Various updates pulled from #990 (#1033)

* Various updates pulled from #990

This gets Quepid looking more like a brand new 7.1 Rails app.

README.md

@@ -418,7 +418,7 @@ bin/docker r bundle update foobar
 You can remove a gem via:
 
 ```
-bin/docker r bundle remove foobar --install
+bin/docker r bundle remove foobar
 ```
 
 Then check in the updated `Gemfile` and `Gemfile.lock` files.  For good measure

app/services/book_importer.rb

@@ -89,10 +89,12 @@ def import
     # Force the imported book to be owned by the user doing the importing.  Otherwise you can loose the book!
     @book.owner = User.find_by(email: @current_user.email)
 
+    @book.save
+
     if params_to_use[:query_doc_pairs]
       counter = params_to_use[:query_doc_pairs].size
       params_to_use[:query_doc_pairs].each do |query_doc_pair|
-        qdp = @book.query_doc_pairs.build(query_doc_pair.except(:judgements))
+        qdp = @book.query_doc_pairs.create(query_doc_pair.except(:judgements))
         counter -= 1
         Turbo::StreamsChannel.broadcast_render_to(
           :notifications,
@@ -104,12 +106,10 @@ def import
 
         query_doc_pair[:judgements].each do |judgement|
           judgement[:user] = User.find_by(email: judgement[:user_email])
-          qdp.judgements.build(judgement.except(:user_email))
+          qdp.judgements.create(judgement.except(:user_email))
         end
       end
     end
-
-    @book.save
   end
   # rubocop:enable Metrics/MethodLength
   # rubocop:enable Metrics/AbcSize

config/application.rb

@@ -12,7 +12,11 @@ module Quepid
   class Application < Rails::Application
     # Initialize configuration defaults for originally generated Rails version.
     config.load_defaults 7.1
-    # config.active_support.cache_format_version = 7.1 # remove when load_defaults is 7.0
+
+    # Please, add to the `ignore` list any other `lib` subdirectories that do
+    # not contain `.rb` files, or that should not be reloaded or eager loaded.
+    # Common ones are `templates`, `generators`, or `middleware`, for example.
+    config.autoload_lib(ignore: %w[assets tasks])
 
     # Configuration for the application, engines, and railties goes here.
     #

config/environments/development.rb

@@ -10,7 +10,7 @@
   # In the development environment your application's code is reloaded any time
   # it changes. This slows down response time but is perfect for development
   # since you don't have to restart the web server when you make code changes.
-  config.cache_classes = false
+  config.enable_reloading = true
 
   # Do not eager load code on boot.
   config.eager_load = false
@@ -61,18 +61,18 @@
   # Highlight code that triggered database queries in logs.
   config.active_record.verbose_query_logs = true
 
+  # Highlight code that enqueued background job in logs.
+  config.active_job.verbose_enqueue_logs = true
+
+  # Suppress logger output for asset requests.
+  config.assets.quiet = true
+
   # Debug mode disables concatenation and preprocessing of assets.
   # This option may cause significant delays in view rendering with a large
   # number of complex assets.
   config.assets.debug = true
   # config.assets.debug = false
 
-  # Suppress logger output for asset requests.
-  config.assets.quiet = true
-
-  # reduce the amount of logging for asset requests
-  config.assets.logger = false
-
   # Raises error for missing translations
   # config.i18n.raise_on_missing_translations = true
 
@@ -103,6 +103,9 @@
   config.action_cable.disable_request_forgery_protection = true
   config.action_cable.allowed_request_origins = '*'
 
+  # Raise error when a before_action's only/except options reference missing actions
+  config.action_controller.raise_on_missing_callback_actions = true
+
   # Enable detailed ActionCable logging
   config.action_cable.log_tags = [
     :channel,

config/environments/production.rb

@@ -6,7 +6,7 @@
   # Settings specified here will take precedence over those in config/application.rb.
 
