* Optimize PaperTrail whodunnit query in CropsController#show
Replace @crop.versions.map(&:whodunnit) with
@crop.versions.distinct.pluck(:whodunnit) to avoid instantiating all PaperTrail version objects and loading object/object_changes into memory.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Optimize PaperTrail whodunnit query in CropsController#show
Replace @crop.versions.map(&:whodunnit) with
@crop.versions.distinct.pluck(:whodunnit) to avoid instantiating all PaperTrail version objects and loading object/object_changes into memory. Added unit test in spec/controllers/crops_controller_spec.rb.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Optimize PaperTrail whodunnit query in CropsController#show
Use @crop.versions.reorder(nil).distinct.pluck(:whodunnit) to avoid instantiating all PaperTrail version objects into memory and prevent PostgreSQL PG::InvalidColumnReference errors with SELECT DISTINCT.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Fix crop route parameter in controller spec
Update parameter key from id to slug in CropsController show spec to match param: :slug route definition.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
- Update liked_by? to return false if member is nil and use likes.exists?(member_id: member.id) instead of allocating login name arrays.
- Simplify liked_by_members_names to use members.pluck(:login_name).
- Update app/views/photos/_likes.html.haml to use photo.liked_by?(current_member).
- Add unit tests for liked_by? in spec/models/like_spec.rb.
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
* Keep Rack::Attack counters in process memory
Rack::Attack was storing its request counters in Rails.cache, which is
memcached in production. On 2026-09-19, memcached calls were timing out
in the production logs. When that happens, the counters stop working.
In the same log window, one IP made 753 requests. 717 of them
succeeded. The 15 per minute throttle and the 500 per day ban did not
stop it.
Rack::Attack now uses its own in-memory store, capped at 8 MB. Each
Puma worker keeps its own counters, so the limits apply per worker.
Refs #1640
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* Add BLOCKED_IPS list to Rack::Attack
When one crawler overloads the site, we need a fast way to block it.
Rack::Attack now blocks every IP listed in the BLOCKED_IPS environment
variable. The list is comma separated.
Setting the variable does not need a code change. It also keeps IP
addresses out of the repository.
Refs #1640
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* Lower the memcached socket timeout to 0.5 seconds
The production cache store waited up to 1.5 seconds for each memcached
call. Dalli's own default is 1 second. Dalli also retries after a
failure, so one bad cache call can block a Puma thread for longer than
the timeout.
On 2026-09-19, the production logs showed memcached timeouts every few
seconds. With only 5 threads per Puma worker, blocked threads make the
site slow. Slow requests hold memory for longer.
The timeout is now 0.5 seconds. A healthy memcached call takes a few
milliseconds. A call that takes 0.5 seconds has failed in practice, so the
request is better off skipping the cache.
Refs #1640
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* Wait for the page reload in the members list spec
The "members list" feature specs click "Show" and then read the list of
members right away. "Show" submits a GET form, so the browser loads a
whole new page. The spec could read the list from the old page. The old
page was then replaced, and Selenium raised StaleElementReferenceError.
This failed once in CI on the pull request for #4800:
https://github.com/Growstuff/growstuff/actions/runs/35477162596
Both examples now wait for the new URL before they read the list. The
URL contains the chosen sort order, so the wait only ends once the new
page has loaded.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* Wait for the place page in the places search spec
The "User searches" specs fill in the search form, click "Search", and
then read the page straight away. The search goes to /places/search,
which redirects to /places/<place>. The spec could read the page while
the browser was still moving to the new page.
Selenium then raised "Node with given id does not belong to the
document". It failed in CI on the first example in "with a valid place":
https://github.com/Growstuff/growstuff/actions/runs/35481754102
The search_with helper now waits for the place page URL before it
returns. A blank search stays on the same URL, so it does not wait.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* Rename the places CI workflow from "Admin" to "Places"
The workflow in ci-features-places.yml was named "CI Features - Admin".
It looks like it was copied from the admin workflow and never renamed.
It runs spec/features/places/.
Two workflows then had the same name. Every commit showed two
"CI Features - Admin" runs. A failing places spec appeared under the
admin name, which sent people to the wrong specs:
https://github.com/Growstuff/growstuff/actions/runs/35481754102
Branch protection requires a check called "rspec". That is the job
name, not the workflow name, so the required check does not change.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
- Configure Allow2Ban in Rack::Attack to ban IPs requesting >500 pages per day for 1 week (7 days).
