Merge pull request #4600 from Growstuff/dev

Release 85

.github/workflows/docker-build-push.yml

@@ -14,13 +14,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -28,12 +28,12 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ghcr.io/${{ github.repository }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: true

Gemfile

@@ -116,6 +116,8 @@ gem 'xmlrpc' # fixes rake error - can be removed if not needed later
 
 gem 'puma'
 
+gem 'rack-attack'
+
 gem 'loofah', '>= 2.19.1'
 gem 'rack-protection', '>= 2.0.1'
 

Gemfile.lock

@@ -498,11 +498,13 @@ GEM
       date
       stringio
     public_suffix (7.0.5)
-    puma (8.0.0)
+    puma (8.0.1)
       nio4r (~> 2.0)
     query_diet (0.7.3)
     racc (1.8.1)
     rack (2.2.23)
+    rack-attack (6.8.0)
+      rack (>= 1.0, < 4)
     rack-cors (2.0.2)
       rack (>= 2.0.0)
     rack-protection (3.2.0)
@@ -841,6 +843,7 @@ DEPENDENCIES
   pry
   puma
   query_diet
+  rack-attack
   rack-cors
   rack-protection (>= 2.0.1)
   rails (~> 7.2.0)

app/controllers/activities_controller.rb

@@ -7,9 +7,9 @@ class ActivitiesController < DataController
     where = {}
     where['active'] = true unless @show_all
 
-    if params[:member_slug]
-      @owner = Member.find_by(slug: params[:member_slug])
-      where['owner_id'] = @owner.id unless @owner.nil?
+    if params[:member_slug].present?
+      @owner = Member.find_by!(slug: params[:member_slug])
+      where['owner_id'] = @owner.id
     end
 
     @activities = Activity.search(

app/controllers/charts/crops_controller.rb

@@ -3,6 +3,7 @@
 module Charts
   class CropsController < ApplicationController
     respond_to :json
+    before_action :set_crop
 
     def sunniness
       pie_chart_query 'sunniness'
@@ -13,20 +14,28 @@ module Charts
     end
 
     def harvested_for
-      @crop = Crop.find_by!(slug: params[:crop_slug])
-      render json: Harvest.joins(:plant_part)
-        .where(crop: @crop)
-        .group("plant_parts.name").count(:id)
+      data = Rails.cache.fetch("#{@crop.cache_key_with_version}/harvested_for", expires_in: 1.day) do
+        Harvest.joins(:plant_part)
+          .where(crop: @crop)
+          .group("plant_parts.name").count(:id)
+      end
+      render json: data
     end
 
     private
 
-    def pie_chart_query(field)
+    def set_crop
       @crop = Crop.find_by!(slug: params[:crop_slug])
-      render json: Planting.where(crop: @crop)
-        .where.not(field.to_sym => nil)
-        .where.not(field.to_sym => '')
-        .group(field.to_sym).count(:id)
+    end
+
+    def pie_chart_query(field)
+      data = Rails.cache.fetch("#{@crop.cache_key_with_version}/#{field}", expires_in: 1.day) do
+        Planting.where(crop: @crop)
+          .where.not(field.to_sym => nil)
+          .where.not(field.to_sym => '')
+          .group(field.to_sym).count(:id)
+      end
+      render json: data
     end
   end
 end

app/controllers/gardens_controller.rb

@@ -2,7 +2,7 @@
 
 class GardensController < DataController
   def index
-    @owner = Member.find_by(slug: params[:member_slug])
+    @owner = Member.find_by!(slug: params[:member_slug]) if params[:member_slug].present?
     @show_all = params[:all] == '1'
     @show_jump_to = params[:member_slug].present? || false
 

app/controllers/harvests_controller.rb

@@ -5,8 +5,8 @@ class HarvestsController < DataController
 
   def index
     where = {}
-    if params[:member_slug]
-      @owner = Member.find_by(slug: params[:member_slug])
+    if params[:member_slug].present?
+      @owner = Member.find_by!(slug: params[:member_slug])
       where['owner_id'] = @owner.id
     end
 

app/controllers/photos_controller.rb

@@ -102,11 +102,12 @@ class PhotosController < ApplicationController
     end
 
     @current_set = params[:set]
+    @current_tag = params[:tag]
 
     page = params[:page] || 1
 
     @sets = current_member.flickr_sets
-    photos, total = current_member.flickr_photos(page, @current_set)
+    photos, total = current_member.flickr_photos(page, @current_set, @current_tag)
 