   # Code is not reloaded between requests.
-  config.cache_classes = true
+  config.enable_reloading = false
 
   # Eager load code on boot. This eager loads most of Rails and
   # your application in memory, allowing both threaded web servers
@@ -22,12 +22,11 @@
 
   config.action_controller.default_protect_from_forgery = false
 
-  # Ensures that a master key has been made available in either ENV["RAILS_MASTER_KEY"]
-  # or in config/master.key. This key is used to decrypt credentials (and other encrypted files).
+  # Ensures that a master key has been made available in ENV["RAILS_MASTER_KEY"], config/master.key, or an environment
+  # key such as config/credentials/production.key. This key is used to decrypt credentials (and other encrypted files).
   # config.require_master_key = true
 
-  # Disable serving static files from the `/public` folder by default since
-  # Apache or NGINX already handles this.
+  # Enable static file serving from the `/public` folder (turn off if using NGINX/Apache for it).
   config.public_file_server.enabled = ENV['RAILS_SERVE_STATIC_FILES'].present?
 
   # Compress JavaScripts and CSS.
@@ -55,18 +54,27 @@
   # config.action_cable.allowed_request_origins = [ 'http://example.com', /http:\/\/example.*/ ]
   config.action_cable.disable_request_forgery_protection = true
   config.action_cable.allowed_request_origins = '*'
+  #
+  # Assume all access to the app is happening through a SSL-terminating reverse proxy.
+  # Can be used together with config.force_ssl for Strict-Transport-Security and secure cookies.
+  # config.assume_ssl = true
 
   # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
   # config.force_ssl = true
 
-  # Info include generic and useful information about system operation, but avoids logging too much
-  # information to avoid inadvertent exposure of personally identifiable information (PII). Use "debug"
-  # for everything.
-  config.log_level = ENV.fetch('RAILS_LOG_LEVEL', 'info')
+  # Log to STDOUT by default
+  config.logger = ActiveSupport::Logger.new($stdout)
+    .tap  { |logger| logger.formatter = Logger::Formatter.new }
+    .then { |logger| ActiveSupport::TaggedLogging.new(logger) }
 
   # Prepend all log lines with the following tags.
   config.log_tags = [ :request_id ]
 
+  # Info include generic and useful information about system operation, but avoids logging too much
+  # information to avoid inadvertent exposure of personally identifiable information (PII). If you
+  # want to log everything, set the level to "debug".
+  config.log_level = ENV.fetch('RAILS_LOG_LEVEL', 'info')
+
   # Use a different cache store in production.
   # config.cache_store = :mem_cache_store
 
@@ -87,21 +95,16 @@
   # Don't log any deprecations.
   config.active_support.report_deprecations = false
 
-  # Use default logging formatter so that PID and timestamp are not suppressed.
-  config.log_formatter = Logger::Formatter.new
-
-  # Use a different logger for distributed setups.
-  # require 'syslog/logger'
-  # config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new 'app-name')
-
-  if ENV['RAILS_LOG_TO_STDOUT'].present?
-    logger           = ActiveSupport::Logger.new($stdout)
-    logger.formatter = config.log_formatter
-    config.logger    = ActiveSupport::TaggedLogging.new(logger)
-  end
-
   # Do not dump schema after migrations.
   config.active_record.dump_schema_after_migration = false
 
+  # Enable DNS rebinding protection and other `Host` header attacks.
+  # config.hosts = [
+  #   "example.com",     # Allow requests from example.com
+  #   /.*\.example\.com/ # Allow requests from subdomains like `www.example.com`
+  # ]
+  # Skip DNS rebinding protection for the default health check endpoint.
+  # config.host_authorization = { exclude: ->(request) { request.path == "/up" } }
+
   config.action_mailer.default_url_options = { host: ENV.fetch('QUEPID_DOMAIN', nil) }
 end

config/environments/test.rb

@@ -10,12 +10,13 @@
 Rails.application.configure do
   # Settings specified here will take precedence over those in config/application.rb.
 
