include? user.id }
   end

app/controllers/concerns/request_forgery_protection.rb

@@ -2,31 +2,19 @@ module RequestForgeryProtection
   extend ActiveSupport::Concern
 
   included do
-    after_action :append_sec_fetch_site_to_vary_header
+    protect_from_forgery using: :header_only, with: :exception
   end
 
   private
-    def append_sec_fetch_site_to_vary_header
-      vary_header = response.headers["Vary"].to_s.split(",").map(&:strip).reject(&:blank?)
-      response.headers["Vary"] = (vary_header + [ "Sec-Fetch-Site" ]).join(",")
+    def verified_via_header_only?
+      super || allowed_api_request? || allowed_insecure_context_request?
     end
 
-    def verified_request?
-      request.get? || request.head? || !protect_against_forgery? ||
-        (valid_request_origin? && safe_fetch_site?)
+    def allowed_api_request?
+      sec_fetch_site_value.nil? && request.format.json?
     end
 
-    SAFE_FETCH_SITES = %w[ same-origin same-site ]
-
-    def safe_fetch_site?
-      SAFE_FETCH_SITES.include?(sec_fetch_site_value) || (sec_fetch_site_value.nil? && api_request?)
-    end
-
-    def api_request?
-      request.format.json?
-    end
-
-    def sec_fetch_site_value
-      request.headers["Sec-Fetch-Site"].to_s.downcase.presence
+    def allowed_insecure_context_request?
+      sec_fetch_site_value.nil? && !request.ssl? && !Rails.configuration.force_ssl
     end
 end

app/models/board/storage.rb

@@ -21,7 +21,7 @@ module Board::Storage
     end
 
     def card_ids
-      @card_ids ||= cards.pluck(:id)
+      @card_ids ||= cards.ids
     end
 
     def card_image_bytes
@@ -36,7 +36,7 @@ module Board::Storage
 
     def comment_embed_bytes
       card_ids.each_slice(BATCH_SIZE).sum do |batch|
-        sum_embed_bytes_for "Comment", Comment.where(card_id: batch).pluck(:id)
+        sum_embed_bytes_for "Comment", Comment.where(card_id: batch).ids
       end
     end
 
@@ -46,8 +46,7 @@ module Board::Storage
 
     def sum_embed_bytes_for(record_type, record_ids)
       rich_text_ids = ActionText::RichText \
-        .where(record_type: record_type, record_id: record_ids)
-        .pluck(:id)
+        .where(record_type: record_type, record_id: record_ids).ids
 
       sum_blob_bytes_in_batches \
         ActiveStorage::Attachment.where(record_type: "ActionText::RichText", name: "embeds"),

app/models/user/accessor.rb

@@ -13,6 +13,6 @@ module User::Accessor
 
   private
     def grant_access_to_boards
-      Access.insert_all account.boards.all_access.pluck(:id).collect { |board_id| { id: ActiveRecord::Type::Uuid.generate, board_id: board_id, user_id: id, account_id: account.id } }
+      Access.insert_all account.boards.all_access.ids.collect { |board_id| { id: ActiveRecord::Type::Uuid.generate, board_id: board_id, user_id: id, account_id: account.id } }
     end
 end