diff --git a/Gemfile b/Gemfile index f456167b..25f42ccd 100644 --- a/Gemfile +++ b/Gemfile @@ -1,6 +1,6 @@ source "https://rubygems.org" -gem "rails", "7.1.3.4" +gem "rails", "7.2.0" gem "activerecord-import" gem "addressable" diff --git a/Gemfile.lock b/Gemfile.lock index 35d2d7ff..c43ad8e5 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,82 +1,78 @@ GEM remote: https://rubygems.org/ specs: - actioncable (7.1.3.4) - actionpack (= 7.1.3.4) - activesupport (= 7.1.3.4) + actioncable (7.2.0) + actionpack (= 7.2.0) + activesupport (= 7.2.0) nio4r (~> 2.0) websocket-driver (>= 0.6.1) zeitwerk (~> 2.6) - actionmailbox (7.1.3.4) - actionpack (= 7.1.3.4) - activejob (= 7.1.3.4) - activerecord (= 7.1.3.4) - activestorage (= 7.1.3.4) - activesupport (= 7.1.3.4) - mail (>= 2.7.1) - net-imap - net-pop - net-smtp - actionmailer (7.1.3.4) - actionpack (= 7.1.3.4) - actionview (= 7.1.3.4) - activejob (= 7.1.3.4) - activesupport (= 7.1.3.4) - mail (~> 2.5, >= 2.5.4) - net-imap - net-pop - net-smtp + actionmailbox (7.2.0) + actionpack (= 7.2.0) + activejob (= 7.2.0) + activerecord (= 7.2.0) + activestorage (= 7.2.0) + activesupport (= 7.2.0) + mail (>= 2.8.0) + actionmailer (7.2.0) + actionpack (= 7.2.0) + actionview (= 7.2.0) + activejob (= 7.2.0) + activesupport (= 7.2.0) + mail (>= 2.8.0) rails-dom-testing (~> 2.2) - actionpack (7.1.3.4) - actionview (= 7.1.3.4) - activesupport (= 7.1.3.4) + actionpack (7.2.0) + actionview (= 7.2.0) + activesupport (= 7.2.0) nokogiri (>= 1.8.5) racc - rack (>= 2.2.4) + rack (>= 2.2.4, < 3.2) rack-session (>= 1.0.1) rack-test (>= 0.6.3) rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) - actiontext (7.1.3.4) - actionpack (= 7.1.3.4) - activerecord (= 7.1.3.4) - activestorage (= 7.1.3.4) - activesupport (= 7.1.3.4) + useragent (~> 0.16) + actiontext (7.2.0) + actionpack (= 7.2.0) + activerecord (= 7.2.0) + activestorage (= 7.2.0) + activesupport (= 7.2.0) globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (7.1.3.4) - activesupport (= 7.1.3.4) + actionview (7.2.0) + activesupport (= 7.2.0) builder (~> 3.1) erubi (~> 1.11) rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) - activejob (7.1.3.4) - activesupport (= 7.1.3.4) + activejob (7.2.0) + activesupport (= 7.2.0) globalid (>= 0.3.6) - activemodel (7.1.3.4) - activesupport (= 7.1.3.4) - activerecord (7.1.3.4) - activemodel (= 7.1.3.4) - activesupport (= 7.1.3.4) + activemodel (7.2.0) + activesupport (= 7.2.0) + activerecord (7.2.0) + activemodel (= 7.2.0) + activesupport (= 7.2.0) timeout (>= 0.4.0) activerecord-import (1.7.0) activerecord (>= 4.2) - activestorage (7.1.3.4) - actionpack (= 7.1.3.4) - activejob (= 7.1.3.4) - activerecord (= 7.1.3.4) - activesupport (= 7.1.3.4) + activestorage (7.2.0) + actionpack (= 7.2.0) + activejob (= 7.2.0) + activerecord (= 7.2.0) + activesupport (= 7.2.0) marcel (~> 1.0) - activesupport (7.1.3.4) + activesupport (7.2.0) base64 bigdecimal - concurrent-ruby (~> 1.0, >= 1.0.2) + concurrent-ruby (~> 1.0, >= 1.3.1) connection_pool (>= 2.2.5) drb i18n (>= 1.6, < 2) + logger (>= 1.4.2) minitest (>= 5.1) - mutex_m - tzinfo (~> 2.0) + securerandom (>= 0.3) + tzinfo (~> 2.0, >= 2.0.5) addressable (2.8.7) public_suffix (>= 2.0.2, < 7.0) ast (2.4.2) @@ -228,14 +224,13 @@ GEM mime-types-data (3.2024.0604) mini_mime (1.1.5) mini_portile2 (2.8.7) - minitest (5.24.1) + minitest (5.25.0) msgpack (1.7.2) multi_xml (0.7.1) bigdecimal (~> 3.1) - mutex_m (0.2.0) net-http (0.4.1) uri - net-imap (0.4.12) + net-imap (0.4.14) date net-protocol net-pop (0.1.2) @@ -246,14 +241,14 @@ GEM net-protocol netrc (0.11.0) nio4r (2.7.3) - nokogiri (1.16.6) + nokogiri (1.16.7) mini_portile2 (~> 2.8.2) racc (~> 1.4) - nokogiri (1.16.6-aarch64-linux) + nokogiri (1.16.7-aarch64-linux) racc (~> 1.4) - nokogiri (1.16.6-arm64-darwin) + nokogiri (1.16.7-arm64-darwin) racc (~> 1.4) - nokogiri (1.16.6-x86_64-linux) + nokogiri (1.16.7-x86_64-linux) racc (~> 1.4) null_logger (0.0.1) oauth2 (2.0.9) @@ -517,7 +512,7 @@ GEM puma (6.4.2) nio4r (~> 2.0) raabro (1.4.0) - racc (1.8.0) + racc (1.8.1) rack (2.2.9) rack-protection (3.2.0) base64 (>= 0.1.0) @@ -531,20 +526,20 @@ GEM rackup (1.0.0) rack (< 3) webrick - rails (7.1.3.4) - actioncable (= 7.1.3.4) - actionmailbox (= 7.1.3.4) - actionmailer (= 7.1.3.4) - actionpack (= 7.1.3.4) - actiontext (= 7.1.3.4) - actionview (= 7.1.3.4) - activejob (= 7.1.3.4) - activemodel (= 7.1.3.4) - activerecord (= 7.1.3.4) - activestorage (= 7.1.3.4) - activesupport (= 7.1.3.4) + rails (7.2.0) + actioncable (= 7.2.0) + actionmailbox (= 7.2.0) + actionmailer (= 7.2.0) + actionpack (= 7.2.0) + actiontext (= 7.2.0) + actionview (= 7.2.0) + activejob (= 7.2.0) + activemodel (= 7.2.0) + activerecord (= 7.2.0) + activestorage (= 7.2.0) + activesupport (= 7.2.0) bundler (>= 1.15.0) - railties (= 7.1.3.4) + railties (= 7.2.0) rails-dom-testing (2.2.0) activesupport (>= 5.0.0) minitest @@ -552,10 +547,10 @@ GEM rails-html-sanitizer (1.6.0) loofah (~> 2.21) nokogiri (~> 1.14) - railties (7.1.3.4) - actionpack (= 7.1.3.4) - activesupport (= 7.1.3.4) - irb + railties (7.2.0) + actionpack (= 7.2.0) + activesupport (= 7.2.0) + irb (~> 1.13) rackup (>= 1.0.0) rake (>= 12.2) thor (~> 1.0, >= 1.2.2) @@ -645,6 +640,7 @@ GEM ruby-progressbar (1.13.0) rufus-scheduler (3.9.1) fugit (~> 1.1, >= 1.1.6) + securerandom (0.3.1) sentry-rails (5.19.0) railties (>= 5.0) sentry-ruby (~> 5.19.0) @@ -695,6 +691,7 @@ GEM concurrent-ruby (~> 1.0) unicode-display_width (2.5.0) uri (0.13.0) + useragent (0.16.10) version_gem (1.1.4) warden (1.2.9) rack (>= 2.0.9) @@ -713,7 +710,7 @@ GEM websocket-driver (0.7.6) websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) - zeitwerk (2.6.16) + zeitwerk (2.6.17) PLATFORMS aarch64-linux @@ -741,7 +738,7 @@ DEPENDENCIES pg plek pry - rails (= 7.1.3.4) + rails (= 7.2.0) rspec-its rspec-rails rspec-sidekiq diff --git a/app/lib/link_checker/uri_checker/http_checker.rb b/app/lib/link_checker/uri_checker/http_checker.rb index 4da6df66..dda24f5d 100644 --- a/app/lib/link_checker/uri_checker/http_checker.rb +++ b/app/lib/link_checker/uri_checker/http_checker.rb @@ -294,7 +294,7 @@ def gov_uk_upload_uri? def rate_limit_header return {} unless gov_uk_uri? - { "Rate-Limit-Token": Rails.application.secrets.govuk_rate_limit_token } + { "Rate-Limit-Token": Rails.application.credentials.govuk_rate_limit_token } end def basic_authorization_header diff --git a/bin/brakeman b/bin/brakeman new file mode 100755 index 00000000..ace1c9ba --- /dev/null +++ b/bin/brakeman @@ -0,0 +1,7 @@ +#!/usr/bin/env ruby +require "rubygems" +require "bundler/setup" + +ARGV.unshift("--ensure-latest") + +load Gem.bin_path("brakeman", "brakeman") diff --git a/bin/rubocop b/bin/rubocop new file mode 100755 index 00000000..40330c0f --- /dev/null +++ b/bin/rubocop @@ -0,0 +1,8 @@ +#!/usr/bin/env ruby +require "rubygems" +require "bundler/setup" + +# explicit rubocop config increases performance slightly while avoiding config confusion. +ARGV.unshift("--config", File.expand_path("../.rubocop.yml", __dir__)) + +load Gem.bin_path("rubocop", "rubocop") diff --git a/bin/setup b/bin/setup index ec47b79b..9824e82a 100755 --- a/bin/setup +++ b/bin/setup @@ -1,11 +1,11 @@ #!/usr/bin/env ruby require "fileutils" -# path to your application root. APP_ROOT = File.expand_path("..", __dir__) +APP_NAME = "link-checker-api" def system!