diff --git a/main-server/.gitignore b/main-server/.gitignore new file mode 100644 index 0000000..3b6ee58 --- /dev/null +++ b/main-server/.gitignore @@ -0,0 +1 @@ +/coverage diff --git a/main-server/.rspec b/main-server/.rspec new file mode 100644 index 0000000..c99d2e7 --- /dev/null +++ b/main-server/.rspec @@ -0,0 +1 @@ +--require spec_helper diff --git a/main-server/Gemfile b/main-server/Gemfile index 80c1159..9732572 100644 --- a/main-server/Gemfile +++ b/main-server/Gemfile @@ -1,7 +1,13 @@ source "https://rubygems.org" gem "rails", "~> 8.1.2" +# Use sqlite3 as the database for Active Record in development/test gem "sqlite3", ">= 2.1" + +# Use PostgreSQL in production +group :production do + gem "pg", "~> 1.5" +end gem "puma", ">= 5.0" # Use Active Model has_secure_password [https://guides.rubyonrails.org/active_model_basics.html#securepassword] @@ -34,9 +40,14 @@ gem "rack-cors" group :development, :test do gem "debug", platforms: %i[ mri windows ], require: "debug/prelude" + gem "rspec-rails", "~> 8.0" gem "bundler-audit", require: false gem "brakeman", require: false gem "rubocop-rails-omakase", require: false end gem "redis", "~> 6.0" + +group :test do + gem "simplecov", require: false +end diff --git a/main-server/Gemfile.lock b/main-server/Gemfile.lock index 2089d47..8d879d2 100644 --- a/main-server/Gemfile.lock +++ b/main-server/Gemfile.lock @@ -95,6 +95,7 @@ GEM debug (1.11.1) irb (~> 1.10) reline (>= 0.3.8) + diff-lcs (1.6.2) dotenv (3.2.0) drb (2.2.3) ed25519 (1.4.0) @@ -190,6 +191,11 @@ GEM parser (3.3.12.0) ast (~> 2.4.1) racc + pg (1.6.3) + pg (1.6.3-aarch64-linux) + pg (1.6.3-aarch64-linux-musl) + pg (1.6.3-x86_64-linux) + pg (1.6.3-x86_64-linux-musl) pp (0.6.4) prettyprint prettyprint (0.2.0) @@ -257,6 +263,23 @@ GEM regexp_parser (2.12.0) reline (0.7.0) io-console (~> 0.5) + rspec-core (3.13.6) + rspec-support (~> 3.13.0) + rspec-expectations (3.13.5) + diff-lcs (>= 1.2.0, < 2.0) + rspec-support (~> 3.13.0) + rspec-mocks (3.13.8) + diff-lcs (>= 1.2.0, < 2.0) + rspec-support (~> 3.13.0) + rspec-rails (8.0.4) + actionpack (>= 7.2) + activesupport (>= 7.2) + railties (>= 7.2) + rspec-core (>= 3.13.0, < 5.0.0) + rspec-expectations (>= 3.13.0, < 5.0.0) + rspec-mocks (>= 3.13.0, < 5.0.0) + rspec-support (>= 3.13.0, < 5.0.0) + rspec-support (3.13.7) rubocop (1.91.0) json (>= 2.3) language_server-protocol (~> 3.17.0.2) @@ -290,6 +313,7 @@ GEM ffi (~> 1.12) logger securerandom (0.4.1) + simplecov (1.3.2) solid_cable (4.0.2) actioncable (>= 7.2) activejob (>= 7.2) @@ -358,11 +382,14 @@ DEPENDENCIES json (~> 2.19) jwt (~> 2.10) kamal + pg (~> 1.5) puma (>= 5.0) rack-cors rails (~> 8.1.2) redis (~> 6.0) + rspec-rails (~> 8.0) rubocop-rails-omakase + simplecov solid_cable solid_cache solid_queue @@ -397,6 +424,7 @@ CHECKSUMS crass (1.0.7) sha256=94868719948664c89ddcaf0a37c65048413dfcb1c869470a5f7a7ceb5390b295 date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0 debug (1.11.1) sha256=2e0b0ac6119f2207a6f8ac7d4a73ca8eb4e440f64da0a3136c30343146e952b6 + diff-lcs (1.6.2) sha256=9ae0d2cba7d4df3075fe8cd8602a8604993efc0dfa934cff568969efb1909962 dotenv (3.2.0) sha256=e375b83121ea7ca4ce20f214740076129ab8514cd81378161f11c03853fe619d drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373 ed25519 (1.4.0) sha256=16e97f5198689a154247169f3453ef4cfd3f7a47481fde0ae33206cdfdcac506 @@ -445,6 +473,11 @@ CHECKSUMS ostruct (0.6.3) sha256=95a2ed4a4bd1d190784e666b47b2d3f078e4a9efda2fccf18f84ddc6538ed912 parallel (2.2.0) sha256=e1059c5fd7b649558a0aec38a769f06a42942bdb40503d005a59c352fe011cd8 