From c731e15365150e7f6db75edc5fffc91787cac602 Mon Sep 17 00:00:00 2001 From: Leo Kacenjar Date: Mon, 28 Jul 2025 07:56:15 -0600 Subject: [PATCH 1/4] Asap 204 change all file handling to requests (#239) * Use requests library for both file downloads. Add errors to logs as well as API response. * Locally mount code for inference container. * Add some tests for file related issues. * Install local module during github setup. --- .github/workflows/python_components.yml | 1 + docker-compose.yml | 2 + python_components/ci/requirements.txt | 18 ++-- python_components/ci/scripts/entrypoint.sh | 1 + .../document_inference/helpers.py | 16 +++- .../document_inference/lambda_function.py | 1 + .../tests/test_file_downloads.py | 89 +++++++++++++++++++ .../evaluation/evaluation/utility/document.py | 17 +++- .../evaluation/lambda_function.py | 1 + 9 files changed, 134 insertions(+), 12 deletions(-) create mode 100644 python_components/document_inference/tests/test_file_downloads.py diff --git a/.github/workflows/python_components.yml b/.github/workflows/python_components.yml index b97ba750..da4becc1 100644 --- a/.github/workflows/python_components.yml +++ b/.github/workflows/python_components.yml @@ -26,6 +26,7 @@ jobs: python -m pip install --upgrade pip if [ -f ./python_components/ci/requirements.txt ]; then pip install -r ./python_components/ci/requirements.txt; fi pip install python_components/evaluation + pip install python_components/document_inference python -m spacy download en_core_web_sm - name: Run Linting run: | diff --git a/docker-compose.yml b/docker-compose.yml index b6af5838..438d54fa 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -38,6 +38,8 @@ services: - "9002:8080" environment: - ASAP_LOCAL_MODE=True + volumes: + - ./python_components/document_inference:/var/task lambda_evaluation: container_name: lambda_evaluation build: diff --git a/python_components/ci/requirements.txt b/python_components/ci/requirements.txt index 49bc2a8e..198e37d8 100644 --- a/python_components/ci/requirements.txt +++ b/python_components/ci/requirements.txt @@ -2,23 +2,25 @@ backports.tarfile==1.2.0 beautifulsoup4==4.13.3 black==25.1.0 boto3==1.38.30 -deepeval @ git+https://github.com/codeforamerica/deepeval.git@fix/support-read-only-file-systems +deepeval==3.1.4 flake8==7.1.2 google-api-python-client==2.171.0 google-auth-oauthlib==1.2.2 -importlib-metadata==8.0.0 +inflect==7.3.1 isort==6.0.1 +jaraco-functools==4.2.1 jaraco.collections==5.1.0 -requests-aws4auth==1.3.1 +llm==0.26 pandas==2.2.3 pip-chill==1.0.3 -PyMuPDF==1.25.5 -pytest==8.3.5 -pydantic==2.11.5 +pymupdf==1.25.5 +pypdf==5.8.0 +pysocks==1.7.1 +pytest-httpserver==1.1.3 +requests-aws4auth==1.3.1 scikit-learn==1.6.1 selenium==4.34.2 spacy==3.8.7 tldextract==5.1.3 tomli==2.0.1 -tqdm==4.67.1 -xgboost==2.1.4 +xgboost==2.1.4 \ No newline at end of file diff --git a/python_components/ci/scripts/entrypoint.sh b/python_components/ci/scripts/entrypoint.sh index 73624f00..f4ff6a3e 100755 --- a/python_components/ci/scripts/entrypoint.sh +++ b/python_components/ci/scripts/entrypoint.sh @@ -3,6 +3,7 @@ set -e # Install any local packages. pip install python_components/evaluation +pip install python_components/document_inference # Execute the main command exec "$@" \ No newline at end of file diff --git a/python_components/document_inference/document_inference/helpers.py b/python_components/document_inference/document_inference/helpers.py index 548e28b1..5fc15f02 100644 --- a/python_components/document_inference/document_inference/helpers.py +++ b/python_components/document_inference/document_inference/helpers.py @@ -1,7 +1,7 @@ import json import logging import os -import urllib +import shutil import boto3 import fitz @@ -49,7 +49,19 @@ def get_secret(secret_name: str, local_mode: bool) -> str: def get_file(url: str, output_path: str) -> str: file_name = os.path.basename(url) local_path = f"{output_path}/{file_name}" - urllib.request.urlretrieve(url, local_path) + headers = { + "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", + "Accept": "application/pdf,application/octet-stream,*/*", + "Accept-Language": "en-US,en;q=0.9", + "Accept-Encoding": "gzip, deflate", + "DNT": "1", + "Connection": "keep-alive", + "Upgrade-Insecure-Requests": "1", + } + with requests.get(url, headers=headers, stream=True) as response: + response.raise_for_status() + with open(f"{output_path}/{file_name}", "wb") as file: + shutil.copyfileobj(response.raw, file) return local_path diff --git a/python_components/document_inference/lambda_function.py b/python_components/document_inference/lambda_function.py index 2affcfb0..ef097be3 100644 --- a/python_components/document_inference/lambda_function.py +++ b/python_components/document_inference/lambda_function.py @@ -76,4 +76,5 @@ def handler(event, context): else: return {"statusCode": 200, "body": helpers.json_dump_collection()} except Exception as e: + helpers.logger.error(f"Error during execution: {e}") return {"statusCode": 500, "body": str(e)} diff --git a/python_components/document_inference/tests/test_file_downloads.py b/python_components/document_inference/tests/test_file_downloads.py new file mode 100644 index 00000000..252830de --- /dev/null +++ b/python_components/document_inference/tests/test_file_downloads.py @@ -0,0 +1,89 @@ +import os + +from document_inference.helpers import get_file +from pytest_httpserver import HTTPServer +from werkzeug import Request, Response + +""" +Tests to assert that our file getting method works with some known curveballs. +""" + + +def test_default_behavior(httpserver: HTTPServer): + def handler(request: Request): + return Response("Plain pdf content!", 200) + + httpserver.expect_request("/test.pdf").respond_with_handler(handler) + _remove_file_if_exists("/tmp/test.pdf") + get_file(httpserver.url_for("/test.pdf"), "/tmp") + _assert_file_contents("/tmp/test.pdf", "Plain pdf content!") + + +def test_content_disposition(httpserver: HTTPServer): + def handler(request: Request): + return Response( + "Great pdf content!", + 200, + headers={"Content-Disposition": "attachment", "filename": "mypdf.pdf"}, + ) + + httpserver.expect_request("/test.pdf").respond_with_handler(handler) + _remove_file_if_exists("/tmp/test.pdf") + get_file(httpserver.url_for("/test.pdf"), "/tmp") + _assert_file_contents("/tmp/test.pdf", "Great pdf content!") + + +def test_header_assertion(httpserver: HTTPServer): + def handler(request: Request): + try: + headers_as_text = str(request.headers) + assert ( + "python" not in headers_as_text + ), f"Headers contain 'python': {headers_as_text}" + assert ( + "urllib" not in headers_as_text + ), f"Headers contain 'urllib': {headers_as_text}" + assert ( + "Mozilla" in headers_as_text + ), f"Headers missing 'Mozilla': {headers_as_text}" + return Response("Great pdf validated by headers content!", 200) + except AssertionError as e: + print(f"Assertion failed: {e}") + return Response(f"Assertion failed: {e}", 500) + + httpserver.expect_request("/test.pdf").respond_with_handler(handler) + _remove_file_if_exists("/tmp/test.pdf") + get_file(httpserver.url_for("/test.pdf"), "/tmp") + _assert_file_contents("/tmp/test.pdf", "Great pdf validated by headers content!") + + +def test_308_redirect(httpserver: HTTPServer): + def redirect_handler(request: Request): + return Response( + "", + status=308, + headers={ + "Location": httpserver.url_for("/redirected.pdf"), + "Cache-Control": "max-age=3600", + }, + ) + + def final_handler(request: Request): + return Response("Great redirected content!", 200) + + httpserver.expect_request("/original.pdf").respond_with_handler(redirect_handler) + httpserver.expect_request("/redirected.pdf").respond_with_handler(final_handler) + _remove_file_if_exists("/tmp/original.pdf") + get_file(httpserver.url_for("/original.pdf"), "/tmp") + _assert_file_contents("/tmp/original.pdf", "Great redirected content!") + + +def _remove_file_if_exists(path: str): + if os.path.exists(path): + os.remove(path) + assert not os.path.exists(path) + + +def _assert_file_contents(path: str, contents: str): + with open(path, "r") as f: + assert f.read() == contents diff --git a/python_components/evaluation/evaluation/utility/document.py b/python_components/evaluation/evaluation/utility/document.py index cd4abb49..116795ae 100644 --- a/python_components/evaluation/evaluation/utility/document.py +++ b/python_components/evaluation/evaluation/utility/document.py @@ -1,6 +1,6 @@ import datetime import os -import urllib +import shutil from abc import ABC, abstractmethod from pathlib import Path from typing import Any, List @@ -8,6 +8,7 @@ import boto3 import fitz import pandas as pd +import requests from deepeval.models import DeepEvalBaseMLLM from deepeval.test_case import MLLMImage from evaluation.utility.helpers import logger @@ -81,7 +82,19 @@ def add_images_to_document( def get_file(url: str, output_path: str) -> str: file_name = os.path.basename(url) local_path = f"{output_path}/{file_name}" - urllib.request.urlretrieve(url, local_path) + headers = { + "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", + "Accept": "application/pdf,application/octet-stream,*/*", + "Accept-Language": "en-US,en;q=0.9", + "Accept-Encoding": "gzip, deflate", + "DNT": "1", + "Connection": "keep-alive", + "Upgrade-Insecure-Requests": "1", + } + with requests.get(url, headers=headers, stream=True) as response: + response.raise_for_status() + with open(f"{output_path}/{file_name}", "wb") as file: + shutil.copyfileobj(response.raw, file) return local_path diff --git a/python_components/evaluation/lambda_function.py b/python_components/evaluation/lambda_function.py index 7e0964cd..dcc791a2 100644 --- a/python_components/evaluation/lambda_function.py +++ b/python_components/evaluation/lambda_function.py @@ -107,4 +107,5 @@ def handler(event, context): output = str(e) if local_mode: output = traceback.format_exc() + utility.helpers.logger.error(f"Error during execution: {output}") return {"statusCode": 500, "body": output} From 0caf1681a0dd36dd7c46be6a5365569475766bd8 Mon Sep 17 00:00:00 2001 From: Leo Kacenjar Date: Mon, 28 Jul 2025 12:08:36 -0600 Subject: [PATCH 2/4] Asap 173 admin user UI (#222) * Devise working for login. * Migrate away from custom session table. * Use database for session management. * Bring back the tests and fix API authentication. * Get inline validation going. * Return success flash, update tests and lint away. * Remove obsolete test. * Fix accessibility scan. * Theme user profile form. Rename is_admin to is_site_admin. Add is_user_admin. * Start working on admin list. * Remove development creds and add to gitignore. * Fix linting. * Admin views for list, add and edit with validation. * Add admin fields and site picker. * Clean up admin table. * Block admin pages for non-admins. * Add a test. * Fix linting. * Fix broken tests. * Improve mobile experience. * Try braking up tests into two batches. * Make password labels and validation more clear. * Improve current password language. --- .github/workflows/ci.yml | 10 +- app/controllers/admin/users_controller.rb | 68 ++++++++++++++ app/controllers/concerns/access.rb | 14 ++- app/controllers/configurations_controller.rb | 2 +- app/controllers/sites_controller.rb | 2 +- .../users/registrations_controller.rb | 1 - .../controllers/modal_controller.js | 4 +- app/views/admin/users/edit.html.erb | 82 ++++++++++++++++ app/views/admin/users/index.html.erb | 41 ++++++++ app/views/admin/users/new.html.erb | 67 +++++++++++++ app/views/layouts/application.html.erb | 10 +- app/views/sites/index.html.erb | 4 +- app/views/users/registrations/edit.html.erb | 94 ++++++++++++------- app/views/users/sessions/new.html.erb | 4 +- config/locales/en.yml | 37 ++------ config/routes.rb | 4 +- .../20250711141619_change_admin_roles.rb | 8 ++ lib/tasks/users.rake | 3 +- spec/factories/users.rb | 4 +- spec/features/admin_spec.rb | 64 ++++++++++++- spec/features/site_spec.rb | 2 +- spec/requests/api/sites_spec.rb | 2 +- 22 files changed, 436 insertions(+), 91 deletions(-) create mode 100644 app/controllers/admin/users_controller.rb create mode 100644 app/views/admin/users/edit.html.erb create mode 100644 app/views/admin/users/index.html.erb create mode 100644 app/views/admin/users/new.html.erb create mode 100644 db/migrate/20250711141619_change_admin_roles.rb diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 95347033..c0872fcf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -52,11 +52,17 @@ jobs: bundle exec rails db:create bundle exec rails db:migrate - - name: Run tests + - name: Run Non-JS tests env: RAILS_ENV: test DATABASE_URL: postgres://postgres:postgres@localhost:5432/access_pdf_test - run: bundle exec rspec + run: bundle exec rspec spec/models spec/requests + + - name: Run JS tests + env: + RAILS_ENV: test + DATABASE_URL: postgres://postgres:postgres@localhost:5432/access_pdf_test + run: bundle exec rspec spec/features - name: Keep screenshots from failed system tests uses: actions/upload-artifact@v4 diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb new file mode 100644 index 00000000..33d10023 --- /dev/null +++ b/app/controllers/admin/users_controller.rb @@ -0,0 +1,68 @@ +class Admin::UsersController < ApplicationController + include Access + + before_action :ensure_user_user_admin + + before_action :set_user, only: [:new, :edit, :update] + before_action :site_list, only: [:new, :create, :edit, :update] + before_action :set_minimum_password_length, only: [:new, :edit, :update] + + def index + @users = User.all + end + + def new + render "/admin/users/new" + end + + def create + @user = User.new(user_params) + if @user.save + redirect_to admin_users_path, notice: "User added successfully" + else + render :new, status: 422 + end + end + + def edit + render "/admin/users/edit" + end + + def update + if params[:user][:password].blank? + params[:user].delete(:password) + params[:user].delete(:password_confirmation) + success = @user.update_without_password(user_params) + elsif @user.id == current_user.id + bypass_sign_in @user, scope: "user" + success = @user.update_with_password(user_params) + else + success = @user.update(user_params) + end + if success + redirect_to admin_users_path, notice: "User updated successfully" + else + render :edit, status: 422 + end + end + + private + + def site_list + @sites = Site.all.order(:location, :name).group_by(&:location).map do |location, sites| + [location, sites.map { |site| [site.name, site.id] }] + end + end + + def set_user + @user = params[:id].present? ? User.find(params[:id]) : User.new + end + + def user_params + params.require(:user).permit(:email, :password, :password_confirmation, :current_password, :is_site_admin, :is_user_admin, :site_id) + end + + def set_minimum_password_length + @minimum_password_length = User.password_length.min + end +end diff --git a/app/controllers/concerns/access.rb b/app/controllers/concerns/access.rb index 07554a99..cef179ea 100644 --- a/app/controllers/concerns/access.rb +++ b/app/controllers/concerns/access.rb @@ -1,18 +1,24 @@ module Access - def ensure_user_admin - unless current_user.is_admin? + def ensure_user_site_admin + unless current_user.is_site_admin? + redirect_to sites_path, alert: "You don't have permission to access that page." + end + end + + def ensure_user_user_admin + unless current_user.is_user_admin? redirect_to sites_path, alert: "You don't have permission to access that page." end end def ensure_user_site_access - if !current_user.is_admin? && (current_user.site.nil? || current_user.site.id != @site.id) + if !current_user.is_site_admin? && (current_user.site.nil? || current_user.site.id != @site.id) redirect_to sites_path, alert: "You don't have permission to access that site." end end def ensure_user_document_access - if !current_user.is_admin? && (current_user.site.nil? || current_user.site.documents.find(@document.id).nil?) + if !current_user.is_site_admin? && (current_user.site.nil? || current_user.site.documents.find(@document.id).nil?) redirect_to sites_path, alert: "You don't have permission to perform that action on document." end end diff --git a/app/controllers/configurations_controller.rb b/app/controllers/configurations_controller.rb index a516be67..bf13c4c5 100644 --- a/app/controllers/configurations_controller.rb +++ b/app/controllers/configurations_controller.rb @@ -1,7 +1,7 @@ class ConfigurationsController < AuthenticatedController include Access - before_action :ensure_user_admin + before_action :ensure_user_site_admin ASAP_API_USER = "/asap-pdf/production/RAILS_API_USER-20250613220933079900000001" ASAP_API_PASSWORD = "/asap-pdf/production/RAILS_API_PASSWORD-20250613220933080000000003" diff --git a/app/controllers/sites_controller.rb b/app/controllers/sites_controller.rb index 8aa19d16..fde11e78 100644 --- a/app/controllers/sites_controller.rb +++ b/app/controllers/sites_controller.rb @@ -6,7 +6,7 @@ class SitesController < AuthenticatedController before_action :ensure_user_site_access, only: [:insights, :show, :edit, :update, :destroy] def index - @sites = if current_user.is_admin? + @sites = if current_user.is_site_admin? Site.all else current_user.site.nil? ? [] : [current_user.site] diff --git a/app/controllers/users/registrations_controller.rb b/app/controllers/users/registrations_controller.rb index c266662e..b9e664fe 100644 --- a/app/controllers/users/registrations_controller.rb +++ b/app/controllers/users/registrations_controller.rb @@ -1,7 +1,6 @@ # frozen_string_literal: true class Users::RegistrationsController < Devise::RegistrationsController - layout "centered" # before_action :configure_sign_up_params, only: [:create] # before_action :configure_account_update_params, only: [:update] diff --git a/app/javascript/controllers/modal_controller.js b/app/javascript/controllers/modal_controller.js index 8304a8d3..37554b8f 100644 --- a/app/javascript/controllers/modal_controller.js +++ b/app/javascript/controllers/modal_controller.js @@ -5,7 +5,9 @@ export default class extends Controller { connect() { super.connect(); - this.wrapperTarget.addEventListener('close', this.onModalClose.bind(this)) + if (this.hasWrapperTarget) { + this.wrapperTarget.addEventListener('close', this.onModalClose.bind(this)) + } } submitAndClose(event) { diff --git a/app/views/admin/users/edit.html.erb b/app/views/admin/users/edit.html.erb new file mode 100644 index 00000000..607a53bb --- /dev/null +++ b/app/views/admin/users/edit.html.erb @@ -0,0 +1,82 @@ +
+
+