- Add honeypot route /dont-crawl-me disallowed in robots.txt and configure Fail2Ban in Rack::Attack to ban IPs visiting it for 7 days upon 1 hit.
- Update PhotosController#index to raise ActiveRecord::RecordNotFound when page parameter is out of bounds, returning 404 Not Found to crawlers instead of 200 OK.
- Add request and controller specs for Rack::Attack rules and pagination 404 responses.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Implement crop photo fallback in PhotoCapable thumbnail_url
Currently, plantings, seeds, and harvests display "no photo available" placeholders when they do not have specific photos attached. This change enables the PhotoCapable#thumbnail_url method to automatically fall back to the associated crop's thumbnail_url when no item-specific photo is present.
Additionally, this commit:
- Fixes validation in PhotoAssociation to handle crop photos that do not have a polymorphic photographable owner.
- Disables cache store during testing to prevent stale/cached default photos from leaking across specs.
- Adds comprehensive unit tests for the fallback logic.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Keep only core crop photo fallback and unit tests, removing excess changes
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
* Upgrade application to Rails 8.1
- Update rails gem to ~> 8.1.0
- Set config.load_defaults 8.1 in application.rb
- Add gem 'csv' for Ruby 3.4+ compatibility
- Replace deprecated 'render text:' with 'render plain:' in PagesController
- Add compatibility patch for jsonapi-resources routing in Rails 8.1
- Add compatibility patch for Faraday 2.x error constants
- Add Searchkick test stubs for environments without Elasticsearch
- Include required Active Storage update migrations
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Remove disabled searchkick
* Apply suggestion from @CloCkWeRX
* Delete config/initializers/faraday_patch.rb
* Apply suggestions from code review
Co-authored-by: Daniel O'Connor <daniel.oconnor@gmail.com>
* Remove modifications for tests without elasticsearch
* Remove psych gem and its dependencies
Removed psych gem version 5.4.0 and its dependencies.
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
* Refactor Plantings to remove Elasticsearch dependency
This commit refactors the Plantings controller, model, and views to use
ActiveRecord instead of Searchkick/Elasticsearch.
Key changes:
- Refactored `PlantingsController#index` to use an ActiveRecord-based
`plantings` method.
- Moved `homepage_records` logic from `SearchPlantings` concern to the
`Planting` model using ActiveRecord scopes.
- Removed `SearchPlantings` concern and deleted the file.
- Updated `home/_plantings.html.haml` and `plantings/index.rss.haml` to
use dot notation for `Planting` object attributes.
- Updated specs to remove Searchkick-related setup and assertions.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Fix Planting.reindex
* Fix test
* Mark test pending
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
* Refactor Seeds to remove Elasticsearch dependency
This commit refactors the `SeedsController` and `Seed` model to remove
dependency on Elasticsearch and Searchkick.
Key changes:
- Removed `SearchSeeds` concern from the `Seed` model.
- Reimplemented `Seed.homepage_records` using ActiveRecord.
- Refactored `SeedsController#index` to use ActiveRecord for filtering,
eager loading, and pagination.
- Deleted `app/models/concerns/search_seeds.rb`.
- Updated relevant specs to remove Searchkick-specific tags and setup.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Remove Seed.reindex
* Remove trait
* Fix tests
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
The Photo model is no longer using Searchkick/Elasticsearch, so calling
`Photo.reindex` causes a NoMethodError. This commit removes these calls
from `spec/spec_helper.rb` and feature specs, and removes the unused
`:reindex` trait from the photo factory call in `likeable_spec.rb`.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
- Refactored `PhotosController#index` to use ActiveRecord queries instead of Searchkick/Elasticsearch.
- Handled filtering by crop and planting via associations.
- Added eager loading for the photo owner to prevent N+1 queries.
- Decoupled the `Photo` model from Elasticsearch by removing the `SearchPhotos` concern.
- Deleted `app/models/concerns/search_photos.rb`.
- Updated controller and model specs to use standard ActiveRecord expectations.
- Cleaned up the photo factory by removing the now-obsolete `:reindex` trait.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
- Update Ability to grant destroy permission to collaborators for their own record
- Add 'Leave garden' link to garden show page
- Add specs for garden collaborator permissions
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
* Add crops search API endpoint
- Added GET /api/v1/crops/search endpoint.