(*args) - system(*args) || abort("\n== Command #{args} failed ==") + system(*args, exception: true) end FileUtils.chdir APP_ROOT do @@ -30,4 +30,8 @@ FileUtils.chdir APP_ROOT do puts "\n== Restarting application server ==" system! "bin/rails restart" + + # puts "\n== Configuring puma-dev ==" + # system "ln -nfs #{APP_ROOT} ~/.puma-dev/#{APP_NAME}" + # system "curl -Is https://#{APP_NAME}.test/up | head -n 1" end diff --git a/config/application.rb b/config/application.rb index b24ddaa1..eeaa7cf2 100644 --- a/config/application.rb +++ b/config/application.rb @@ -7,7 +7,7 @@ require "active_record/railtie" # require "active_storage/engine" require "action_controller/railtie" -require "action_mailer/railtie" +# require "action_mailer/railtie" # require "action_mailbox/engine" # require "action_text/engine" require "action_view/railtie" @@ -24,7 +24,7 @@ module LinkCheckerApi class Application < Rails::Application # Initialize configuration defaults for originally generated Rails version. - config.load_defaults 7.1 + config.load_defaults 7.2 # Please, add to the `ignore` list any other `lib` subdirectories that do # not contain `.rb` files, or that should not be reloaded or eager loaded. diff --git a/config/environments/development.rb b/config/environments/development.rb index 9a827e60..77c87878 100644 --- a/config/environments/development.rb +++ b/config/environments/development.rb @@ -14,27 +14,20 @@ # Show full error reports. config.consider_all_requests_local = true - # Enable server timing + # Enable server timing. config.server_timing = true # Enable/disable caching. By default caching is disabled. # Run rails dev:cache to toggle caching. if Rails.root.join("tmp/caching-dev.txt").exist? config.cache_store = :memory_store - config.public_file_server.headers = { - "Cache-Control" => "public, max-age=#{2.days.to_i}", - } + config.public_file_server.headers = { "Cache-Control" => "public, max-age=#{2.days.to_i}" } else config.action_controller.perform_caching = false config.cache_store = :null_store end - # Don't care if the mailer can't send. - config.action_mailer.raise_delivery_errors = false - - config.action_mailer.perform_caching = false - # Print deprecation notices to the Rails logger. config.active_support.deprecation = :log @@ -62,9 +55,12 @@ # Uncomment if you wish to allow Action Cable access from any origin. # config.action_cable.disable_request_forgery_protection = true - # Raise error when a before_action's only/except options reference missing actions + # Raise error when a before_action's only/except options reference missing actions. config.action_controller.raise_on_missing_callback_actions = true + # Apply autocorrection by RuboCop to files generated by `bin/rails generate`. + # config.generators.apply_rubocop_autocorrect_after_generate! + # Allow requests for all domains e.g. .dev.gov.uk config.hosts.clear config.debug_exception_response_format = :api diff --git a/config/environments/production.rb b/config/environments/production.rb index 95372ff1..d77ee219 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -19,7 +19,7 @@ # key such as config/credentials/production.key. This key is used to decrypt credentials (and other encrypted files). # config.require_master_key = true - # Enable static file serving from the `/public` folder (turn off if using NGINX/Apache for it). + # Disable serving static files from `public/`, relying on NGINX/Apache to do so instead. config.public_file_server.enabled = ENV["RAILS_SERVE_STATIC_FILES"].present? # Enable serving of images, stylesheets, and JavaScripts from an asset server. @@ -41,13 +41,23 @@ # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies. # config.force_ssl = true + # Skip http-to-https redirect for the default health check endpoint. + # config.ssl_options = { redirect: { exclude: ->(request) { request.path == "/up" } } } + + # Log to STDOUT by default + if ENV["RAILS_LOG_TO_STDOUT"].present? + logger = ActiveSupport::Logger.new($stdout) + logger.formatter = config.log_formatter + config.logger = ActiveSupport::TaggedLogging.new(logger) + end + # Prepend all log lines with the following tags. config.log_tags = [:request_id] - # Info include generic and useful information about system operation, but avoids logging too much + # "info" includes generic and useful information about system operation, but avoids logging too much # information to avoid inadvertent exposure of personally identifiable information (PII). If you # want to log everything, set the level to "debug". - config.log_level = ENV.fetch("RAILS_LOG_LEVEL", :info) + config.log_level = ENV.fetch("RAILS_LOG_LEVEL", "info") # Use a different cache store in production. # config.cache_store = :mem_cache_store @@ -56,12 +66,6 @@ # config.active_job.queue_adapter = :resque # config.active_job.queue_name_prefix = "link_checker_api_production" - config.action_mailer.perform_caching = false - - # Ignore bad email addresses and do not raise email delivery errors. - # Set this to true and configure the email server for immediate delivery to raise delivery errors. - # config.action_mailer.raise_delivery_errors = false - # Enable locale fallbacks for I18n (makes lookups for any locale fall back to # the I18n.default_locale when a translation cannot be found). config.i18n.fallbacks = true @@ -69,14 +73,16 @@ # Don't log any deprecations. config.active_support.report_deprecations = false - if ENV["RAILS_LOG_TO_STDOUT"].present? - logger = ActiveSupport::Logger.new($stdout) - logger.formatter = config.log_formatter - config.logger = ActiveSupport::TaggedLogging.new(logger) - end - # Do not dump schema after migrations. config.active_record.dump_schema_after_migration = false + # Enable DNS rebinding protection and other `Host` header attacks. + # config.hosts = [ + # "example.com", # Allow requests from example.com + # /.*\.example\.com/ # Allow requests from subdomains like `www.example.com` + # ] + # Skip DNS rebinding protection for the default health check endpoint. + # config.host_authorization = { exclude: ->(request) { request.path == "/up" } } + config.action_controller.perform_caching = true end diff --git a/config/environments/test.rb b/config/environments/test.rb index 2c44ae54..a621f7a9 100644 --- a/config/environments/test.rb +++ b/config/environments/test.rb @@ -19,28 +19,19 @@ # Configure public file server for tests with Cache-Control for performance. config.public_file_server.enabled = true - config.public_file_server.headers = { - "Cache-Control" => "public, max-age=#{1.hour.to_i}", - } + config.public_file_server.headers = { "Cache-Control" => "public, max-age=#{1.hour.to_i}" } # Show full error reports and disable caching. config.consider_all_requests_local = true config.action_controller.perform_caching = false config.cache_store = :null_store - # Raise exceptions instead of rendering exception templates. + # Render exception templates for rescuable exceptions and raise for other exceptions. config.action_dispatch.show_exceptions = :rescuable # Disable request forgery protection in test environment. config.action_controller.allow_forgery_protection = false - config.action_mailer.perform_caching = false - - # Tell Action Mailer not to deliver emails to the real world. - # The :test delivery method accumulates sent emails in the - # ActionMailer::Base.deliveries array. - config.action_mailer.delivery_method = :test - # Print deprecation notices to the stderr. config.active_support.deprecation = :stderr @@ -56,7 +47,7 @@ # Annotate rendered