Edit <%= @user.email %>

+ + <%= form_with(model: [:admin, @user]) do |f| %> + +
+ <%= f.label :email, class: "label-text text-black mb-2 font-semibold" %> + <%= f.email_field :email, autofocus: true, autocomplete: "email", class: "input input-bordered w-full" + (@user.errors[:email].any? ? " input-error " : " border-black ") %> + <% if @user.errors[:email].any? %> +
+ <%= @user.errors.full_message(:email, @user.errors[:email].first) %> +
+ <% end %> +
+ + <% if @user.id == current_user.id %> +
+ <%= f.label :current_password, class: "label-text text-black mb-2 font-semibold" %> + <%= f.password_field :current_password, autocomplete: "current-password", class: "input input-bordered w-full" + (@user.errors[:current_password].any? ? " input-error " : " border-black ") %> + We need your current password to confirm any password changes. + <% if @user.errors[:current_password].any? %> +
+ <%= @user.errors.full_message(:current_password, @user.errors[:current_password].first) %> +
+ <% end %> +
+ <% end %> + +
+ <%= f.label :password, "New password", class: "label-text text-black mb-2 font-semibold" %> + <%= f.password_field :password, autocomplete: "new-password", class: "input input-bordered w-full" + (@user.errors[:password].any? ? " input-error " : " border-black ") %> + <% if @minimum_password_length %> + + <% if @minimum_password_length %><%= @minimum_password_length %> characters minimum.<% end %> Leave blank if you don't want to change it. + <% end %> + <% if @user.errors[:password].any? %> +
+ <%= @user.errors.full_message(:password, @user.errors[:password].first) %> +
+ <% end %> +
+ +
+ <%= f.label :password_confirmation, "New password confirmation", class: "label-text text-black mb-2 font-semibold" %> + <%= f.password_field :password_confirmation, autocomplete: "new-password", class: "input input-bordered w-full" + (@user.errors[:password_confirmation].any? ? " input-error " : " border-black ") %> + <% if @user.errors[:password_confirmation].any? %> +
+ <%= @user.errors.full_message(:password_confirmation, @user.errors[:password_confirmation].first) %> +
+ <% end %> +
+ +
+ <%= f.check_box :is_site_admin %> + <%= f.label :is_site_admin, class: "label-text text-black mb-2 font-semibold" %> +
User should be able to see and edit all sites and documents.
+
+ +
+ <%= f.check_box :is_user_admin %> + <%= f.label :is_user_admin, class: "label-text text-black mb-2 font-semibold" %> +
User should be able to edit other users and create admins.
+
+ +
+ <%= f.label :site_id, "Site", class: "label-text text-black mb-2 font-semibold" %> + <%= f.select :site_id, grouped_options_for_select(@sites, @user.site_id), + { include_blank: "None" }, + { class: "input input-bordered w-full select" } %> +
+ +
+ <%= button_tag type: "submit", class: "btn btn-primary text-white", id: "submit-user-form" do %> + + Update + <% end %> + <%= link_to "Back", :back %> +
+ <% end %> +
+
diff --git a/app/views/admin/users/index.html.erb b/app/views/admin/users/index.html.erb new file mode 100644 index 00000000..7cadcf62 --- /dev/null +++ b/app/views/admin/users/index.html.erb @@ -0,0 +1,41 @@ +
+
+
+
+
+