-  # Turn false under Spring and add config.action_view.cache_template_loading = true.
-  config.cache_classes = true
+  # While tests run files are not watched, reloading is not necessary.
+  config.enable_reloading = false
 
-  # Eager loading loads your whole application. When running a single test locally,
-  # this probably isn't necessary. It's a good idea to do in a continuous integration
-  # system, or in some way before deploying your code.
+  # Eager loading loads your entire application. When running a single test locally,
+  # this is usually not necessary, and can slow down your test suite. However, it's
+  # recommended that you enable it in continuous integration systems to ensure eager
+  # loading is working properly before deploying your code.
   config.eager_load = ENV['CI'].present?
 
   # Configure public file server for tests with Cache-Control for performance.
@@ -74,6 +75,9 @@
   # Annotate rendered view with file names.
   # config.action_view.annotate_rendered_view_with_filenames = true
 
+  # Raise error when a before_action's only/except options reference missing actions
+  config.action_controller.raise_on_missing_callback_actions = true
+
   ENV['TC_URL'] = 'https://quepid.com/agreement'
 
   ENV['QUEPID_GA'] = 'UA-FAKE-GA-CODE-FOR-TESTING'

config/initializers/content_security_policy.rb

@@ -16,9 +16,9 @@
     policy.report_uri "/csp-violation-report-endpoint"
   end
   #
-  #   # Generate session nonces for permitted importmap and inline scripts
+  #   # Generate session nonces for permitted importmap, inline scripts, and inline styles.
   #   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
-  #   config.content_security_policy_nonce_directives = %w(script-src)
+  #   config.content_security_policy_nonce_directives = %w(script-src style-src)
   #
   #   # Report violations without enforcing the policy.
   #   # config.content_security_policy_report_only = true

config/initializers/filter_parameter_logging.rb

@@ -3,9 +3,9 @@
 # require 'active_support'
 # Be sure to restart your server when you modify this file.
 
-# Configure parameters to be filtered from the log file. Use this to limit dissemination of
-# sensitive information. See the ActiveSupport::ParameterFilter documentation for supported
-# notations and behaviors.
+# Configure parameters to be partially matched (e.g. passw matches password) and filtered from the log file.
+# Use this to limit dissemination of sensitive information.
+# See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
 Rails.application.config.filter_parameters += [
   :passw, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :document_fields
 ]

config/initializers/permissions_policy.rb

@@ -1,13 +1,15 @@
 # frozen_string_literal: true
 
+## Be sure to restart your server when you modify this file.
+
 # Define an application-wide HTTP permissions policy. For further
-# information see https://developers.google.com/web/updates/2018/06/feature-policy
-#
-# Rails.application.config.permissions_policy do |f|
-#   f.camera      :none
-#   f.gyroscope   :none
-#   f.microphone  :none
-#   f.usb         :none
-#   f.fullscreen  :self
-#   f.payment     :self, "https://secure.example.com"
+# information see: https://developers.google.com/web/updates/2018/06/feature-policy
+
+# Rails.application.config.permissions_policy do |policy|
+#   policy.camera      :none
+#   policy.gyroscope   :none
+#   policy.microphone  :none
+#   policy.usb         :none
+#   policy.fullscreen  :self
+#   policy.payment     :self, "https://secure.example.com"
 # end

