Merge branch 'main' into env-example-updates

Author: grega

.github/pull_request_template.md

@@ -0,0 +1,17 @@
+## Status
+
+- Closes _add issue numbers or delete_
+- Related to _add issue numbers or delete_
+
+## Points for consideration:
+
+- Security
+- Performance
+
+## What's changed?
+
+_Description of what's been done - bullets are often best_
+
+## Steps to perform after deploying to production
+
+_If the production environment requires any extra work after this PR has been deployed detail it here. This could be running a Rake task, a migration, or upgrading a Gem. That kind of thing._

Dockerfile

@@ -3,7 +3,7 @@ RUN gem install bundler \
   && apt-get update \
   && apt-get upgrade --yes \
   && apt-get install --yes --no-install-recommends \
-  libpq5 libxml2 libxslt1.1 \
+  libpq5 libxml2 libxslt1.1 libvips \
   curl gnupg graphviz nodejs \
   && echo "deb http://apt.postgresql.org/pub/repos/apt bullseye-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
   && curl -sL https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - \

app/controllers/admin/projects_controller.rb

@@ -17,7 +17,9 @@ def destroy_image
     private
 
     def set_host_for_local_storage
-      ActiveStorage::Current.host = request.base_url if Rails.application.config.active_storage.service == :local
+      return unless Rails.application.config.active_storage.service == :local
+
+      ActiveStorage::Current.url_options = { host: request.base_url }
     end
   end
 end

app/controllers/admin/schools_controller.rb

@@ -38,5 +38,13 @@ def reject_school
 
       redirect_to admin_school_path(id: school_id)
     end
+
+    def default_sorting_attribute
+      :created_at
+    end
+
+    def default_sorting_direction
+      :desc
+    end
   end
 end

app/controllers/api/teacher_invitations_controller.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Api
+  class TeacherInvitationsController < ApiController
+    rescue_from ActiveSupport::MessageVerifier::InvalidSignature, with: -> { denied }
+
+    before_action :authorize_user
+    before_action :load_invitation
+    before_action :ensure_invitation_email_matches_user_email
+
+    def show
+      render :show, formats: [:json], status: :ok
+    end
+
+    def accept
+      role = Role.teacher.build(user_id: current_user.id, school: @invitation.school)
+      if role.valid?
+        role.save
+        @invitation.update!(accepted_at: Time.current) if @invitation.accepted_at.blank?
+        head :ok
+      else
+        render json: { error: role.errors }, status: :unprocessable_entity
+      end
+    end
+
+    private
+
+    def load_invitation
+      @invitation = TeacherInvitation.find_by_token_for!(:teacher_invitation, params[:token])
+    end
+
+    def ensure_invitation_email_matches_user_email
+      return if @invitation.email_address == current_user.email
+
+      render json: { error: 'Invitation email does not match user email' }, status: :forbidden
+    end
+  end
+end

app/dashboards/school_dashboard.rb

@@ -38,6 +38,7 @@ class SchoolDashboard < Administrate::BaseDashboard
     name
     reference
     country_code
+    created_at
     verified_at
     rejected_at
   ].freeze

app/models/invitation.rb renamed to app/models/teacher_invitation.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
-class Invitation < ApplicationRecord
+class TeacherInvitation < ApplicationRecord
+  delegate :name, to: :school, prefix: true
+
   belongs_to :school
   validates :email_address,
             format: { with: EmailValidator.regexp, message: I18n.t('validations.invitation.email_address') }

app/views/api/teacher_invitations/show.json.jbuilder

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+json.call(
+  @invitation,
+  :school_name
+)

config/routes.rb

@@ -53,6 +53,10 @@
     resources :lessons, only: %i[index create show update destroy] do
       post :copy, on: :member, to: 'lessons#create_copy'
     end
+
+    resources :teacher_invitations, param: :token, only: :show do
+      put :accept, on: :member
+    end
   end
 
   resource :github_webhooks, only: :create, defaults: { formats: :json }

db/migrate/20240621082741_add_accepted_at_to_invitation.rb

@@ -0,0 +1,5 @@
+class AddAcceptedAtToInvitation < ActiveRecord::Migration[7.1]
+  def change
+    add_column :invitations, :accepted_at, :datetime
+  end
+end

db/migrate/20240624122250_rename_invitations_to_teacher_invitations.rb

@@ -0,0 +1,5 @@
+class RenameInvitationsToTeacherInvitations < ActiveRecord::Migration[7.1]
+  def change
+    rename_table :invitations, :teacher_invitations
+  end
+end

db/schema.rb

@@ -17,7 +17,7 @@ def call(school:, school_teacher_params:, token:)
 
       def invite_teacher(school, school_teacher_params, _token)
         email_address = school_teacher_params.fetch(:email_address)
-        Invitation.create!(school:, email_address:)
+        TeacherInvitation.create!(school:, email_address:)
       end
     end
   end

lib/concepts/school_teacher/invite.rb

@@ -11,7 +11,7 @@ module ClassroomManagementHelper
   def create_school(creator_id, school_id = nil)
     School.find_or_create_by!(creator_id:, id: school_id) do |school|
       Rails.logger.info 'Seeding a school...'
-      school.name = 'School Name'
+      school.name = 'Test School'
       school.website = 'http://example.com'
       school.address_line_1 = 'School Address'
       school.municipality = 'City'
@@ -31,7 +31,7 @@ def verify_school(school)
   def create_school_class(teacher_id, school)
     SchoolClass.find_or_create_by!(teacher_id:, school:) do |school_class|
       Rails.logger.info 'Seeding a class...'
-      school_class.name = 'De§ult Class Name'
+      school_class.name = 'Test Class'
       school_class.teacher_id = teacher_id
       school_class.school = school
     end
@@ -51,7 +51,7 @@ def create_lessons(user_id, school, school_class, visibility = 'public')
         lesson.user_id = user_id
         lesson.school = school
         lesson.school_class = school_class
-        lesson.name = "Lesson #{i + 1}"
+        lesson.name = "Test Lesson #{i + 1}"
         lesson.description = "This is lesson #{i + 1}"
         lesson.visibility = visibility
       end
@@ -62,7 +62,7 @@ def create_lessons(user_id, school, school_class, visibility = 'public')
   def create_project(user_id, school, lesson)
     Project.find_or_create_by!(user_id:, school:, lesson:) do |project|
       Rails.logger.info "Seeding a project for #{lesson.name}..."
-      project.name = 'Default Project Name'
+      project.name = "Test Project for #{lesson.name}"
       project.user_id = user_id
       project.school = school
       project.lesson = lesson

lib/tasks/classroom_management_helper.rb

@@ -16,8 +16,8 @@
     expect(response.success?).to be(true)
   end
 
-  it 'creates an Invitation' do
-    expect { described_class.call(school:, school_teacher_params:, token:) }.to change(Invitation, :count)
+  it 'creates a TeacherInvitation' do
+    expect { described_class.call(school:, school_teacher_params:, token:) }.to change(TeacherInvitation, :count)
   end
 
   context 'when creation fails' do

spec/concepts/school_teacher/invite_spec.rb

@@ -11,4 +11,8 @@
     creator_agree_authority { true }
     creator_agree_terms_and_conditions { true }
   end
+
+  factory :verified_school, parent: :school do
+    verified_at { Time.current }
+  end
 end

spec/factories/school.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 FactoryBot.define do
-  factory :invitation do
+  factory :teacher_invitation do
     email_address { '[email protected]' }
-    school factory: :school, verified_at: Time.zone.now
+    school factory: :verified_school
   end
 end