     @photos = WillPaginate::Collection.create(page, 30, total) do |pager|
       pager.replace photos
@@ -118,6 +119,8 @@ class PhotosController < ApplicationController
       { crops: @crop.id }
     elsif params[:planting_id]
       { planting_id: @planting.id }
+    elsif params[:planting_slug]
+      { plantings: @planting.id }
     else
       {}
     end
@@ -126,5 +129,6 @@ class PhotosController < ApplicationController
   def set_crop_and_planting
     @crop = Crop.find params[:crop_slug] if params[:crop_slug]
     @planting = Planting.find params[:planting_id] if params[:planting_id]
+    @planting ||= Planting.find params[:planting_slug] if params[:planting_slug]
   end
 end

app/controllers/plantings_controller.rb

@@ -11,9 +11,9 @@ class PlantingsController < DataController
     where = {}
     where['active'] = true unless @show_all
 
-    if params[:member_slug]
-      @owner = Member.find_by(slug: params[:member_slug])
-      where['owner_id'] = @owner.id unless @owner.nil?
+    if params[:member_slug].present?
+      @owner = Member.find_by!(slug: params[:member_slug])
+      where['owner_id'] = @owner.id
     end
 
     if params[:crop_slug]
@@ -160,7 +160,7 @@ class PlantingsController < DataController
   end
 
   def matching_seeds
-    Seed.where(crop: @planting.crop, owner: @planting.owner)
+    @matching_seeds ||= Seed.where(crop: @planting.crop, owner: @planting.owner)
       .where('(finished_at IS NULL OR finished_at >= ?)', @planting.planted_at)
       .where('(saved_at IS NULL OR saved_at <= ?)', @planting.planted_at)
   end

app/controllers/posts_controller.rb

@@ -8,7 +8,7 @@ class PostsController < ApplicationController
   respond_to :rss, only: %i(index show)
 
   def index
-    @author = Member.find_by(slug: params[:member_slug])
+    @author = Member.find_by!(slug: params[:member_slug]) if params[:member_slug].present?
     @posts = posts
     respond_with(@posts)
   end

app/controllers/seeds_controller.rb

@@ -5,7 +5,7 @@ class SeedsController < DataController
     where = {}
 
     if params[:member_slug].present?
-      @owner = Member.find_by(slug: params[:member_slug])
+      @owner = Member.find_by!(slug: params[:member_slug])
       where['owner_id'] = @owner.id
     end
 

app/helpers/crops_helper.rb

@@ -2,28 +2,47 @@
 
 module CropsHelper
   def crop_or_parent(crop, attribute)
-    default = crop.send(attribute)
-    return default if default.present?
+    @crop_or_parent_cache ||= {}
+    cache_key = [crop.persisted? ? crop.id : crop.object_id, attribute]
+    return @crop_or_parent_cache[cache_key] if @crop_or_parent_cache.key?(cache_key)
 
-    parent = crop
-    while parent = parent.parent
-      return parent.send(attribute) if parent&.send(attribute).present?
+    @crop_or_parent_cache[cache_key] = begin
+      value = crop.send(attribute)
+      if value.blank?
+        parent = crop
+        while (parent = parent.parent)
+          parent_value = parent.send(attribute)
+          if parent_value.present?
+            value = parent_value
+            break
+          end
+        end
+      end
+      value
     end
-
-    # For scopes, arrays, etc return the empty value
-    default
   end
 
   def display_seed_availability(member, crop)
-    seeds = member.seeds.where(crop:)
-    total_quantity = seeds.where.not(quantity: nil).sum(:quantity)
+    @seed_availability_cache ||= {}
+    cache_key = [
+      member.persisted? ? member.id : member.object_id,
+      crop.persisted? ? crop.id : crop.object_id
+    ]
+    return @seed_availability_cache[cache_key] if @seed_availability_cache.key?(cache_key)
 
