Commit graph

77 commits

Author SHA1 Message Date
Jacob Herrington
a5b2d109d5
Rename banned and comment_banned roles (#12270)
* Rename banned and comment_banned roles

* Add data update script to rename roles containing 'ban'

* Add named error for Suspended users

* Update unidiomatic method names

* Rename misc banned to suspended

* Apply suggestions from code review

Co-authored-by: Michael Kohl <me@citizen428.net>

* Add unit tests for suspended methods

This commit also adds TODO comments for removing banned and
comment_banned from the codebase after data update scripts have
successfully run on all of our Forems.

Co-authored-by: Michael Kohl <me@citizen428.net>
2021-04-06 10:12:14 -05:00
Nick Taylor
7c1343be9e
Revert "Revert "Removed service worker (#12974)" (#13014)" (#13015)
This reverts commit 2416387fb4.
2021-03-17 10:57:56 -04:00
Molly Struve
2416387fb4
Revert "Removed service worker (#12974)" (#13014)
This reverts commit 4fb6230606.
2021-03-16 18:10:01 -05:00
Nick Taylor
4fb6230606
Removed service worker (#12974) 2021-03-16 15:55:31 -04:00
Alex
d109b6824e
Refactor cache purging (#12811)
* Refactor caching

* Bring back old bust class

* Refactor with PR feedback

* Remove useless return values
2021-03-02 10:09:05 -05:00
Ben Halpern
73125c0795
Reduce service worker functionality to minimal offline page (#12834)
* Reduce service worker functionality to minimal offline page

* Update docs for service workers

* Add comment to fix test

* Include incrementable static cache

* Add TODO comments about removal

* Fix trailing whitespace
2021-03-01 19:29:26 -05:00
rhymes
543b9bec7e
Improve ActionController::InvalidAuthenticityToken error handling (#12833) 2021-03-01 11:27:12 +01:00
Michael Kohl
d1d4c00114
Update OmniAuth to 2.0 (#12715)
* Update gems

* Remove Omniauth CVE from bundle-audit ignore list

* Add omniauth-rails_csrf_protection gem

This is recommended in the OmniAuth upgrade guide:
https://github.com/omniauth/omniauth/wiki/Upgrading-to-2.0#rails

* Temporarily bundle Devise from master

* Pin Devise commit in Gemfile

* Fix CSRF cookie workaround

As suggested by @fdoxyz

* Remove CSRF workaround

* Add DataDog counter

* Add request path tag

* Remove rendering of devise shared links

* Remove unused Devise partial
2021-02-25 12:46:13 -06:00
Alex
f70af66258
Update bust to EdgeCache::Bust (#12052)
* Update bust to EdgeCache::Bust

* Update specs

* Fix more specs

* Fix more specs :)
2020-12-29 09:53:15 +01:00
Ben Halpern
68867e9384
Add config post route for admin api (#11698)
* Add config post route for admin api

* Fix params

* Extract config_params to concern

* Remove print statement

* Some changes

* A couple changes

* Change controller method name and refactor upsert

* Fix tests and method names

* Fix routes and class stuff

* Fix styles

* Fix config params

* Fix styles

* Move regex to constant

* Remove single-use after action callbacks

* Expose success? method

* Fix syntax error

* Fix success? return

* Switch to guard clause

* Final clean ups?
2020-12-22 15:50:34 -05:00
Ben Halpern
a229cfa174
Preserve internal navigation indicator on redirect (#11476)
* Preserve internal navigation indicator on redirect

* Fix test

* Refactor for cleaner reusability

* Add docs
2020-11-25 11:04:19 -05:00
Ben Halpern
badefcabeb
Developer experience/security: Make dev/test blow up if current_user is used erroneously (#11237)
* Let dev/test blow up if current_user is used erroneously

* Fix logic

* Fix click-to-edit permissions

* Change test to check for new behavior

* linting

* Edit tests

* Change test

* Clean up implementation

* Update comment

* Fix instance vars

* Update app/controllers/concerns/caching_headers.rb

* Merge origin and add request_store gem
2020-11-12 11:54:23 -05:00
Ben Halpern
e83f194a01
[deploy] Redirect to SiteConfig.app_domain (#10942)
* Redirect to SiteConfig.app_domain