parser (3.3.12.0) sha256=21a6d7f755d5a24dfbdc6e6b772e4e879a52e7631a88bc5a3a134606052c9828 + pg (1.6.3) sha256=1388d0563e13d2758c1089e35e973a3249e955c659592d10e5b77c468f628a99 + pg (1.6.3-aarch64-linux) sha256=0698ad563e02383c27510b76bf7d4cd2de19cd1d16a5013f375dd473e4be72ea + pg (1.6.3-aarch64-linux-musl) sha256=06a75f4ea04b05140146f2a10550b8e0d9f006a79cdaf8b5b130cde40e3ecc2c + pg (1.6.3-x86_64-linux) sha256=5d9e188c8f7a0295d162b7b88a768d8452a899977d44f3274d1946d67920ae8d + pg (1.6.3-x86_64-linux-musl) sha256=9c9c90d98c72f78eb04c0f55e9618fe55d1512128e411035fe229ff427864009 pp (0.6.4) sha256=dfcb0fce700c41456265922884f9fe195d7fbb0674a3578e6c0f69588e82b570 prettyprint (0.2.0) sha256=2bc9e15581a94742064a3cc8b0fb9d45aae3d03a1baa6ef80922627a0766f193 prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85 @@ -468,6 +501,11 @@ CHECKSUMS redis-client (0.30.1) sha256=5151bc5c7bbfe48623732cdae3b900d8a22dc691cc7cdfacfb351ac55116522d regexp_parser (2.12.0) sha256=35a916a1d63190ab5c9009457136ae5f3c0c7512d60291d0d1378ba18ce08ebb reline (0.7.0) sha256=5b012d8e55dbf9d450f12bde2cf7d15ff546ae80b3f8f3b30e570d431815583d + rspec-core (3.13.6) sha256=a8823c6411667b60a8bca135364351dda34cd55e44ff94c4be4633b37d828b2d + rspec-expectations (3.13.5) sha256=33a4d3a1d95060aea4c94e9f237030a8f9eae5615e9bd85718fe3a09e4b58836 + rspec-mocks (3.13.8) sha256=086ad3d3d17533f4237643de0b5c42f04b66348c28bf6b9c2d3f4a3b01af1d47 + rspec-rails (8.0.4) sha256=06235692fc0892683d3d34977e081db867434b3a24ae0dd0c6f3516bad4e22df + rspec-support (3.13.7) sha256=0640e5570872aafefd79867901deeeeb40b0c9875a36b983d85f54fb7381c47c rubocop (1.91.0) sha256=9c82b7bf391c5d7e3798c5b9996e22a1fe3bd7468e351dfdeb96140c058296d0 rubocop-ast (1.50.0) sha256=b9ca88300da0803ee222ad20cdb30494c0a784eed06fdc35d254b06d662788db rubocop-performance (1.27.0) sha256=eeeb1374d062a368ee1c787b70eb0b0cc4b184cb1f8565f424760946146d61ce @@ -476,6 +514,7 @@ CHECKSUMS ruby-progressbar (1.13.0) sha256=80fc9c47a9b640d6834e0dc7b3c94c9df37f08cb072b7761e4a71e22cff29b33 ruby-vips (2.3.0) sha256=e685ec02c13969912debbd98019e50492e12989282da5f37d05f5471442f5374 securerandom (0.4.1) sha256=cc5193d414a4341b6e225f0cb4446aceca8e50d5e1888743fac16987638ea0b1 + simplecov (1.3.2) sha256=2a22ec1759f1b8db60881a2e038758956fc69ef93ed669be0bde0678de6d0e85 solid_cable (4.0.2) sha256=084636a67679ad00d23088b33c84047e614bcf41ee559db24b414d83cdc42d03 solid_cache (1.0.10) sha256=bc05a2fb3ac78a6f43cbb5946679cf9db67dd30d22939ededc385cb93e120d41 solid_queue (1.7.0) sha256=6566b70b801d1c317c81bba7bcdd5677c019afac584a30374b4164002ca356d3 diff --git a/main-server/config/application.rb b/main-server/config/application.rb index b71b039..3d0e093 100644 --- a/main-server/config/application.rb +++ b/main-server/config/application.rb @@ -11,7 +11,7 @@ require "action_controller/railtie" # require "action_mailbox/engine" # require "action_text/engine" # require "action_view/railtie" -# require "action_cable/engine" +require "action_cable/engine" # require "rails/test_unit/railtie" # Require the gems listed in Gemfile, including any gems diff --git a/main-server/config/database.yml b/main-server/config/database.yml index 302d638..95234dc 100644 --- a/main-server/config/database.yml +++ b/main-server/config/database.yml @@ -20,21 +20,20 @@ test: <<: *default database: storage/test.sqlite3 -# Store production database in the storage/ directory, which by default -# is mounted as a persistent Docker volume in config/deploy.yml. +# PostgreSQL for production. +# +# Configure via DATABASE_URL environment variable: +# postgresql://user:password@host:5432/database +# +# Or via individual variables: +# DB_NAME, DB_USER, DB_PASSWORD, DB_HOST, DB_PORT +# production: - primary: - <<: *default - database: storage/production.sqlite3 - cache: - <<: *default - database: storage/production_cache.sqlite3 - migrations_paths: db/cache_migrate - queue: - <<: *default - database: storage/production_queue.sqlite3 - migrations_paths: db/queue_migrate - cable: - <<: *default - database: storage/production_cable.sqlite3 - migrations_paths: db/cable_migrate + adapter: postgresql + encoding: unicode + pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %> + database: <%= ENV["DB_NAME"] %> + username: <%= ENV["DB_USER"] %> + password: <%= ENV["DB_PASSWORD"] %> + host: <%= ENV["DB_HOST"] %> + port: <%= ENV["DB_PORT"] || 5432 %> diff --git a/main-server/config/environments/test.rb b/main-server/config/environments/test.rb index c2095b1..1427836 100644 --- a/main-server/config/environments/test.rb +++ b/main-server/config/environments/test.rb @@ -31,13 +31,7 @@ Rails.application.configure do # Store uploaded files on the local file system in a temporary directory. config.active_storage.service = :test - # Tell Action Mailer not to deliver emails to the real world. - # The :test delivery method accumulates sent emails in the - # ActionMailer::Base.deliveries array. - config.action_mailer.delivery_method = :test - - # Set host to be used by links generated in mailer templates. - config.action_mailer.default_url_options = { host: "example.com" } + # Action Mailer is not enabled in this application. # Print deprecation notices to the stderr. config.active_support.deprecation = :stderr diff --git a/main-server/spec/models/user_spec.rb b/main-server/spec/models/user_spec.rb new file mode 100644 index 0000000..d78dbb0 --- /dev/null +++ b/main-server/spec/models/user_spec.rb @@ -0,0 +1,66 @@ +require "rails_helper" + +RSpec.describe User, type: :model do + let(:valid_attributes) { { nickname: "player_one", password: "secret123" } } + + describe "validations" do + it "is valid with a nickname and password" do + expect(User.new(valid_attributes)).to be_valid + end + + it "requires a nickname" do + user = User.new(valid_attributes.merge(nickname: nil)) + expect(user).not_to be_valid + expect(user.errors[:nickname]).to be_present + end + + it "requires a password" do + user = User.new(nickname: "player_one", password: nil) + expect(user).not_to be_valid + expect(user.errors[:password]).to be_present + end + + it "rejects nicknames shorter than 3 characters" do + expect(User.new(valid_attributes.merge(nickname: "ab"))).not_to be_valid + end + + it "rejects nicknames longer than 24 characters" do + expect(User.new(valid_attributes.merge(nickname: "a" * 25))).not_to be_valid + end + + it "rejects passwords shorter than 6 characters" do + expect(User.new(valid_attributes.merge(password: "12345"))).not_to be_valid + end + + it "requires nicknames to be unique case-insensitively" do + User.create!(valid_attributes) + duplicate = User.new(valid_attributes.merge(nickname: "PLAYER_ONE")) + expect(duplicate).not_to be_valid + expect(duplicate.errors[:nickname]).to be_present + end + end + + describe "nickname normalization" do + it "strips surrounding whitespace" do + user = User.create!(valid_attributes.merge(nickname: " player_one ")) + expect(user.nickname).to eq("player_one") + end + end + + describe "password authentication" do + it "authenticates with the correct password" do + user = User.create!