Manage Users

+ + + Add User + +
+
+
+ + + + + + + + + + + + <% @users.each do |user| %> + + + + + + + + <% end %> + +
EmailSiteSite AdminUser AdminActions
<%= user.email %><%= user.site.present? ? user.site.name : "None" %><%= user.is_site_admin? ? "Yes" : "No" %><%= user.is_user_admin? ? "Yes" : "No" %> + <%= link_to "Edit", edit_admin_user_path(user), class: "text-primary" %> +
+
+
+
+
\ No newline at end of file diff --git a/app/views/admin/users/new.html.erb b/app/views/admin/users/new.html.erb new file mode 100644 index 00000000..5bdec638 --- /dev/null +++ b/app/views/admin/users/new.html.erb @@ -0,0 +1,67 @@ +
+
+

Add New User

+ + <%= form_for(@user, url: admin_users_path) do |f| %> +
+ <%= f.label :email, class: "label-text text-black mb-2 font-semibold" %> + <%= f.email_field :email, autofocus: true, autocomplete: "email", class: "input input-bordered w-full" + (@user.errors[:email].any? ? " input-error " : " border-black ") %> + <% if @user.errors[:email].any? %> +
+ <%= @user.errors.full_message(:email, @user.errors[:email].first)%> +
+ <% end %> +
+ +
+ <%= f.label :password, class: "label-text text-black mb-2 font-semibold" %> + <%= f.password_field :password, autocomplete: "new-password", class: "input input-bordered w-full" + (@user.errors[:password].any? ? " input-error " : " border-black ") %> + <% if @minimum_password_length %> + <%= @minimum_password_length %> characters minimum. + <% end %> + <% if @user.errors[:password].any? %> +
+ <%= @user.errors.full_message(:password, @user.errors[:password].first)%> +
+ <% end %> +
+ +
+ <%= f.label :password_confirmation, class: "label-text text-black mb-2 font-semibold" %> + <%= f.password_field :password_confirmation, autocomplete: "new-password", class: "input input-bordered w-full" + (@user.errors[:password_confirmation].any? ? " input-error " : " border-black ") %> + <% if @user.errors[:password_confirmation].any? %> +
+ <%= @user.errors.full_message(:password_confirmation, @user.errors[:password_confirmation].first)%> +
+ <% end %> +
+ +
+ <%= f.check_box :is_site_admin %> + <%= f.label :is_site_admin, class: "label-text text-black mb-2 font-semibold" %> +
User should be able to see and edit all sites and documents.
+
+ +
+ <%= f.check_box :is_user_admin %> + <%= f.label :is_user_admin, class: "label-text text-black mb-2 font-semibold" %> +
User should be able to edit other users and create admins.
+
+ +
+ <%= f.label :site_id, "Site", class: "label-text text-black mb-2 font-semibold" %> + <%= f.select :site_id, grouped_options_for_select(@sites, @user.site_id), + { include_blank: "None" }, + { class: "input input-bordered w-full select" } %> +
+ +
+ <%= button_tag type: "submit", class: "btn btn-primary text-white", id: "submit-user-form" do %> + + Save + <% end %> + <%= link_to "Back", :back %> +
+ <% end %> +
+
\ No newline at end of file diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb index 1d01d144..26d65bdb 100644 --- a/app/views/layouts/application.html.erb +++ b/app/views/layouts/application.html.erb @@ -36,14 +36,22 @@ -<% if current_user.is_admin? %> +<% if current_user.is_site_admin? %>
diff --git a/app/views/users/registrations/edit.html.erb b/app/views/users/registrations/edit.html.erb index 54a7c4a9..10c720b4 100644 --- a/app/views/users/registrations/edit.html.erb +++ b/app/views/users/registrations/edit.html.erb @@ -1,43 +1,67 @@ -

Edit <%= resource_name.to_s.humanize %>

+
+
+

Edit <%= resource_name.to_s.humanize %>

-<%= form_for(resource, as: resource_name, url: registration_path(resource_name), html: { method: :put }) do |f| %> - <%= render "users/shared/error_messages", resource: resource %> + <%= form_for(resource, as: resource_name, url: registration_path(resource_name), html: { method: :put }) do |f| %> -
- <%= f.label :email %>
- <%= f.email_field :email, autofocus: true, autocomplete: "email" %> -
+
+ <%= f.label :email, class: "label-text text-black mb-2 font-semibold" %> + <%= f.email_field :email, autofocus: true, autocomplete: "email", class: "input input-bordered w-full" + (resource.errors[:email].any? ? " input-error " : " border-black ") %> + <% if resource.errors[:email].any? %> +
+ <%= resource.errors.full_message(:email, resource.errors[:email].first) %> +
+ <% end %> +
- <% if devise_mapping.confirmable? && resource.pending_reconfirmation? %> -
Currently waiting confirmation for: <%= resource.unconfirmed_email %>
- <% end %> + <% if devise_mapping.confirmable? && resource.pending_reconfirmation? %> +
Currently waiting confirmation for: <%= resource.unconfirmed_email %>
+ <% end %> -
- <%= f.label :password %> (leave blank if you don't want to change it)
- <%= f.password_field :password, autocomplete: "new-password" %> - <% if @minimum_password_length %> -
- <%= @minimum_password_length %> characters minimum - <% end %> -
+ <% if resource.id == current_user.id %> +
+ <%= f.label :current_password, class: "label-text text-black mb-2 font-semibold" %> + <%= f.password_field :current_password, autocomplete: "current-password", class: "input input-bordered w-full" + (resource.errors[:current_password].any? ? " input-error " : " border-black ") %> + We need your current password to confirm any password changes. + <% if resource.errors[:current_password].any? %> +
+ <%= resource.errors.full_message(:current_password, resource.errors[:current_password].first) %> +
+ <% end %> +
+ <% end %> -
- <%= f.label :password_confirmation %>
- <%= f.password_field :password_confirmation, autocomplete: "new-password" %> -
+
+ <%= f.label :password, "New password", class: "label-text text-black mb-2 font-semibold" %> + <%= f.password_field :password, autocomplete: "new-password", class: "input input-bordered w-full" + (resource.errors[:password].any? ? " input-error " : " border-black ") %> + <% if @minimum_password_length %> + + <% if @minimum_password_length %><%= @minimum_password_length %> characters minimum.<% end %> Leave blank if you don't want to change it. + <% end %> + <% if resource.errors[:password].any? %> +
+ <%= resource.errors.full_message(:password, resource.errors[:password].first) %> +
+ <% end %> +
-
- <%= f.label :current_password %> (we need your current password to confirm your changes)
- <%= f.password_field :current_password, autocomplete: "current-password" %> -
+
+ <%= f.label :password_confirmation, "Confirm new password", class: "label-text text-black mb-2 font-semibold" %> + <%= f.password_field :password_confirmation, autocomplete: "new-password", class: "input input-bordered w-full" + (resource.errors[:password_confirmation].any? ? " input-error " : " border-black ") %> + <% if resource.errors[:password_confirmation].any? %> +
+ <%= resource.errors.full_message(:password_confirmation, resource.errors[:password_confirmation].first) %> +
+ <% end %> +
-
- <%= f.submit "Update" %> +
+ <%= button_tag type: "submit", class: "btn btn-primary text-white", id: "submit-session-form" do %> + + Update + <% end %> + <%= link_to "Back", :back %> +
+ <% end %>
-<% end %> - -