* Redirect to full path with helper
2020-10-19 20:07:15 -04:00
Julianna Tetreault
292b4143ce
Part One: Fix Users Stuck in a "Created" but "Unregistered" State (#10882)
* Alters the Invitations::Controller to work with registered users and onboarding
  - Adds #after_accept_path_for to Application::Controller for onboarding
  - Adds update! on the users registered status to the Invitations::Controller
  - Adds a respond_with in place of a redirt to Invitations::Controller
  - Adds a request spec testing invitation acceptance and registered status

* specs: Cleans up invitations_spec.rb comments a little bit

* fix: Adds comments back to the Invitations::Controller that previously existed prior to refactor

* Adds back accidentally removed code from InvitationsController

* Temporarily comments out invitations_spec with reference to issue in the code

* Removes invitations_spec file in favor of spec file in another open PR
2020-10-19 16:51:31 -04:00
Ben Halpern
f62f5514f7
Add invitations controller to Allow List (#10934) 2020-10-19 16:31:26 -04:00
Molly Struve
ea969748e9
Feature:Notify Devs when Sidekiq is Not Running in Development (#10541) 2020-10-13 12:13:47 -05:00
Molly Struve
3303186125
Bug Fix:Count the Health Checks Controller as Public (#10435) 2020-09-25 10:35:10 +07:00
Ben Halpern
3a469a99e2
[deploy] Enable admin-configured app_domain (#10206)
* Move app_domain from env var to siteconfig *within app area*

* Fix SiteConfig

* Don't change URL.domain yet

* Not use in fastly cache purge yet

* Session store magoo

* Revert domain issue

* Add SetCookie middleware

* Temporarily remove cookie middleware and release tasks

* Re-enable SetCookieDomain

* Add some more comments, get it ready for testing

* Remove host from url options and temporarily show errors

* Allow forwarded host to be cookie

* Fix typo

* Change invalidAuthenticityToken

* Properly set app domain

* Proper Fastly cache

* Remove config.app_domain

* Remove config.app_domain

* Explicitely set remember_user_token

* More play with cookies

* Fiddle with remember_user_token

* Add remember_user_token changes

* Monkeypatch devise

* Sessions controller

* Include rememberable

* Include rememberable

* Proper cookie monkeypatch

* Proper cookie monkeypatch

* Proper cookie monkeypatch

* Remove extra cookie code

* User sign in tweak

* Close the loop

* Experiment with carrierwave public_url

* Finalize carrierwave monkeypatch

* Remove async controller specs

* Change some tests

* Update domain test

* Remove temporary production.rb change

* modify cookie logic

* Remove unneeded changes

* Remove unneeded changes

* Explicitely pass host

* Fix linting

* Fix social image test

* Add some cookie tests

* Modify article url

* Fix canonical urls

* Fix typo

* Remove sessions controller

* Remove devise monkeypatch

* Add monkeypatch

* Remove elsif

* Update spec/helpers/application_helper_spec.rb

Co-authored-by: Michael Kohl <citizen428@dev.to>

* Adjust remember_cookie_sync

* Remember user token experimentation

* Fiddle with devise

* Properly configure devise

* Fix typo

* Fix formatting issue

* Add comment about middleware

* Fix typo

Co-authored-by: Vaidehi Joshi <vaidehi.sj@gmail.com>

* Remove commented-out code

Co-authored-by: Michael Kohl <citizen428@dev.to>
Co-authored-by: Vaidehi Joshi <vaidehi.sj@gmail.com>
2020-09-11 09:38:34 -04:00
Ben Halpern
7e9a6b848d
Add multiple entry options (#10117) 2020-09-01 08:59:52 -04:00
Lisa Sy
54c071856e
[deploy] Update top-header for logged-out user (#9874)
* Create first start at desktop top header updates