(valid_attributes) + expect(user.authenticate("secret123")).to eq(user) + end + + it "rejects a wrong password" do + user = User.create!(valid_attributes) + expect(user.authenticate("wrong")).to be_falsey + end + + it "does not require a password when updating other attributes" do + user = User.create!(valid_attributes) + expect(user.update(nickname: "new_nickname")).to be true + end + end +end diff --git a/main-server/spec/rails_helper.rb b/main-server/spec/rails_helper.rb new file mode 100644 index 0000000..ee4d56a --- /dev/null +++ b/main-server/spec/rails_helper.rb @@ -0,0 +1,78 @@ +# This file is copied to spec/ when you run 'rails generate rspec:install' +if ENV["COVERAGE"] + require "simplecov" + SimpleCov.start "rails" do + add_filter "/spec/" + end +end +require 'spec_helper' +ENV['RAILS_ENV'] ||= 'test' +require_relative '../config/environment' +# Prevent database truncation if the environment is production +abort("The Rails environment is running in production mode!") if Rails.env.production? +# Uncomment the line below in case you have `--require rails_helper` in the `.rspec` file +# that will avoid rails generators crashing because migrations haven't been run yet +# return unless Rails.env.test? +require 'rspec/rails' +# Add additional requires below this line. Rails is not loaded until this point! + +# Requires supporting ruby files with custom matchers and macros, etc, in +# spec/support/ and its subdirectories. Files matching `spec/**/*_spec.rb` are +# run as spec files by default. This means that files in spec/support that end +# in _spec.rb will both be required and run as specs, causing the specs to be +# run twice. It is recommended that you do not name files matching this glob to +# end with _spec.rb. You can configure this pattern with the --pattern +# option on the command line or in ~/.rspec, .rspec or `.rspec-local`. +# +# The following line is provided for convenience purposes. It has the downside +# of increasing the boot-up time by auto-requiring all files in the support +# directory. Alternatively, in the individual `*_spec.rb` files, manually +# require only the support files necessary. +# +# Rails.root.glob('spec/support/**/*.rb').sort_by(&:to_s).each { |f| require f } + +# Ensures that the test database schema matches the current schema file. +# If there are pending migrations it will invoke `db:test:prepare` to +# recreate the test database by loading the schema. +# If you are not using ActiveRecord, you can remove these lines. +begin + ActiveRecord::Migration.maintain_test_schema! +rescue ActiveRecord::PendingMigrationError => e + abort e.to_s.strip +end +RSpec.configure do |config| + # Remove this line if you're not using ActiveRecord or ActiveRecord fixtures + config.fixture_paths = [ + Rails.root.join('spec/fixtures') + ] + + # If you're not using ActiveRecord, or you'd prefer not to run each of your + # examples within a transaction, remove the following line or assign false + # instead of true. + config.use_transactional_fixtures = true + + # You can uncomment this line to turn off ActiveRecord support entirely. + # config.use_active_record = false + + # RSpec Rails uses metadata to mix in different behaviours to your tests, + # for example enabling you to call `get` and `post` in request specs. e.g.: + # + # RSpec.describe UsersController, type: :request do + # # ... + # end + # + # The different available types are documented in the features, such as in + # https://rspec.info/features/8-0/rspec-rails + # + # You can also infer these behaviours automatically by location, e.g. + # /spec/models