Cancel my account

- -
Unhappy? <%= button_to "Cancel my account", registration_path(resource_name), data: { confirm: "Are you sure?", turbo_confirm: "Are you sure?" }, method: :delete %>
- -<%= link_to "Back", :back %> +
diff --git a/app/views/users/sessions/new.html.erb b/app/views/users/sessions/new.html.erb index bb6e1673..6cd48baa 100644 --- a/app/views/users/sessions/new.html.erb +++ b/app/views/users/sessions/new.html.erb @@ -8,7 +8,7 @@
<%= form_for(resource, as: resource_name, url: session_path(resource_name)) do |f| %>
- <%= f.label :email, class: "label label-text text-black" %> + <%= f.label :email, class: "label label-text text-black font-semibold" %> <%= f.email_field :email, autofocus: true, autocomplete: "email", class: "input input-bordered w-full " + (resource.errors[:base].any? ? " input-error " : " border-black ") %> <% if resource.errors[:base].any? %>
@@ -18,7 +18,7 @@
- <%= f.label :password, class: "label label-text text-black" %> + <%= f.label :password, class: "label label-text text-black font-semibold" %> <%= f.password_field :password, autocomplete: "current-password", class: "input input-bordered w-full " + (resource.errors[:base].any? ? " input-error " : " border-black ") %> <% if resource.errors[:base].any? %>
diff --git a/config/locales/en.yml b/config/locales/en.yml index 6c349ae5..2383d5dc 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -1,31 +1,8 @@ -# Files in the config/locales directory are used for internationalization and -# are automatically loaded by Rails. If you want to use locales other than -# English, add the necessary files in this directory. -# -# To use the locales, use `I18n.t`: -# -# I18n.t "hello" -# -# In views, this is aliased to just `t`: -# -# <%= t("hello") %> -# -# To use a different locale, set it with `I18n.locale`: -# -# I18n.locale = :es -# -# This would use the information in config/locales/es.yml. -# -# To learn more about the API, please read the Rails Internationalization guide -# at https://guides.rubyonrails.org/i18n.html. -# -# Be aware that YAML interprets the following case-insensitive strings as -# booleans: `true`, `false`, `on`, `off`, `yes`, `no`. Therefore, these strings -# must be quoted to be interpreted as strings. For example: -# -# en: -# "yes": yup -# enabled: "ON" - en: - hello: "Hello world" + activerecord: + errors: + models: + user: + attributes: + password_confirmation: + confirmation: "must match \"New password\"" \ No newline at end of file diff --git a/config/routes.rb b/config/routes.rb index d414d9b2..37605b53 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -5,7 +5,9 @@ registrations: "users/registrations" } # Administrative user paths. - resources :users, only: [:index, :new, :create, :edit, :update], controller: "users/admin" + namespace :admin do + resources :users, only: [:index, :new, :create, :edit, :update, :show] + end get "up" => "rails/health#show", :as => :rails_health_check diff --git a/db/migrate/20250711141619_change_admin_roles.rb b/db/migrate/20250711141619_change_admin_roles.rb new file mode 100644 index 00000000..1228bf8a --- /dev/null +++ b/db/migrate/20250711141619_change_admin_roles.rb @@ -0,0 +1,8 @@ +class ChangeAdminRoles < ActiveRecord::Migration[8.0] + def change + change_table :user do |t| + rename_column :users, :is_admin, :is_site_admin + add_column :users, :is_user_admin, :boolean + end + end +end diff --git a/lib/tasks/users.rake b/lib/tasks/users.rake index caa3c001..e0f89e29 100644 --- a/lib/tasks/users.rake +++ b/lib/tasks/users.rake @@ -3,7 +3,8 @@ namespace :users do task :create_admin, [:password] => :environment do |t, args| User.find_or_create_by!(email: "admin@codeforamerica.org") do |user| user.password = args.password - user.is_admin = true + user.is_site_admin = true + user.is_user_admin = true puts "Created test user: admin@codeforamerica.org / #{args.password}" end end diff --git a/spec/factories/users.rb b/spec/factories/users.rb index bebaab88..41370349 100644 --- a/spec/factories/users.rb +++ b/spec/factories/users.rb @@ -2,8 +2,8 @@ factory :user do email { "user#{rand(1000)}@example.com" } password { "password" } - trait :admin do - is_admin { true } + trait :site_admin do + is_site_admin { true } end end end diff --git a/spec/features/admin_spec.rb b/spec/features/admin_spec.rb index 9cce7477..e02605ab 100644 --- a/spec/features/admin_spec.rb +++ b/spec/features/admin_spec.rb @@ -1,12 +1,13 @@ require "rails_helper" -describe "admins can see admin pages", type: :feature do +describe "admins can see admin pages", js: true, type: :feature do before :each do + Site.create(location: "Colorado", name: "City and County of Denver", primary_url: "https://www.denver.gov") @current_user = User.create(email: "user@example.com", password: "password") login_user(@current_user) end - it "admins can create and see sites" do + it "admins can view AI configuration" do visit "/" within("#header") do user_menu = find("[data-action='click->dropdown#toggle']") @@ -17,9 +18,9 @@ expect(page).to have_no_content "AI Settings" end visit "/configuration/edit" - expect(current_path).to eq("/sites") + expect(page).to have_current_path("/sites") expect(page).to have_content "You don't have permission to access that page." - @current_user.is_admin = true + @current_user.is_site_admin = true @current_user.save visit "/" within("#header") do @@ -27,7 +28,60 @@ user_menu.click click_link("AI Settings") end - expect(current_path).to eq("/configuration/edit") + expect(page).to have_current_path("/configuration/edit") expect(page).to have_content "AI Configuration Settings" end + + it "admins can view user admin pages" do + visit "/" + within("#header") do + user_menu = find("[data-action='click->dropdown#toggle']") + user_menu.click + end + within("div[data-dropdown-target='menu']") do + expect(page).to have_content "My Sites" + expect(page).to have_no_content "Admin Users" + end + visit "/admin/users" + expect(page).to have_current_path("/sites") + expect(page).to have_content "You don't have permission to access that page." + visit "/admin/users/new" + expect(current_path).to eq("/sites") + expect(page).to have_content "You don't have permission to access that page." + visit "/admin/users/1/edit" + expect(page).to have_current_path("/sites") + expect(page).to have_content "You don't have permission to access that page." + @current_user.is_user_admin = true + @current_user.save + visit "/admin/users" + expect(page).to have_content "Manage Users" + expect(page).to have_content "user@example.com None No Yes Edit" + within("#user-list") do + click_link "Add User" + end + expect(page).to have_current_path("/admin/users/new") + fill_in "Email", with: "user@example.com" + fill_in "Password", with: "123459!" + fill_in "Password confirmation", with: "123459!" + click_button "Save" + expect(page).to have_current_path("/admin/users/new") + expect(page).to have_content "Email has already been taken" + fill_in "Email", with: "bob@example.com" + fill_in "Password", with: "123459!" + fill_in "Password confirmation", with: "123459!" + check "Is user admin" + select "City and County of Denver", from: "Site" + click_button "Save" + expect(page).to have_current_path("/admin/users") + expect(page).to have_content "bob@example.com City and County of Denver No Yes Edit" + within("#user-list tr:nth-child(2)") do + click_link("Edit") + end + expect(page).to have_content("Edit bob@example.com") + select "None", from: "Site" + check "Is site admin" + click_button "Update" + expect(page).to have_current_path("/admin/users") + expect(page).to have_content "bob@example.com None Yes Yes Edit" + end end diff --git a/spec/features/site_spec.rb b/spec/features/site_spec.rb index f9f52d38..423ec689 100644 --- a/spec/features/site_spec.rb +++ b/spec/features/site_spec.rb @@ -9,7 +9,7 @@ it "admins can create and see sites" do visit "/" expect(page).to have_no_content("Add New Site") - @current_user.is_admin = true + @current_user.is_site_admin = true @current_user.save visit "/" click_button "Add Site", id: "add-site-modal" diff --git a/spec/requests/api/sites_spec.rb b/spec/requests/api/sites_spec.rb index 0d53a280..06e6deb8 100644 --- a/spec/requests/api/sites_spec.rb +++ b/spec/requests/api/sites_spec.rb @@ -13,7 +13,7 @@ def auth_headers {"HTTP_AUTHORIZATION" => encoded_credentials} end - let!(:user) { create(:user, :admin) } + let!(:user) { create(:user, :site_admin) } describe "GET /sites" do let!(:sites) { create_list(:site, 3) } From 4de6d89ab2845068c568a822d3e7e6b040944a46 Mon Sep 17 00:00:00 2001 From: Leo Kacenjar Date: Tue, 29 Jul 2025 10:06:17 -0500 Subject: [PATCH 3/4] Asap 198 setup emails and password reset (#242) * Devise working for login. * Migrate away from custom session table. * Use database for session management. * Bring back the tests and fix API authentication. * Get inline validation going. * Return success flash, update tests and lint away. * Remove obsolete test. * Fix accessibility scan. * Theme user profile form. Rename is_admin to is_site_admin. Add is_user_admin. * Start working on admin list. * Remove development creds and add to gitignore. * Fix linting. * Admin views for list, add and edit with validation. * Add admin fields and site picker. * Clean up admin table. * Block admin pages for non-admins. * Add a test. * Fix linting. * Fix broken tests. * Improve mobile experience. * Try braking up tests into two batches. * Get ready to send emails with AWS SES. Theme and expose password reset form. Generally cleanup. * Mostly functional invitation process. * Make password labels and validation more clear. * Handle SMTP exceptions gracefully and set display name in mailer. * Improve current password language. * Add configuration for SES and related secrets. * Add production SMTP configuration. * Fix linting issues. * Fix linting again. * Make user forms a little better on normal sized screens. * Revert to using sites_path. * Add some mail related tests. * Fix linting issues. * Implement Em's great feedback. * Make password reset links consistent. * Tempoarily hide password reset link. * Tempoarily comment out login test. --- Gemfile | 2 + Gemfile.lock | 8 ++ app/controllers/admin/users_controller.rb | 31 +++-- app/controllers/concerns/access.rb | 10 +- app/controllers/users/passwords_controller.rb | 40 ++----- .../users/registrations_controller.rb | 63 +--------- app/mailers/application_mailer.rb | 11 +- app/models/user.rb | 13 +- app/views/admin/users/edit.html.erb | 4 +- app/views/admin/users/new.html.erb | 10 +- app/views/layouts/application.html.erb | 2 +- app/views/layouts/mailer.html.erb | 66 ++++++++++- .../mailer/new_account_instructions.html.erb | 7 ++ .../reset_password_instructions.html.erb | 2 +- app/views/users/passwords/edit.html.erb | 62 ++++++---- app/views/users/passwords/new.html.erb | 38 +++--- app/views/users/registrations/edit.html.erb | 2 +- app/views/users/sessions/new.html.erb | 7 +- config/environments/production.rb | 13 +- config/initializers/devise.rb | 4 +- .../20250716155512_add_devise_trackable.rb | 11 ++ .../20250716163605_add_invitation_flag.rb | 7 ++ spec/features/admin_spec.rb | 15 +++ spec/features/login_spec.rb | 15 +++ spec/helpers/mail.rb | 14 +++ spec/rails_helper.rb | 1 + spec/spec_helper.rb | 1 + terraform/.terraform.lock.hcl | 58 +++++++++ terraform/main.tf | 26 +++- terraform/modules/ecs/main.tf | 16 ++- terraform/modules/ecs/variables.tf | 15 +++ terraform/modules/ses/main.tf | 12 ++ terraform/modules/ses/variables.tf | 14 +++ terraform/variables.tf | 111 ------------------ 34 files changed, 434 insertions(+), 277 deletions(-) create mode 100644 app/views/users/mailer/new_account_instructions.html.erb create mode 100644 db/migrate/20250716155512_add_devise_trackable.rb create mode 100644 db/migrate/20250716163605_add_invitation_flag.rb create mode 100644 spec/helpers/mail.rb create mode 100644 terraform/modules/ses/main.tf create mode 100644 terraform/modules/ses/variables.tf diff --git a/Gemfile b/Gemfile index 451fcc96..800e5419 100644 --- a/Gemfile +++ b/Gemfile @@ -54,6 +54,7 @@ group :test do gem "rails-controller-testing" gem "factory_bot_rails", "~> 6.5" gem "capybara" + gem "capybara-email" gem "webdrivers" end @@ -62,6 +63,7 @@ gem "aws-sdk-s3", "~> 1.194" # For S3 versioning support gem "aws-sdk-secretsmanager" gem "aws-sdk-lambda" gem "aws-sigv4" +gem "aws-sdk-ses" # API and Documentation gem "grape", "~> 2.4" diff --git a/Gemfile.lock b/Gemfile.lock index 69f4fc7b..588c995f 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -103,6 +103,9 @@ GEM aws-sdk-secretsmanager (1.117.0) aws-sdk-core (~> 3, >= 3.227.0) aws-sigv4 (~> 1.5) + aws-sdk-ses (1.85.0) + aws-sdk-core (~> 3, >= 3.225.0) + aws-sigv4 (~> 1.5) aws-sigv4 (1.12.1) aws-eventstream (~> 1, >= 1.0.2) base64 (0.3.0) @@ -131,6 +134,9 @@ GEM rack-test (>= 0.6.3) regexp_parser (>= 1.5, < 3.0) xpath (~> 3.2) + capybara-email (3.0.2) + capybara (>= 2.4, < 4.0) + mail cgi (0.5.0) chartkick (5.2.0) childprocess (5.1.0) @@ -518,6 +524,7 @@ DEPENDENCIES aws-sdk-lambda aws-sdk-s3 (~> 1.194) aws-sdk-secretsmanager + aws-sdk-ses aws-sigv4 bcrypt (~> 3.1) better_errors (~> 2.10) @@ -525,6 +532,7 @@ DEPENDENCIES brakeman (~> 7.1) bundler-audit (~> 0.9.2) capybara + capybara-email chartkick cssbundling-rails (~> 1.4.3) csv diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb index 33d10023..929c7b6f 100644 --- a/app/controllers/admin/users_controller.rb +++ b/app/controllers/admin/users_controller.rb @@ -1,9 +1,9 @@ class Admin::UsersController < ApplicationController include Access - before_action :ensure_user_user_admin + before_action :ensure_user_is_user_admin - before_action :set_user, only: [:new, :edit, :update] + before_action :set_user, only: [:edit, :update] before_action :site_list, only: [:new, :create, :edit, :update] before_action :set_minimum_password_length, only: [:new, :edit, :update] @@ -12,30 +12,45 @@ def index end def new - render "/admin/users/new" + @user = User.new + render :new end def create @user = User.new(user_params) + if @user.is_invited? + temp_password = SecureRandom.hex(12) + @user.password = temp_password + @user.password_confirmation = temp_password + end if @user.save - redirect_to admin_users_path, notice: "User added successfully" + begin + msg = "User added successfully" + if @user.send_new_account_instructions? + msg = "User added successfully. Instructions were emailed to the user." + end + redirect_to admin_users_path, notice: msg + rescue Net::SMTPFatalError => e + redirect_to admin_users_path, alert: e.message + end else render :new, status: 422 end end def edit - render "/admin/users/edit" + render :edit end def update if params[:user][:password].blank? params[:user].delete(:password) params[:user].delete(:password_confirmation) + params[:user].delete(:current_password) success = @user.update_without_password(user_params) elsif @user.id == current_user.id - bypass_sign_in @user, scope: "user" success = @user.update_with_password(user_params) + bypass_sign_in @user, scope: "user" else success = @user.update(user_params) end @@ -55,11 +70,11 @@ def site_list end def set_user - @user = params[:id].present? ? User.find(params[:id]) : User.new + @user = User.find(params[:id]) end def user_params - params.require(:user).permit(:email, :password, :password_confirmation, :current_password, :is_site_admin, :is_user_admin, :site_id) + params.require(:user).permit(:email, :password, :password_confirmation, :current_password, :is_site_admin, :is_user_admin, :site_id, :is_invited) end def set_minimum_password_length diff --git a/app/controllers/concerns/access.rb b/app/controllers/concerns/access.rb index cef179ea..b6e0861c 100644 --- a/app/controllers/concerns/access.rb +++ b/app/controllers/concerns/access.rb @@ -1,24 +1,24 @@ module Access def ensure_user_site_admin - unless current_user.is_site_admin? + unless current_user.present? && current_user.is_site_admin? redirect_to sites_path, alert: "You don't have permission to access that page." end end - def ensure_user_user_admin - unless current_user.is_user_admin? + def ensure_user_is_user_admin + unless current_user.present? && current_user.is_user_admin? redirect_to sites_path, alert: "You don't have permission to access that page." end end def ensure_user_site_access - if !current_user.is_site_admin? && (current_user.site.nil? || current_user.site.id != @site.id) + if current_user.nil? || !current_user.is_site_admin? && (current_user.site.nil? || current_user.site.id != @site.id) redirect_to sites_path, alert: "You don't have permission to access that site." end end def ensure_user_document_access - if !current_user.is_site_admin? && (current_user.site.nil? || current_user.site.documents.find(@document.id).nil?) + if current_user.nil? || !current_user.is_site_admin? && (current_user.site.nil? || current_user.site.documents.find(@document.id).nil?) redirect_to sites_path, alert: "You don't have permission to perform that action on document." end end diff --git a/app/controllers/users/passwords_controller.rb b/app/controllers/users/passwords_controller.rb index 9f2d9aee..ce8cd164 100644 --- a/app/controllers/users/passwords_controller.rb +++ b/app/controllers/users/passwords_controller.rb @@ -2,34 +2,18 @@ class Users::PasswordsController < Devise::PasswordsController layout "centered" - # GET /resource/password/new - # def new - # super - # end - # POST /resource/password - # def create - # super - # end + def create + self.resource = resource_class.send_reset_password_instructions(resource_params) + set_flash_message! :notice, :send_paranoid_instructions + resource.email = nil + redirect_back(fallback_location: new_password_path(resource_name)) + end - # GET /resource/password/edit?reset_password_token=abcdef - # def edit - # super - # end - - # PUT /resource/password - # def update - # super - # end - - # protected - - # def after_resetting_password_path_for(resource) - # super(resource) - # end - - # The path used after sending reset password instructions - # def after_sending_reset_password_instructions_path_for(resource_name) - # super(resource_name) - # end + def edit + @is_invitation = params[:is_invitation] == "1" + self.resource = resource_class.new + set_minimum_password_length + resource.reset_password_token = params[:reset_password_token] + end end diff --git a/app/controllers/users/registrations_controller.rb b/app/controllers/users/registrations_controller.rb index b9e664fe..0ddd28c2 100644 --- a/app/controllers/users/registrations_controller.rb +++ b/app/controllers/users/registrations_controller.rb @@ -1,62 +1,11 @@ # frozen_string_literal: true class Users::RegistrationsController < Devise::RegistrationsController - # before_action :configure_sign_up_params, only: [:create] - # before_action :configure_account_update_params, only: [:update] + def new + redirect_to root_path + end - # GET /resource/sign_up - # def new - # super - # end - - # POST /resource - # def create - # super - # end - - # GET /resource/edit - # def edit - # super - # end - - # PUT /resource - # def update - # super - # end - - # DELETE /resource - # def destroy - # super - # end - - # GET /resource/cancel - # Forces the session data which is usually expired after sign - # in to be expired now. This is useful if the user wants to - # cancel oauth signing in/up in the middle of the process, - # removing all OAuth session data. - # def cancel - # super - # end - - # protected - - # If you have extra params to permit, append them to the sanitizer. - # def configure_sign_up_params - # devise_parameter_sanitizer.permit(:sign_up, keys: [:attribute]) - # end - - # If you have extra params to permit, append them to the sanitizer. - # def configure_account_update_params - # devise_parameter_sanitizer.permit(:account_update, keys: [:attribute]) - # end - - # The path used after sign up. - # def after_sign_up_path_for(resource) - # super(resource) - # end - - # The path used after sign up for inactive accounts. - # def after_inactive_sign_up_path_for(resource) - # super(resource) - # end + def create + redirect_to root_path + end end diff --git a/app/mailers/application_mailer.rb b/app/mailers/application_mailer.rb index 3c34c814..710b5421 100644 --- a/app/mailers/application_mailer.rb +++ b/app/mailers/application_mailer.rb @@ -1,4 +1,11 @@ -class ApplicationMailer < ActionMailer::Base - default from: "from@example.com" +class ApplicationMailer < Devise::Mailer + default from: "Code for America " + layout "mailer" + + def new_account_instructions(record, token) + @token = token + @resource = record + mail(to: @resource.email, subject: "Welcome! Set up your account", template_path: "users/mailer") + end end diff --git a/app/models/user.rb b/app/models/user.rb index 29f06430..71865233 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -1,14 +1,15 @@ class User < ApplicationRecord - # Include default devise modules. Others available are: - # :confirmable, :lockable, :timeoutable, :trackable and :omniauthable devise :database_authenticatable, :registerable, - :recoverable, :rememberable, :validatable + :recoverable, :rememberable, :validatable, :trackable - # has_many :sessions, dependent: :destroy belongs_to :site, optional: true delegate :documents, to: :site, allow_nil: true - # normalizes :email_address, with: ->(e) { e.strip.downcase } + def send_new_account_instructions? + return false unless is_invited? - # validates :email_address, presence: true, uniqueness: {case_sensitive: false}, format: {with: URI::MailTo::EMAIL_REGEXP} + token = set_reset_password_token + ApplicationMailer.new_account_instructions(self, token).deliver_now + true + end end diff --git a/app/views/admin/users/edit.html.erb b/app/views/admin/users/edit.html.erb index 607a53bb..c984430f 100644 --- a/app/views/admin/users/edit.html.erb +++ b/app/views/admin/users/edit.html.erb @@ -1,4 +1,4 @@ -
+