* Update mobile styling of top header

* Stylize sign in widget card

* Update nav menu and top bar

* Changes based on user being logged-in or not

* Uses user_signed_in? on top nav bar

* Fix lingering old cloudinary helper method

* Trigger CI

* Fixes specs

* Adds redirect_using_referer_spec, fixes other specs & cleanup

* Adds nav-menu.scss to layouts/_styles.html.erb for inline & small edit in referer check

* Remove logged-out styles to make it more uniform with logged in

* Remove nav-menu.scss file

* cleanup markup and JS a little

* Fixes FB auth specs to new login links

* Makes sure unauthenticated /new redirects back to editor

* CI fix Sing in with -> Continue with

* Update db/schema.rb

* Update db/schema.rb

* Update db/schema.rb

Co-authored-by: Fernando Valverde <fdov88@gmail.com>
Co-authored-by: ludwiczakpawel <ludwiczakpawel@gmail.com>
Co-authored-by: Ben Halpern <bendhalpern@gmail.com>
2020-08-31 18:12:22 -04:00
Ben Halpern
7ba7d9fc46
Add logic for asking for FOREM_OWNER_SECRET to be present on first user sign up if set by system (#10108)
* Add logic for requiring FOREM_OWNER_SECRET to be present

* Fix test logic
2020-08-31 16:41:30 -04:00
Ben Halpern
dba151915b
[deploy] Allow initial user to sign up and configure app (#10073)
* Allow initial user to sign up and configure app

* Fix added value unneeded

* Make siteconfig public in tests

* Remove deprecated method and adjust seed default

* Add new controllers not to redirect for public

* Modify tests

* Edit test defaults

* Fix linting

* Add starter mode to seed file
2020-08-31 12:54:22 -04:00
Ben Halpern
0dd04ea45a
Create initial "register by email and password" beta/MVP in prep for "setup mode" (#10039)
* Modify registrations controller

* A bit of progress

* More work

* a bit pf progress on confirmation emails

* Get basic functionality in place

* Remove comments

* First basic test

* Add tests

* Fix code styles

* Remove sessions spec

* Remove sessions spec

* Remove extra markup
2020-08-28 09:46:56 -04:00
rhymes
ec4d373ea0
Move Stripe dev logger in the controller (#9887) 2020-08-20 09:38:54 -04:00
Ben Halpern
e76f6cbbba
Set Stripe dynamically instead of at boot (#9862)
* Set Stripe dynamically instead of at boot

* Add stripe SiteConfig

* Fix capitalization
2020-08-19 21:24:19 -04:00
Michael Kohl
1c1ab8b709
Add PUBLIC_CONTROLLERS constant (#9825) 2020-08-17 14:05:25 -04:00
Vaidehi Joshi
df990afadc
Conditionally remove no-cache from Fastly headers (#9631) [deploy]
* Rename FastlyHeaders to CachingHeaders, conditionally experiment with removing no-cache

We suspect that it is safe to remove `no-cache` entirely from the Cache-Control headers that are sent
along to Fastly, but there is no great way to confirm this hypothesis. We're testing this by experimenting
on one single article. We will conditionally default to the same headers that we send to Nginx, and send
those headers to Fastly (by removing `no-cache` and adding in `max-age`, which should be ignored since Fastly
also has Surrogate-Control headers added to it, which include a `max-age`, which Fastly should prioritize
over any other `max-age`.

Once we've confirmed that this doesn't cause issues on the Fastly side, we can remove this check and use
the same Cache-Control headers for both Fastly and Nginx.

* Add check for request.env[REQUEST_PATH].present?
2020-08-05 12:34:12 -07:00
benhalpern
b611a9847a Enable public or private forem config 2020-07-16 09:58:00 -04:00
benhalpern
98242dc68b Initial work 2020-07-16 06:59:20 -04:00
Michael Kohl
fb27f52ed0
[deploy] Display banner if site hasn't been configured (PRE DEPLOYMENT TASKS) (#8435) 2020-07-07 07:37:04 -05:00
Ben Halpern
cfa5e882ce
[deploy] Add SiteConfig for feed style (#8721)
* Add SiteConfig for feed style