would pull in the same behaviour as `type: :model` but this + # behaviour is considered legacy and will be removed in a future version. + # + # To enable this behaviour uncomment the line below. + # config.infer_spec_type_from_file_location! + + # Filter lines from Rails gems in backtraces. + config.filter_rails_from_backtrace! + # arbitrary gems may also be filtered via: + # config.filter_gems_from_backtrace("gem name") +end diff --git a/main-server/spec/services/jwt_service_spec.rb b/main-server/spec/services/jwt_service_spec.rb new file mode 100644 index 0000000..04810cd --- /dev/null +++ b/main-server/spec/services/jwt_service_spec.rb @@ -0,0 +1,50 @@ +require "rails_helper" + +RSpec.describe JwtService do + describe ".encode" do + it "returns a JWT string" do + token = described_class.encode(user_id: 1) + expect(token).to be_a(String) + expect(token.split(".").size).to eq(3) + end + + it "sets a default expiration about 7 days in the future" do + token = described_class.encode(user_id: 1) + payload = JWT.decode(token, described_class::SECRET_KEY, true, algorithm: described_class::ALGORITHM).first + expect(payload["exp"]).to be_within(60).of(7.days.from_now.to_i) + end + + it "keeps a custom expiration if provided" do + custom_exp = 1.hour.from_now.to_i + token = described_class.encode(user_id: 1, exp: custom_exp) + payload = JWT.decode(token, described_class::SECRET_KEY, true, algorithm: described_class::ALGORITHM).first + expect(payload["exp"]).to eq(custom_exp) + end + end + + describe ".decode" do + it "round-trips the user_id" do + token = described_class.encode(user_id: 42) + expect(described_class.decode(token)[:user_id]).to eq(42) + end + + it "returns nil for a tampered token" do + token = described_class.encode(user_id: 42) + expect(described_class.decode(token + "x")).to be_nil + end + + it "returns nil for a token signed with a different secret" do + token = JWT.encode({ user_id: 42 }, "wrong-secret", "HS256") + expect(described_class.decode(token)).to be_nil + end + + it "returns nil for an expired token" do + token = described_class.encode(user_id: 42, exp: 1.minute.ago.to_i) + expect(described_class.decode(token)).to be_nil + end + + it "returns nil for garbage input" do + expect(described_class.decode("not-a-token")).to be_nil + end + end +end diff --git a/main-server/spec/spec_helper.rb b/main-server/spec/spec_helper.rb new file mode 100644 index 0000000..327b58e --- /dev/null +++ b/main-server/spec/spec_helper.rb @@ -0,0 +1,94 @@ +# This file was generated by the `rails generate rspec:install` command. Conventionally, all +# specs live under a `spec` directory, which RSpec adds to the `$LOAD_PATH`. +# The generated `.rspec` file contains `--require spec_helper` which will cause +# this file to always be loaded, without a need to explicitly require it in any +# files. +# +# Given that it is always loaded, you are encouraged to keep this file as +# light-weight as possible. Requiring heavyweight dependencies from this file +# will add to the boot time of your test suite on EVERY test run, even for an +# individual file that may not need all of that loaded. Instead, consider making +# a separate helper file that requires the additional dependencies and performs +# the additional setup, and require it from the spec files that actually need +# it. +# +# See https://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration +RSpec.configure do |config| + # rspec-expectations config goes here. You can use an alternate + # assertion/expectation library such