Edit <%= @user.email %>

@@ -67,7 +67,7 @@ <%= f.label :site_id, "Site", class: "label-text text-black mb-2 font-semibold" %> <%= f.select :site_id, grouped_options_for_select(@sites, @user.site_id), { include_blank: "None" }, - { class: "input input-bordered w-full select" } %> + { class: "input input-bordered w-full select border-black" } %>
diff --git a/app/views/admin/users/new.html.erb b/app/views/admin/users/new.html.erb index 5bdec638..cef07771 100644 --- a/app/views/admin/users/new.html.erb +++ b/app/views/admin/users/new.html.erb @@ -1,4 +1,4 @@ -
+

Add New User

@@ -12,7 +12,11 @@
<% end %>
- +
+ <%= f.check_box :is_invited %> + <%= f.label :is_invited, "Send invitation email", class: "label-text text-black mb-2 font-semibold" %> +
Send the user an invitation email, which includes a link to set password (skip password fields below).
+
<%= f.label :password, class: "label-text text-black mb-2 font-semibold" %> <%= f.password_field :password, autocomplete: "new-password", class: "input input-bordered w-full" + (@user.errors[:password].any? ? " input-error " : " border-black ") %> @@ -52,7 +56,7 @@ <%= f.label :site_id, "Site", class: "label-text text-black mb-2 font-semibold" %> <%= f.select :site_id, grouped_options_for_select(@sites, @user.site_id), { include_blank: "None" }, - { class: "input input-bordered w-full select" } %> + { class: "input input-bordered w-full select border-black" } %>
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb index 26d65bdb..8347acec 100644 --- a/app/views/layouts/application.html.erb +++ b/app/views/layouts/application.html.erb @@ -85,7 +85,7 @@ <% end %>
-
+
<%= yield %>
diff --git a/app/views/layouts/mailer.html.erb b/app/views/layouts/mailer.html.erb index 3aac9002..d1ba3f75 100644 --- a/app/views/layouts/mailer.html.erb +++ b/app/views/layouts/mailer.html.erb @@ -1,13 +1,71 @@ - + - - <%= yield %> +
+
+ +
+ <%= yield %> +
+
+
diff --git a/app/views/users/mailer/new_account_instructions.html.erb b/app/views/users/mailer/new_account_instructions.html.erb new file mode 100644 index 00000000..5cccc669 --- /dev/null +++ b/app/views/users/mailer/new_account_instructions.html.erb @@ -0,0 +1,7 @@ +

Hello!

+ +

Your account has been created, but requires activation. Please follow the link below to set a new password and log in.

+ +

<%= link_to 'Set my password', edit_password_url(@resource, reset_password_token: @token, is_invitation: 1) %>

+ +

If you didn't request this, please ignore this email.

diff --git a/app/views/users/mailer/reset_password_instructions.html.erb b/app/views/users/mailer/reset_password_instructions.html.erb index f667dc12..efce8d03 100644 --- a/app/views/users/mailer/reset_password_instructions.html.erb +++ b/app/views/users/mailer/reset_password_instructions.html.erb @@ -1,4 +1,4 @@ -

Hello <%= @resource.email %>!

+

Hello!

Someone has requested a link to change your password. You can do this through the link below.

diff --git a/app/views/users/passwords/edit.html.erb b/app/views/users/passwords/edit.html.erb index 863ffbb2..e32b1760 100644 --- a/app/views/users/passwords/edit.html.erb +++ b/app/views/users/passwords/edit.html.erb @@ -1,25 +1,45 @@ -

Change your password

+
+
+

<%= @is_invitation ? "Set" : "Change" %> your password

+ <%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :put }) do |f| %> + <%= f.hidden_field :reset_password_token %> + <% if resource.errors[:reset_password_token].any? %> +
+ Reset password token has expired, + please <%= link_to "request a new one", new_password_path(resource_name), class: "text-black" %> +
+ <% end %> +
+ <%= f.label :password, class: "label-text text-black mb-2 font-semibold" %> + <%= f.password_field :password, autocomplete: "new-password", class: "input input-bordered w-full" + (resource.errors[:password].any? ? " input-error " : " border-black ") %> + <% if @minimum_password_length %> + + <% if @minimum_password_length %><%= @minimum_password_length %> characters minimum. + <% end %> Leave blank if you don't want to change it. + <% end %> + <% if resource.errors[:password].any? %> +
+ <%= resource.errors.full_message(:password, resource.errors[:password].first) %> +
+ <% end %> +
-<%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :put }) do |f| %> - <%= render "users/shared/error_messages", resource: resource %> - <%= f.hidden_field :reset_password_token %> +
+ <%= f.label :password_confirmation, class: "label-text text-black mb-2 font-semibold" %> + <%= f.password_field :password_confirmation, autocomplete: "new-password", class: "input input-bordered w-full" + (resource.errors[:password_confirmation].any? ? " input-error " : " border-black ") %> + <% if resource.errors[:password_confirmation].any? %> +
+ <%= resource.errors.full_message(:password_confirmation, resource.errors[:password_confirmation].first) %> +
+ <% end %> +
-
- <%= f.label :password, "New password" %>
- <% if @minimum_password_length %> - (<%= @minimum_password_length %> characters minimum)
+
+ <%= button_tag type: "submit", class: "btn btn-primary text-white", id: "submit-session-form" do %> + + <%= @is_invitation ? "Set" : "Change"%> my password + <% end %> +
<% end %> - <%= f.password_field :password, autofocus: true, autocomplete: "new-password" %>
- -
- <%= f.label :password_confirmation, "Confirm new password" %>
- <%= f.password_field :password_confirmation, autocomplete: "new-password" %> -
- -
- <%= f.submit "Change my password" %> -
-<% end %> - -<%= render "users/shared/links" %> +
\ No newline at end of file diff --git a/app/views/users/passwords/new.html.erb b/app/views/users/passwords/new.html.erb index 3b30b06d..1dccc415 100644 --- a/app/views/users/passwords/new.html.erb +++ b/app/views/users/passwords/new.html.erb @@ -1,16 +1,26 @@ -

Forgot your password?

+
+
+

Forgot your password?

+ <%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :post }) do |f| %> +
+ <%= f.label :email, class: "label label-text text-black font-semibold" %> + <%= f.email_field :email, autofocus: true, autocomplete: "email", class: "input input-bordered w-full " + (resource.errors[:base].any? ? " input-error " : " border-black ") %> + <% if resource.errors[:base].any? %> +
+ <%= resource.errors.full_messages.first %> +
+ <% end %> +
-<%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :post }) do |f| %> - <%= render "users/shared/error_messages", resource: resource %> - -
- <%= f.label :email %>
- <%= f.email_field :email, autofocus: true, autocomplete: "email" %> -
- -
- <%= f.submit "Send me reset password instructions" %> +
+ <%= button_tag type: "submit", class: "btn btn-primary text-white", id: "submit-session-form" do %> + + Send instructions + <% end %> +
+
+ <%= link_to "Back to log in", session_path(resource_name), class: "text-primary" %> +
+ <% end %>
-<% end %> - -<%= render "users/shared/links" %> +
\ No newline at end of file diff --git a/app/views/users/registrations/edit.html.erb b/app/views/users/registrations/edit.html.erb index 10c720b4..2fb29b28 100644 --- a/app/views/users/registrations/edit.html.erb +++ b/app/views/users/registrations/edit.html.erb @@ -1,4 +1,4 @@ -
+