* Merge master

* Merge master

* Fix typo
2020-06-24 12:14:33 -04:00
Vaidehi Joshi
ded5e245fd
Turn off ahoy visit tracking (#8782) [deploy] 2020-06-18 15:31:31 -07:00
Molly Struve
16495791d3
Remove Unnecessary User Touch From Strip Controller (#7924) 2020-05-19 12:45:56 +02:00
Molly Struve
6d6f7086e5
[deploy] Track current_user ID in Honeycomb (#7915) 2020-05-18 09:36:18 -05:00
Molly Struve
d1e39a7dba
[deploy] Rate Limit Feedback Message Creation (#7832) 2020-05-14 12:00:22 -05:00
Molly Struve
371a71a3be
[deploy] Expose Article Update Rate Limit on Config Page (#7826) 2020-05-13 15:29:32 -05:00
Molly Struve
ba0ebbafa8
[deploy] RateLimit Refactor: Consolidate Logic for Checking a Limit and Raising an Error (#7636) 2020-05-01 13:31:44 -05:00
Alex
b6664456c0
[deploy] Validate filenames server-side (#7405) 2020-04-23 14:30:59 -05:00
rhymes
6d9ecb45e6
[deploy] Authentication refactoring: improve testing on OmniauthCallbacksController (#7439)
* Improve testing on OmniauthCallbacksController

* Remove removal of legacy cookie and added validation comments
2020-04-23 17:27:04 +02:00
Alex
83e92cbfd3
Rescue error and add specs (#7292) 2020-04-15 10:34:00 -04:00
Alex
10c1882548
[deploy] Log image data to Datadog for file name too long error (#7200)
* Log image data to Datadog for file name too long error

* Add guard for when no images are found
2020-04-09 18:25:26 -04:00
Alex
932f81afe6
Copy set_cache_control_headers from fastly-rails (#7070) [deploy]
* Copy controller actions from fastly-rails

* Move logic to FastlyHeaders controller concern

- Only add cache-control headers
2020-04-06 13:06:27 -04:00
Matej Minárik
e9a0efbbf2
Fix broken StoriesController#show article with bad chars (#6248) [deploy] 2020-02-24 13:41:06 -05:00
rhymes
1df24046d8
Small API controllers refactoring (#6021) [deploy]
* TagsController inherits from ApiController
* Let ApiController inherit from ActionController::Base to have its own lifecycle
* Remove unused method
* Use only one respond_to :json for the entire API
* ApiController inherits from ActionController::Base
* Use Pundit only where needed
2020-02-12 11:51:42 -05:00
rhymes
c41d66e900
Replace ban/banned with suspend/suspended in user facing text (#5816) [deploy] 2020-02-10 10:12:53 -05:00
rhymes
42b33f29ae
Add signin=true as a param correctly if the URL already has params (#5866) [deploy] 2020-02-04 09:41:10 -05:00
Molly Struve
1a76fa03d7 Return ActionController::RoutingError error when Invalid Format is Requested (#5140) [deploy]
* Return ActiveRecord::RecordNotFound error when an invalid format is requested

* raise ActionController::RoutingError when template is not found
2019-12-17 10:00:12 -05:00
Ben Halpern
630c1b7425
Migrate to streaming app shell via serviceworkers (#5020) [deploy]
* Initial work for streaming app shell way of using serviceworkers

* Close in on serviceworker adjustment finalization

* Add docs and loading indicator

* Remove useless code

* Don't run on API

* Update app/javascript/contentDisplayPolicy/hideBlockedContent.js

* Fix small details

* Don't run serviceworker.js code in test env

* Fix JS in serviceworker

* Move private keyword to proper place in async controller

* Change shell_version to HEROKU_SLUG_COMMIT

* Update caching config

* Add test for async_info/shell_version
2019-12-16 12:21:33 -05:00
Ben Halpern
b938dab91b
Add ApplicationMetalController to relevant controllers (#4937)
* Add ApplicationMetalController to relevant controllers

* Add request forgery protection to metal

* Remove logger call

* Add logger keyword and skip protect_from_forgery in test

* Uncomment main_image in test
2019-11-26 16:29:07 -05:00
rhymes
0ffa127481 Refactor session_current_user_id in a shared concern (#4936) 2019-11-26 13:21:56 -05:00