- Updated CropSearchService to support additional search options.
- Manually updated Swagger documentation in swagger/v1/swagger.json.
- Added request specs to verify the new endpoint.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Add crops search API endpoint
- Added GET /api/v1/crops/search endpoint.
- Updated CropSearchService to support additional search options.
- Manually updated Swagger documentation in swagger/v1/swagger.json.
- Added request specs to verify the new endpoint.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
* Update planting rating when recording a harvest
- Added virtual attribute `overall_rating` to `Harvest` model.
- Updated `HarvestsController` to permit `overall_rating` and synchronize it to the associated `Planting`.
- Added a rating range field (1-5) to the harvest form.
- Added controller tests to verify that the planting rating is updated.
- Refined feature tests for harvesting.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* I have updated the system to allow for recording a planting rating when a harvest is logged. Here is a summary of the changes:
- Added a virtual attribute `overall_rating` to the `Harvest` model.
- Updated `HarvestsController` to permit `overall_rating` and synchronize it to the associated `Planting`.
- Added a rating range field (1-5) to the harvest form.
- Added controller tests to verify that the planting rating is updated correctly.
- Updated feature tests to ensure the harvest form functions as expected.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Update database.yml
* Apply suggestions from code review
Co-authored-by: Daniel O'Connor <daniel.oconnor@gmail.com>
* Adjust wording
* Change harvest modal
* Fix tests
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
- Added `send_harvest_reminder` preference to Member model and settings UI.
- Implemented `harvest_in_next_week?` in PredictHarvest concern.
- Created `harvest_reminder` email with localized templates.
- Added `growstuff:send_harvest_reminders` Rake task to run weekly.
- Refactored existing and new reminder tasks to use `deliver_later` for scalability.
- Added unit tests for prediction logic and mailer.
- Fixed a bug in the existing planting reminder task where it was using an uninitialized constant `Notifier`.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Refactor Activity model to remove Elasticsearch integration
- Removed `SearchActivities` concern and Searchkick from `Activity` model.
- Implemented `Activity.homepage_records` using ActiveRecord with `DISTINCT ON` for PostgreSQL.
- Updated `ActivitiesController#index` to use ActiveRecord queries with eager loading and pagination.
- Added `active` scope to `Activity`.
- Added unit tests for `Activity` model.
- Deleted `app/models/concerns/search_activities.rb`.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Fix NoMethodError: undefined method 'reindex' for class Activity
- Removed all calls to `Activity.reindex` in migrations, rake tasks, and spec helpers.
- These were causing failures after the removal of Searchkick from the Activity model.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Fix ambiguous column id in homepage_records query
- Updated `Activity.homepage_records` to use `activities.id` instead of `id` in the subquery.
- This resolves the `PG::AmbiguousColumn: ERROR: column reference "id" is ambiguous` error.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Fix ambiguous created_at in homepage_records query
- Use `unscoped` in the subquery for `Activity.homepage_records` to bypass the default scope from `Ownable` concern.
- This prevents the join with the `members` table in the subquery, which was causing `PG::AmbiguousColumn: ERROR: column reference "created_at" is ambiguous`.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Complete refactoring of Activity model to remove Elasticsearch
- Removed SearchActivities concern and searchkick integration.
- Updated ActivitiesController#index to use ActiveRecord queries.
- Implemented performant Activity.homepage_records using DISTINCT ON (PostgreSQL).
- Added Activity.active scope.
- Added no-op Activity.reindex (class and instance methods) for backward compatibility.
- Cleaned up leftover reindex calls in rake tasks, migrations, and spec helpers.
- Added unit tests for new Activity model logic.
- Updated factories to include no-op reindex traits.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Less eager loading
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
- Update MemberFlickr concern to support tag-based search using flickr.photos.search
- Update PhotosController to handle the 'tag' parameter
- Add tag search input field to the 'New Photo' view
- Add test case to verify tag filtering in PhotosController spec
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
- Added Rails.cache.fetch to `sunniness` and `planted_from` actions.
- Refactored crop loading into a `before_action :set_crop`.