Edit <%= resource_name.to_s.humanize %>

diff --git a/app/views/users/sessions/new.html.erb b/app/views/users/sessions/new.html.erb index 6cd48baa..117f311d 100644 --- a/app/views/users/sessions/new.html.erb +++ b/app/views/users/sessions/new.html.erb @@ -40,6 +40,11 @@ Log in <% end %>
- <% end %> + <%- if devise_mapping.recoverable? && controller_name != 'passwords' && controller_name != 'registrations' %> + + <% end %> + <% end %>
\ No newline at end of file diff --git a/config/environments/production.rb b/config/environments/production.rb index 4786618b..c78f36b8 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -27,7 +27,18 @@ config.active_support.report_deprecations = false - config.action_mailer.default_url_options = {host: "example.com"} + config.action_mailer.delivery_method = :smtp + config.action_mailer.smtp_settings = { + address: ENV.fetch("SMTP_ENDPOINT"), + port: 587, + domain: "demo.codeforamerica.ai", + user_name: ENV.fetch("SMTP_USER"), + password: ENV.fetch("SMTP_PASSWORD"), + authentication: "plain" + } + config.action_mailer.perform_deliveries = true + config.action_mailer.raise_delivery_errors = false + config.action_mailer.default_url_options = {host: "demo.codeforamerica.ai"} config.i18n.fallbacks = true config.active_record.dump_schema_after_migration = false diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb index 875cbb60..b3c6e248 100644 --- a/config/initializers/devise.rb +++ b/config/initializers/devise.rb @@ -24,10 +24,10 @@ # Configure the e-mail address which will be shown in Devise::Mailer, # note that it will be overwritten if you use your own mailer class # with default "from" parameter. - config.mailer_sender = "please-change-me-at-config-initializers-devise@example.com" + config.mailer_sender = "admin@demo.codeforamerica.ai" # Configure the class responsible to send e-mails. - # config.mailer = 'Devise::Mailer' + config.mailer = "ApplicationMailer" # Configure the parent class responsible to send e-mails. # config.parent_mailer = 'ActionMailer::Base' diff --git a/db/migrate/20250716155512_add_devise_trackable.rb b/db/migrate/20250716155512_add_devise_trackable.rb new file mode 100644 index 00000000..58c92469 --- /dev/null +++ b/db/migrate/20250716155512_add_devise_trackable.rb @@ -0,0 +1,11 @@ +class AddDeviseTrackable < ActiveRecord::Migration[8.0] + def self.up + change_table :users do |t| + t.integer :sign_in_count, default: 0, null: false + t.datetime :current_sign_in_at + t.datetime :last_sign_in_at + t.string :current_sign_in_ip + t.string :last_sign_in_ip + end + end +end diff --git a/db/migrate/20250716163605_add_invitation_flag.rb b/db/migrate/20250716163605_add_invitation_flag.rb new file mode 100644 index 00000000..5f06b44d --- /dev/null +++ b/db/migrate/20250716163605_add_invitation_flag.rb @@ -0,0 +1,7 @@ +class AddInvitationFlag < ActiveRecord::Migration[8.0] + def change + change_table :users do |t| + t.boolean :is_invited + end + end +end diff --git a/spec/features/admin_spec.rb b/spec/features/admin_spec.rb index e02605ab..d77bc316 100644 --- a/spec/features/admin_spec.rb +++ b/spec/features/admin_spec.rb @@ -84,4 +84,19 @@ expect(page).to have_current_path("/admin/users") expect(page).to have_content "bob@example.com None Yes Yes Edit" end + + it "admins can invite users" do + clear_emails + @current_user.is_user_admin = true + @current_user.save + visit "/admin/users/new" + fill_in "Email", with: "test-invite@example.com" + check "Send invitation email" + click_button "Save" + expect(page).to have_content "User added successfully. Instructions were emailed to the user." + expect(page).to have_current_path "/admin/users" + wait_for_mail_delivery + open_email("test-invite@example.com") + expect(current_email).to have_content "Your account has been created, but requires activation. Please follow the link below to set a new password and log in." + end end diff --git a/spec/features/login_spec.rb b/spec/features/login_spec.rb index 2d600259..07215b0f 100644 --- a/spec/features/login_spec.rb +++ b/spec/features/login_spec.rb @@ -28,4 +28,19 @@ expect(page).to have_content "Signed in successfully" expect(page).to have_no_selector "#new_user" end + # clear_emails + # it "password resets" do + # clear_emails + # visit "/users/sign_in" + # click_link "Forgot your password?" + # expect(page).to have_current_path "/users/password/new", wait: 5 + # expect(page).to have_content "Forgot your password?" + # fill_in "Email", with: "bob@example.com" + # click_button "Send instructions" + # expect(page).to have_content "If your email address exists in our database, you will receive a password recovery link at your email address in a few minutes." + # expect(ActionMailer::Base.deliveries).to be_empty + # fill_in "Email", with: "bob@example.com" + # click_button "Send instructions" + # expect(page).to have_content "If your email address exists in our database, you will receive a password recovery link at your email address in a few minutes." + # end end diff --git a/spec/helpers/mail.rb b/spec/helpers/mail.rb new file mode 100644 index 00000000..e15f32da --- /dev/null +++ b/spec/helpers/mail.rb @@ -0,0 +1,14 @@ +module MailHelpers + def wait_for_mail_delivery + Timeout.timeout(5) do + loop do + break if ActionMailer::Base.deliveries.any? + sleep(0.1) + end + end + end +end + +RSpec.configure do |config| + config.include MailHelpers, type: :feature +end diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb index 02169cb1..d1447214 100644 --- a/spec/rails_helper.rb +++ b/spec/rails_helper.rb @@ -8,6 +8,7 @@ require "shoulda/matchers" require "capybara/rails" require "helpers/user" +require "helpers/mail" # Capybara.default_driver = :selenium_chrome diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb index 0c3ad0be..fd5c56d8 100644 --- a/spec/spec_helper.rb +++ b/spec/spec_helper.rb @@ -1,6 +1,7 @@ require "shoulda/matchers" require "factory_bot_rails" require "capybara/rspec" +require "capybara/email/rspec" RSpec.configure do |config| config.expect_with :rspec do |expectations| diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl index a36f4ab2..603a4a8b 100644 --- a/terraform/.terraform.lock.hcl +++ b/terraform/.terraform.lock.hcl @@ -1,6 +1,28 @@ # This file is maintained automatically by "tofu init". # Manual edits may be lost in future updates. +provider "registry.opentofu.org/cloudposse/awsutils" { + version = "0.20.1" + constraints = ">= 0.11.0" + hashes = [ + "h1:6r2pii9sYLWC3UXHO7yu/ZPQFmfUltWT+o+Tr9jE3ns=", + "zh:13892dc53f9f6af7d13665a95c11e8821538ced3fdb04fbac92f5346a677bf81", + "zh:4659d0e4e59608b81f08dd989f2674dcd549610454a0f1ed4c245c5f367af164", + "zh:47d879ff6611a6e401f92d125b57ef14ab6c848792b0347204daef57cb9700bc", + "zh:5c41a0ed4f2996a2bd62a8352dcc828f4ac3b157d209c4d9a6c0fefe4181c0c0", + "zh:6ccdec55c0f7d87b8f674a71b79a333f13cf781034f7feecd26e6782e90a902a", + "zh:8263fcf0be891adb101157ba8054094109f436b3fe974bb2da8f99ed55d2d5d2", + "zh:89cf2450d3fba0ac3646f4b9a37803e179583860801ef21201845165073737f9", + "zh:9fcb8243ce3cf9d4cfb8602ed8b31081fd59eac8570838959817aed385a31ad7", + "zh:a9c0f440eb77c77b25c99c4e7faf27cfdc5e80cd52fc8318ffcbc47f0db90ee1", + "zh:d42a6bc5e5fafb076f7d79038908602acff5a6ec727da06e7cbabcadf3ad8bb9", + "zh:eb14a3071ecd35fa38d12b8a688f125aadf9ce61db0d91c0024f9a3788bd0a73", + "zh:eefbba6dc993b636e209b3a7f2dd98dc9242572a319c0580e8725987d07341b6", + "zh:f52b3b8e830032b3c16b93c683cd0c543ceed83f60be71bcbfcb293665d5a76d", + "zh:f584e27d2c922289008034774c1b0b45af3c90714c588b7f1c17a84cce723690", + ] +} + provider "registry.opentofu.org/hashicorp/aws" { version = "5.100.0" constraints = ">= 3.29.0, >= 3.74.0, >= 4.15.1, >= 4.37.0, >= 5.0.0, ~> 5.0, >= 5.44.0, >= 5.79.0, >= 5.81.0, >= 5.83.0, >= 5.93.0, >= 5.99.0" @@ -19,6 +41,42 @@ provider "registry.opentofu.org/hashicorp/aws" { ] } +provider "registry.opentofu.org/hashicorp/local" { + version = "2.5.3" + constraints = ">= 1.2.0" + hashes = [ + "h1:31Clmfoe7hzkcdgwuhUuGuPGfeG2Ksk+YWcJgzBTN7M=", + "zh:32e1d4b0595cea6cda4ca256195c162772ddff25594ab4008731a2ec7be230bf", + "zh:48c390af0c87df994ec9796f04ec2582bcac581fb81ed6bb58e0671da1c17991", + "zh:4be7289c969218a57b40902e2f359914f8d35a7f97b439140cb711aa21e494bd", + "zh:4cf958e631e99ed6c8b522c9b22e1f1b568c0bdadb01dd002ca7dffb1c927764", + "zh:7a0132c0faca4c4c96aa70808effd6817e28712bf5a39881666ac377b4250acf", + "zh:7d60de08fac427fb045e4590d1b921b6778498eee9eb16f78c64d4c577bde096", + "zh:91003bee5981e99ec3925ce2f452a5f743827f9d0e131a86613549c1464796f0", + "zh:9fe2fe75977c8149e2515fb30c6cc6cfd57b225d4ce592c570d81a3831d7ffa3", + "zh:e210e6be54933ce93e03d0994e520ba289aa01b2c1f70e77afb8f2ee796b0fe3", + "zh:e8793e5f9422f2b31a804e51806595f335b827c9a38db18766960464566f21d5", + ] +} + +provider "registry.opentofu.org/hashicorp/null" { + version = "3.2.4" + constraints = ">= 2.0.0" + hashes = [ + "h1:i+WKhUHL2REY5EGmiHjfUljJB8UKZ9QdhdM5uTeUhC4=", + "zh:1769783386610bed8bb1e861a119fe25058be41895e3996d9216dd6bb8a7aee3", + "zh:32c62a9387ad0b861b5262b41c5e9ed6e940eda729c2a0e58100e6629af27ddb", + "zh:339bf8c2f9733fce068eb6d5612701144c752425cebeafab36563a16be460fb2", + "zh:36731f23343aee12a7e078067a98644c0126714c4fe9ac930eecb0f2361788c4", + "zh:3d106c7e32a929e2843f732625a582e562ff09120021e510a51a6f5d01175b8d", + "zh:74bcb3567708171ad83b234b92c9d63ab441ef882b770b0210c2b14fdbe3b1b6", + "zh:90b55bdbffa35df9204282251059e62c178b0ac7035958b93a647839643c0072", + "zh:ae24c0e5adc692b8f94cb23a000f91a316070fdc19418578dcf2134ff57cf447", + "zh:b5c10d4ad860c4c21273203d1de6d2f0286845edf1c64319fa2362df526b5f58", + "zh:e05bbd88e82e1d6234988c85db62fd66f11502645838fff594a2ec25352ecd80", + ] +} + provider "registry.opentofu.org/hashicorp/random" { version = "3.7.2" constraints = ">= 3.0.0" diff --git a/terraform/main.tf b/terraform/main.tf index c9d323db..9676851f 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -47,12 +47,21 @@ module "secrets" { secret_key = "" }) } + smtp = { + description = "The SMTP credentials." + name = "/asap-pdf/production/smtp" + start_value = jsonencode({ + endpoint = "" + user = "" + password = "" + }) + } google = { - description = "The Rails master key." + description = "Optional Google API key." name = "/asap-pdf/production/GOOGLE_AI_KEY" } anthropic = { - description = "The Rails master key." + description = "Optional Anthropic API key." name = "/asap-pdf/production/ANTHROPIC_KEY" } rails_api_user = { @@ -139,7 +148,10 @@ module "ecs" { db_password_secret_arn = "${module.secrets.secrets["database"].secret_arn}:password" secret_key_base_secret_arn = "${module.secrets.secrets["rails"].secret_arn}:secret_key" rails_master_key_secret_arn = "${module.secrets.secrets["rails"].secret_arn}:master_key" - redis_url_secret_arn = "${module.secrets.secrets["redis"].secret_arn}:url" + smtp_endpoint_secret_arn = "${module.secrets.secrets["smtp"].secret_arn}:ednpoint" + smtp_user_secret_arn = "${module.secrets.secrets["smtp"].secret_arn}:user" + smtp_password_secret_arn = "${module.secrets.secrets["smtp"].secret_arn}:password" + redis_url_secret_arn = "${module.secrets.secrets["redis"].secret_arn}:url" vpc_id = module.networking.vpc_id private_subnets = module.networking.private_subnet_ids @@ -169,6 +181,14 @@ module "lambda" { s3_document_bucket_arn = aws_s3_bucket.documents.arn } +module "ses" { + source = "./modules/ses" + + project_name = var.project_name + environment = var.environment + domain_name = var.domain_name +} + # S3 bucket for PDF storage resource "aws_s3_bucket" "documents" { bucket = "${var.project_name}-${var.environment}-documents" diff --git a/terraform/modules/ecs/main.tf b/terraform/modules/ecs/main.tf index f07a76f7..bac5463f 100644 --- a/terraform/modules/ecs/main.tf +++ b/terraform/modules/ecs/main.tf @@ -12,8 +12,8 @@ module "fargate_service" { private_subnets = var.private_subnets public_subnets = var.public_subnets logging_key_id = var.logging_key_id - cpu = 1024 - memory = 2048 + cpu = 1024 + memory = 2048 container_port = 3000 execution_policies = [aws_iam_policy.ecs_task_secrets_policy.arn, aws_iam_policy.ecs_s3_access.arn] @@ -41,15 +41,16 @@ module "fargate_service" { DB_PASSWORD : var.db_password_secret_arn SECRET_KEY_BASE : var.secret_key_base_secret_arn RAILS_MASTER_KEY : var.rails_master_key_secret_arn - REDIS_URL : var.redis_url_secret_arn + REDIS_URL : var.redis_url_secret_arn, + SMTP_ENDPOINT : var.smtp_endpoint_secret_arn, + SMTP_USER : var.smtp_user_secret_arn, + SMTP_PASSWORD : var.smtp_password_secret_arn, } } # Add permissions for Secrets Manager access resource "aws_iam_policy" "ecs_task_secrets_policy" { name = "${var.project_name}-${var.environment}-task-secrets-policy" - # @todo Not sure how to get this. - #role = aws_iam_role.ecs_task_execution_role.id policy = jsonencode({ Version = "2012-10-17" @@ -66,7 +67,10 @@ resource "aws_iam_policy" "ecs_task_secrets_policy" { var.db_password_secret_arn, var.secret_key_base_secret_arn, var.rails_master_key_secret_arn, - var.redis_url_secret_arn + var.redis_url_secret_arn, + var.smtp_endpoint_secret_arn, + var.smtp_user_secret_arn, + var.smtp_password_secret_arn, ] } ] diff --git a/terraform/modules/ecs/variables.tf b/terraform/modules/ecs/variables.tf index 8659f9bc..7f2d90c7 100644 --- a/terraform/modules/ecs/variables.tf +++ b/terraform/modules/ecs/variables.tf @@ -44,6 +44,21 @@ variable "rails_master_key_secret_arn" { type = string } +variable "smtp_endpoint_secret_arn" { + description = "ARN of the SMTP endpoint" + type = string +} + +variable "smtp_user_secret_arn" { + description = "ARN of the SMTP user name" + type = string +} + +variable "smtp_password_secret_arn" { + description = "ARN of the SMTP password" + type = string +} + variable "redis_url_secret_arn" { description = "ARN of the Redis URL secret in Secrets Manager" type = string diff --git a/terraform/modules/ses/main.tf b/terraform/modules/ses/main.tf new file mode 100644 index 00000000..92848162 --- /dev/null +++ b/terraform/modules/ses/main.tf @@ -0,0 +1,12 @@ +data "aws_route53_zone" "domain" { + name = var.domain_name +} + +module "ses" { + name = "${var.project_name}-${var.environment}-ses" + source = "github.com/cloudposse/terraform-aws-ses" + domain = var.domain_name + zone_id = data.aws_route53_zone.domain.id + verify_domain = true + verify_dkim = true +} \ No newline at end of file diff --git a/terraform/modules/ses/variables.tf b/terraform/modules/ses/variables.tf new file mode 100644 index 00000000..14d05e40 --- /dev/null +++ b/terraform/modules/ses/variables.tf @@ -0,0 +1,14 @@ +variable "project_name" { + description = "Name of the project, used in resource naming" + type = string +} + +variable "environment" { + description = "Environment name" + type = string +} + +variable "domain_name" { + description = "The app's domain name." + type = string +} \ No newline at end of file diff --git a/terraform/variables.tf b/terraform/variables.tf index 27b85db3..eeea2135 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -16,119 +16,8 @@ variable "domain_name" { default = "demo.codeforamerica.ai" } -# variable "vpc_cidr" { -# description = "CIDR block for VPC" -# type = string -# default = "10.0.0.0/16" -# } -# -# variable "public_subnet_cidrs" { -# description = "CIDR blocks for public subnets" -# type = list(string) -# default = ["10.0.1.0/24", "10.0.2.0/24"] -# } -# -# variable "private_subnet_cidrs" { -# description = "CIDR blocks for private subnets" -# type = list(string) -# default = ["10.0.3.0/24", "10.0.4.0/24"] -# } - -# Database Configuration -# variable "db_instance_class" { -# description = "RDS instance class" -# type = string -# default = "db.t3.small" -# } - -# variable "db_allocated_storage" { -# description = "Allocated storage for RDS instance in GB" -# type = number -# default = 20 -# } - -# variable "db_name" { -# description = "Name of the database" -# type = string -# default = "access_pdf_production" -# } - -# variable "db_username" { -# description = "Master username for the RDS instance" -# type = string -# default = "asap_pdf" -# } - -# Redis Configuration -# variable "redis_node_type" { -# description = "ElastiCache node type" -# type = string -# default = "cache.t3.micro" -# } - -# variable "redis_port" { -# description = "Port for Redis" -# type = number -# default = 6379 -# } - -# Container Configuration -# variable "container_port" { -# description = "Port the container listens on" -# type = number -# default = 3000 # Rails default port -# } - -# variable "container_cpu" { -# description = "CPU units for Fargate task (256 = 0.25 vCPU, 512 = 0.5 vCPU, 1024 = 1 vCPU)" -# type = number -# default = 1024 # 1 vCPU -# } -# -# variable "container_memory" { -# description = "Memory for Fargate task in MiB (Valid values: 512, 1024, 2048, 3072, 4096, etc.)" -# type = number -# default = 2048 # 2GB memory -# } - -# GitHub Configuration -# variable "github_repository" { -# description = "GitHub repository in format owner/repo" -# type = string -# } - -# Application Configuration -# variable "rails_master_key" { -# description = "Rails master key for the application" -# type = string -# sensitive = true -# } - -# variable "aws_account_id" { -# description = "AWS Account ID" -# type = string -# } - variable "aws_region" { description = "AWS Region" type = string default = "us-east-1" } - -# variable "secret_key_base" { -# description = "Rails secret key base for production" -# type = string -# sensitive = true -# } - -# variable "google_ai_key" { -# description = "Google/Gemini API Key" -# type = string -# sensitive = true -# } -# -# variable "anthropic_key" { -# description = "Anthropic API Key" -# type = string -# sensitive = true -# } From 53750d284c8b77431624132208ab476e8c5a7c06 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 29 Jul 2025 10:16:42 -0500 Subject: [PATCH 4/4] Bump pg from 1.5.9 to 1.6.0 (#243) * Migrate Gemini 1.5-Pro models to Gemini 2.0 Flash models (#240) * Migrate Gemini 1.5-Pro models to Gemini 2.0 Flash models * Update summary model to Gemini 2.0 Flash * Remove Gemini 1.5 model from evaluation suite * Bump pg from 1.5.9 to 1.6.0 Bumps [pg](https://github.com/ged/ruby-pg) from 1.5.9 to 1.6.0. - [Changelog](https://github.com/ged/ruby-pg/blob/master/CHANGELOG.md) - [Commits](https://github.com/ged/ruby-pg/compare/v1.5.9...v1.6.0) --- updated-dependencies: - dependency-name: pg dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --------- Signed-off-by: dependabot[bot] Co-authored-by: Allison Morgan Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/eval.yml | 4 ++-- Gemfile.lock | 6 +++++- app/models/document.rb | 2 +- python_components/document_inference/models.json | 6 ++++++ 4 files changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml index a1949bdf..8c364ab1 100644 --- a/.github/workflows/eval.yml +++ b/.github/workflows/eval.yml @@ -14,14 +14,14 @@ on: description: Inference Model options: - gemini-2.5-pro-preview-03-25 - - gemini-1.5-pro-latest + - gemini-2.0-flash + - gemini-2.0-flash-lite evaluation_model_name: type: choice description: Evaluation Model options: - gemini-2.5-flash - gemini-2.5-pro-preview-03-25 - - gemini-1.5-pro-latest runs_per_document: description: 'Number of times generate evaluations per document' required: false diff --git a/Gemfile.lock b/Gemfile.lock index 588c995f..ff731c2d 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -292,7 +292,11 @@ GEM parser (3.3.8.0) ast (~> 2.4.1) racc - pg (1.5.9) + pg (1.6.0) + pg (1.6.0-aarch64-linux) + pg (1.6.0-arm64-darwin) + pg (1.6.0-x86_64-darwin) + pg (1.6.0-x86_64-linux) pp (0.6.2) prettyprint prettyprint (0.2.0) diff --git a/app/models/document.rb b/app/models/document.rb index a31d6801..767a5cb9 100644 --- a/app/models/document.rb +++ b/app/models/document.rb @@ -230,7 +230,7 @@ def inference_summary! api_host = "https://demo.codeforamerica.ai" end payload = { - model_name: "gemini-1.5-pro-latest", + model_name: "gemini-2.0-flash", documents: [{id: id, title: file_name, url: normalized_url, purpose: document_category}], page_limit: 7, inference_type: "summary", diff --git a/python_components/document_inference/models.json b/python_components/document_inference/models.json index a85480c5..2c2909f9 100644 --- a/python_components/document_inference/models.json +++ b/python_components/document_inference/models.json @@ -5,6 +5,12 @@ "gemini-1.5-pro-latest": { "key": "/asap-pdf/production/GOOGLE_AI_KEY-20250521205655769000000003" }, + "gemini-2.0-flash": { + "key": "/asap-pdf/production/GOOGLE_AI_KEY-20250521205655769000000003" + }, + "gemini-2.0-flash-lite": { + "key": "/asap-pdf/production/GOOGLE_AI_KEY-20250521205655769000000003" + }, "gemini-2.5-pro-preview-03-25": { "key": "/asap-pdf/production/GOOGLE_AI_KEY-20250521205655769000000003" }