as wrong or the stdlib/minitest + # assertions if you prefer. + config.expect_with :rspec do |expectations| + # This option will default to `true` in RSpec 4. It makes the `description` + # and `failure_message` of custom matchers include text for helper methods + # defined using `chain`, e.g.: + # be_bigger_than(2).and_smaller_than(4).description + # # => "be bigger than 2 and smaller than 4" + # ...rather than: + # # => "be bigger than 2" + expectations.include_chain_clauses_in_custom_matcher_descriptions = true + end + + # rspec-mocks config goes here. You can use an alternate test double + # library (such as bogus or mocha) by changing the `mock_with` option here. + config.mock_with :rspec do |mocks| + # Prevents you from mocking or stubbing a method that does not exist on + # a real object. This is generally recommended, and will default to + # `true` in RSpec 4. + mocks.verify_partial_doubles = true + end + + # This option will default to `:apply_to_host_groups` in RSpec 4 (and will + # have no way to turn it off -- the option exists only for backwards + # compatibility in RSpec 3). It causes shared context metadata to be + # inherited by the metadata hash of host groups and examples, rather than + # triggering implicit auto-inclusion in groups with matching metadata. + config.shared_context_metadata_behavior = :apply_to_host_groups + +# The settings below are suggested to provide a good initial experience +# with RSpec, but feel free to customize to your heart's content. +=begin + # This allows you to limit a spec run to individual examples or groups + # you care about by tagging them with `:focus` metadata. When nothing + # is tagged with `:focus`, all examples get run. RSpec also provides + # aliases for `it`, `describe`, and `context` that include `:focus` + # metadata: `fit`, `fdescribe` and `fcontext`, respectively. + config.filter_run_when_matching :focus + + # Allows RSpec to persist some state between runs in order to support + # the `--only-failures` and `--next-failure` CLI options. We recommend + # you configure your source control system to ignore this file. + config.example_status_persistence_file_path = "spec/examples.txt" + + # Limits the available syntax to the non-monkey patched syntax that is + # recommended. For more details, see: + # https://rspec.info/features/3-12/rspec-core/configuration/zero-monkey-patching-mode/ + config.disable_monkey_patching! + + # Many RSpec users commonly either run the entire suite or an individual + # file, and it's useful to allow more verbose output when running an + # individual spec file. + if config.files_to_run.one? + # Use the documentation formatter for detailed output, + # unless a formatter has already been configured + # (e.g. via a command-line flag). + config.default_formatter = "doc" + end + + # Print the 10 slowest examples and example groups at the + # end of the spec run, to help surface which specs are running + # particularly slow. + config.profile_examples = 10 + + # Run specs in random order to surface order dependencies. If you find an + # order dependency and want to debug it, you can fix the order by providing + # the seed, which is printed after each run. + # --seed 1234 + config.order = :random + + # Seed global randomization in this process using the `--seed` CLI option. + # Setting this allows you to use `--seed` to deterministically reproduce + # test failures related to randomization by passing the same `--seed` value + # as the one that triggered the failure. + Kernel.srand config.seed +=end +end