Feat/front - Authentication/Authorization/Frontend in Ruby side - #1
Merged
Merged
Conversation
- Created 422.html for handling "Unprocessable Entity" errors with a user-friendly message and SVG icon. - Created 500.html for handling "Internal Server Error" with a corresponding message and SVG icon. - Added icon.png and icon.svg for branding and visual representation on error pages. - Included a robots.txt file to manage web crawler access. - Added placeholder .keep files in various directories to ensure they are tracked by version control.
- Added package.json with dependencies for React, Inertia.js, Tailwind CSS, and Vite. - Created rails_helper.rb and spec_helper.rb for RSpec configuration. - Added TypeScript configuration files: tsconfig.app.json, tsconfig.node.json, and tsconfig.json. - Set up Vite configuration for React, Inertia.js, and Tailwind CSS integration.
This commit renames config/database.yml to config/database.yml.sample to keep environment-specific database settings out of version control. The sample file can still be copied and customized locally without committing sensitive or machine-specific values.
…reate database.yml for development and production
…ord recovery features
…n concern with tests
… and add corresponding tests
…esponding request specs
…sponding request specs
…onality and corresponding request specs
|
Important Review skippedToo many files! This PR contains 175 files, which is 75 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (9)
📒 Files selected for processing (175)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Delivers the Rails 8 / Ruby 4 user-management application: authentication,
authorization, the admin user backend, and self-service profiles, with a
full RSpec suite.
masterwas an empty repo (README + CodeQL workflow only),so this PR is the whole application.
Stack: Rails 8.1 · Ruby 4.0.6 · PostgreSQL · Vite + Inertia.js + React ·
Tailwind · RSpec + Playwright
What's included
Authentication & registration — Rails 8's built-in generator, no Devise.
Session cookies are signed, httponly,
same_site: :lax; sign-in and passwordreset are rate-limited. Visitors self-register as members;
roleis forcedserver-side so the param can't escalate.
Authorization —
ApplicationPolicy/UserPolicybehind anAuthorizationconcern.
authorize!derives the predicate fromaction_name. Policy scopesnarrow queries at the source, so a member requesting another user's record gets
a 404 rather than a 403 — no existence leak.
Admin — dashboard, user CRUD, and a role toggle guarded so an admin cannot
demote themselves.
UserSearchhandles filtering, sorting, and pagination withcolumn/direction allowlists and
sanitize_sql_likeescaping.Profiles — members view, edit, and delete only their own account.
Data —
email_addressis deterministically encrypted (unique index intact);avatars accept an ActiveStorage upload or a remote URL, with content-type and
size validation; a model-level guard prevents removing the last administrator.
Tests
296 examples, 0 failures — 98.61% line, 100% branch coverage. SimpleCov gates
the build at 90% line / 80% branch. Request, model, policy, serializer, query,
and mailer specs, plus a Playwright system spec covering real-browser sign-in.
RuboCop (rails-omakase) is clean.
Not in this PR
Admin/Users/*,Profile/*, andAuth/Register; onlyhomeandinertia_exampleexist so far. The serverside is complete and specced, but these screens will not render yet.
roois vendored; the importer and Solid Queue jobare not written.