view with file names. # config.action_view.annotate_rendered_view_with_filenames = true - # Raise error when a before_action's only/except options reference missing actions + # Raise error when a before_action's only/except options reference missing actions. config.action_controller.raise_on_missing_callback_actions = true config.active_job.queue_adapter = :test diff --git a/config/initializers/hosts_with_basic_authorization.rb b/config/initializers/hosts_with_basic_authorization.rb index 4ee76b56..f19f6bcb 100644 --- a/config/initializers/hosts_with_basic_authorization.rb +++ b/config/initializers/hosts_with_basic_authorization.rb @@ -1,4 +1,4 @@ -if Rails.application.secrets.govuk_basic_auth_credentials +if Rails.application.credentials.govuk_basic_auth_credentials govuk_website_host = URI(Plek.website_root).host.to_s - LinkCheckerApi.hosts_with_basic_authorization[govuk_website_host] = Rails.application.secrets.govuk_basic_auth_credentials + LinkCheckerApi.hosts_with_basic_authorization[govuk_website_host] = Rails.application.credentials.govuk_basic_auth_credentials end diff --git a/config/initializers/secrets_to_credentials.rb b/config/initializers/secrets_to_credentials.rb new file mode 100644 index 00000000..562a393a --- /dev/null +++ b/config/initializers/secrets_to_credentials.rb @@ -0,0 +1,7 @@ +# Rails 7 has begun to deprecate Rails.application.secrets in favour +# of Rails.application.credentials, but that adds the burden of master key +# administration without giving us any benefit (because our production +# secrets are handled as env vars, not committed to our repo. Here we +# load the config/secrets.YML values into Rails.application.credentials, +# retaining the existing behaviour while dropping deprecated references. +Rails.application.credentials.merge!(Rails.application.config_for(:secrets)) diff --git a/spec/lib/link_checker_spec.rb b/spec/lib/link_checker_spec.rb index 764cb2c3..433ae732 100644 --- a/spec/lib/link_checker_spec.rb +++ b/spec/lib/link_checker_spec.rb @@ -348,7 +348,7 @@ context "bypassing the GOV.UK rate limiter" do before do stub_request(:get, uri) - .with(headers: { "Rate-Limit-Token": Rails.application.secrets.govuk_rate_limit_token, "Accept-Encoding": "none" }) + .with(headers: { "Rate-Limit-Token": Rails.application.credentials.govuk_rate_limit_token, "Accept-Encoding": "none" }) .to_return(status: 200) end @@ -361,7 +361,7 @@ subject expect(WebMock).to have_requested(:get, uri) - .with(headers: { "Rate-Limit-Token": Rails.application.secrets.govuk_rate_limit_token, "Accept-Encoding": "none" }) + .with(headers: { "Rate-Limit-Token": Rails.application.credentials.govuk_rate_limit_token, "Accept-Encoding": "none" }) end end @@ -370,12 +370,12 @@ let(:uri) { "http://#{host}/a/page" } let!(:request) do stub_request(:get, uri) - .with(headers: { "Authorization": "Basic #{Base64.encode64(Rails.application.secrets.govuk_basic_auth_credentials)}".strip }) + .with(headers: { "Authorization": "Basic #{Base64.encode64(Rails.application.credentials.govuk_basic_auth_credentials)}".strip }) .to_return(status: 200) end before do - LinkCheckerApi.hosts_with_basic_authorization[host.to_s] = Rails.application.secrets.govuk_basic_auth_credentials + LinkCheckerApi.hosts_with_basic_authorization[host.to_s] = Rails.application.credentials.govuk_basic_auth_credentials end it "should add basic auth" do diff --git a/spec/service_consumers/pact_helper.rb b/spec/service_consumers/pact_helper.rb index f3d2d572..a346691b 100644 --- a/spec/service_consumers/pact_helper.rb +++ b/spec/service_consumers/pact_helper.rb @@ -1,3 +1,4 @@ +require "active_support" require "pact/provider/rspec" require "webmock/rspec" require "factory_bot_rails"