config/locales/en.yml

@@ -1,6 +1,6 @@
-# Files in the config/locales directory are used for internationalization
-# and are automatically loaded by Rails. If you want to use locales other
-# than English, add the necessary files in this directory.
+# Files in the config/locales directory are used for internationalization and
+# are automatically loaded by Rails. If you want to use locales other than
+# English, add the necessary files in this directory.
 #
 # To use the locales, use `I18n.t`:
 #
@@ -16,19 +16,15 @@
 #
 # This would use the information in config/locales/es.yml.
 #
-# The following keys must be escaped otherwise they will not be retrieved by
-# the default I18n backend:
+#  To learn more about the API, please read the Rails Internationalization guide
+# at https://guides.rubyonrails.org/i18n.html.
 #
-# true, false, on, off, yes, no
+# Be aware that YAML interprets the following case-insensitive strings as
+# booleans: `true`, `false`, `on`, `off`, `yes`, `no`. Therefore, these strings
+# must be quoted to be interpreted as strings. For example:
 #
-# Instead, surround them with single quotes.
-#
-# en:
-#   'true': 'foo'
-#
-#
-# To learn more, please read the Rails Internationalization guide
-# available at https://guides.rubyonrails.org/i18n.html.
+#       "yes": yup
+#       enabled: "ON"
 
 en:
   hello: 'world'

config/puma.rb

@@ -18,6 +18,10 @@
   #ActiveRecord::Base.establish_connection
 #end
 
+# This configuration file will be evaluated by Puma. The top-level methods that
+# are invoked here are part of Puma's configuration DSL. For more information
+# about methods provided by the DSL, see https://puma.io/puma/Puma/DSL.html.
+# 
 # Puma can serve each request in a thread from an internal thread pool.
 # The `threads` method setting takes two numbers: a minimum and maximum.
 # Any libraries that use thread pools should be configured to match
@@ -28,13 +32,20 @@
 min_threads_count = ENV.fetch("RAILS_MIN_THREADS") { max_threads_count }
 threads min_threads_count, max_threads_count
 
+# Specifies that the worker count should equal the number of processors in production.
+if ENV["RAILS_ENV"] == "production"
+  require "concurrent-ruby"
+  worker_count = Integer(ENV.fetch("WEB_CONCURRENCY") { Concurrent.physical_processor_count })
+  workers worker_count if worker_count > 1
+end
+
 # Specifies the `worker_timeout` threshold that Puma will use to wait before
 # terminating a worker in development environments.
-#
+
 worker_timeout 3600 if ENV.fetch("RAILS_ENV", "development") == "development"
 
 # Specifies the `port` that Puma will listen on to receive requests; default is 3000.
-#
+
 port ENV.fetch("PORT") { 3000 }
 
 # Specifies the `environment` that Puma will run in.
@@ -44,20 +55,5 @@
 # Specifies the `pidfile` that Puma will use.
 pidfile ENV.fetch("PIDFILE") { "tmp/pids/server.pid" }
 
-# Specifies the number of `workers` to boot in clustered mode.
-# Workers are forked web server processes. If using threads and workers together
-# the concurrency of the application would be max `threads` * `workers`.
-# Workers do not work on JRuby or Windows (both of which do not support
-# processes).
-#
-# workers ENV.fetch("WEB_CONCURRENCY") { 2 }
-
-# Use the `preload_app!` method when specifying a `workers` number.
-# This directive tells Puma to first boot the application and load code
-# before forking the application. This takes advantage of Copy On Write
-# process behavior so workers use less memory.
-#
-# preload_app!
-
 # Allow puma to be restarted by `bin/rails restart` command.
 plugin :tmp_restart

config/routes.rb

@@ -7,6 +7,10 @@
   apipie
   mount ActiveStorageDB::Engine => '/active_storage_db'
   Healthcheck.routes(self)
+  # Reveal health status on /up that returns 200 if the app boots with no exceptions, otherwise 500.
+  # Can be used by load balancers and uptime monitors to verify that the app is live.
+  get 'up' => 'rails/health#show', as: :rails_health_check
+
   constraints(AdminConstraint) do
     mount Sidekiq::Web, at: 'admin/jobs'
   end

package.json

@@ -7,8 +7,8 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@popperjs/core": "^2.11.6",
-    "@rails/actioncable": "7.1.3",
-    "@rails/activestorage": "7.1.3",
+    "@rails/actioncable": "7.1.3-3",
+    "@rails/activestorage": "7.1.3-3",
     "ace-builds": "^1.32.2",
     "angular": "~1.8.3",
     "angular-animate": "^1.8.3",