- Updated specs to verify caching behavior and ensure coverage.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Add members:cleanup_inactive rake task
This task identifies and deletes members who have not logged in for over
24 months and have no gardens, plantings, or other activity (posts,
comments, seeds, harvests, etc).
Includes support for DRY_RUN=true to preview deletions.
Added tests in spec/tasks/members_spec.rb.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Refactor activity check to Member#has_activity? and update rake task
- Added `Member#has_activity?` to encapsulate the check for gardens, plantings, and other activity.
- Updated `members:cleanup_inactive` rake task to use `Member#has_activity?`.
- Maintained `DRY_RUN` support and existing tests.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Apply suggestion from @CloCkWeRX
* Apply suggestions from code review
Co-authored-by: Daniel O'Connor <daniel.oconnor@gmail.com>
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
* Implement blocking feature
This commit introduces a blocking feature that allows members to block other members.
A blocked member is prevented from:
- following the blocker
- sending private messages to the blocker
- replying to the blocker's posts
- liking the blocker's content
The implementation includes:
- A new `Block` model and a corresponding database table.
- Updates to the `Member` model to include associations for blocks.
- A new `BlocksController` to handle blocking and unblocking actions.
- New routes for the `BlocksController`.
- UI changes to add block/unblock buttons to the member profile page.
- Validations in the `Follow`, `Comment`, and `Like` models to enforce the blocking rules.
- A check in the `MessagesController` to prevent sending messages to a member who has blocked the sender.
- A callback in the `Block` model to destroy the follow relationship when a block is created.
- New feature and model specs to test the blocking functionality.
* Implement blocking feature and fix failing tests
This commit introduces a blocking feature that allows members to block other members.
A blocked member is prevented from:
- following the blocker
- sending private messages to the blocker
- replying to the blocker's posts
- liking the blocker's content
The implementation includes:
- A new `Block` model and a corresponding database table.
- Updates to the `Member` model to include associations for blocks.
- A new `BlocksController` to handle blocking and unblocking actions.
- New routes for the `BlocksController`.
- UI changes to add block/unblock buttons to the member profile page.
- Validations in the `Follow`, `Comment`, and `Like` models to enforce the blocking rules.
- A check in the `MessagesController` to prevent sending messages to a member who has blocked the sender.
- A callback in the `Block` model to destroy the follow relationship when a block is created.
- New feature and model specs to test the blocking functionality.
This commit also fixes a failing test in the blocking feature. The error was caused by the validation being called even when the `member` association was `nil`. A guard has been added to the validation methods in the `Like`, `Follow`, and `Comment` models to prevent this from happening.
* Generate schema
* Fix tests
* Add permissions
* Define Block permissions in Ability model
The feature specs for member blocking were failing because the "Block"
link was not being rendered on member profiles. This was due to the
lack of explicit create and destroy permissions for the Block resource
in the Ability model, which is used by CanCanCan to authorize actions
and by the view to conditionally show links.
This change adds the necessary permissions to `member_abilities`:
- Allows members to create blocks (except for blocking themselves).
- Allows members to destroy blocks where they are the blocker.
These rules ensure that the "Block" and "Unblock" links are correctly
rendered and authorized for signed-in members.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Comment out specs for now
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: Daniel O'Connor <daniel.oconnor@gmail.com>
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Add comprehensive test coverage for forums
- Added `spec/controllers/forums_controller_spec.rb` to test all CRUD actions and authorization for guest, member, and admin roles.
- Added `spec/features/forums_spec.rb` to cover user-facing features such as browsing forums and creating posts from within a forum.
- Updated `spec/requests/forums_spec.rb` to cover basic request flow and JSON response formats.
Note: Tests were verified for content and logic but execution in the sandbox environment was blocked by missing infrastructure (PostgreSQL and Elasticsearch).
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Fix specs
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
- Move expectations from `before` hooks to `it` blocks.
- Ensure controller actions are called after expectations are set in controller specs.
- Replace synchronization expectations in hooks with Capybara `find` calls.
- Remove RSpec/ExpectInHook from .rubocop_todo.yml.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Fix RSpec/IndexedLet RuboCop issues in spec files
Replace indexed let variable names with descriptive names across 11 spec files.
This improves readability and complies with the RSpec/IndexedLet rule.
Co-authored-by: CloCkWeRX <365751+CloCkWeRX@users.noreply.github.com>
* Rubocop
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