-    return "You don't have any seeds of this crop." if seeds.none?
+    @seed_availability_cache[cache_key] = begin
+      seeds = member.seeds.where(crop:)
 
-    if total_quantity == 0
-      "You have an unknown quantity of seeds of this crop."
-    else
-      "You have #{total_quantity} #{Seed.model_name.human(count: total_quantity)} of this crop."
+      if seeds.none?
+        "You don't have any seeds of this crop."
+      else
+        total_quantity = seeds.where.not(quantity: nil).sum(:quantity)
+        if total_quantity == 0
+          "You have an unknown quantity of seeds of this crop."
+        else
+          "You have #{total_quantity} #{Seed.model_name.human(count: total_quantity)} of this crop."
+        end
+      end
     end
   end
 
@@ -40,53 +59,57 @@ module CropsHelper
   end
 
   def crop_jsonld_data(crop, full_attributes: true)
-    same_as_urls = [crop.en_wikipedia_url]
-    crop.scientific_names.each do |scientific_name|
-      same_as_urls << "https://www.wikidata.org/wiki/#{scientific_name.wikidata_id}" if scientific_name.wikidata_id.present?
-    end
-
-    subject_of_entities = []
-    if full_attributes
-      if crop.en_youtube_url.present?
-        subject_of_entities << {
-          '@type': "VideoObject",
-          url:     crop.en_youtube_url
-        }
-      end
-
-      crop.posts.each do |post|
-        subject_of_entities << {
-          '@type': "SocialMediaPosting",
-          url:     post_url(post),
-          author:  {
-            '@type': 'Person',
-            name: post.author.login_name
-          },
-          datePublished: post.created_at
-        }
+    Rails.cache.fetch([crop.cache_key_with_version, "jsonld", full_attributes]) do
+      same_as_urls = [crop.en_wikipedia_url]
+      crop.scientific_names.each do |scientific_name|
+        if scientific_name.wikidata_id.present?
+          same_as_urls << "https://www.wikidata.org/wiki/#{scientific_name.wikidata_id}"
+        end
       end
 
+      subject_of_entities = []
       images = []
-      crop.photos.each do |photo|
-        images << photo.fullsize_url
+      if full_attributes
+        if crop.en_youtube_url.present?
+          subject_of_entities << {
+            '@type': "VideoObject",
+            url:     crop.en_youtube_url
+          }
+        end
+
+        crop.posts.each do |post|
+          subject_of_entities << {
+            '@type': "SocialMediaPosting",
+            url:     post_url(post),
+            author:  {
+              '@type': 'Person',
+              name:    post.author.login_name
+            },
+            datePublished: post.created_at
+          }
+        end
+
+        crop.photos.each do |photo|
+          images << photo.fullsize_url
+        end
       end
+
+      # TODO: Review plantings, seeds, harvests as a subtype of social media post or event that ended? Or creative work?
+      # has_many :plantings, dependent: :destroy
+      # has_many :seeds, dependent: :destroy
+      # has_many :harvests, dependent: :destroy
+
+      {
+        '@context':     "https://schema.org",
+        '@type':        "BioChemEntity",
+        name:           crop.name,
+        taxonomicRange: crop.scientific_names.map(&:name),
+        description:    crop.description,
+        sameAs:         same_as_urls,
+        alternateName:  crop.alternate_names.map(&:name),
+        subjectOf:      subject_of_entities,
+        image:          images
+      }.compact
     end
-
-    # TODO: Review plantings, seeds, harvests as a subtype of social media post or event that ended? Or creative work?
-    # has_many :plantings, dependent: :destroy
-    # has_many :seeds, dependent: :destroy
-    # has_many :harvests, dependent: :destroy
-
-    {
-      '@context':     "https://schema.org",
-      '@type':        "BioChemEntity",
-      name:           crop.name,
-      taxonomicRange: crop.scientific_names.map(&:name),
-      description:    crop.description,
-      sameAs:         same_as_urls,
-      alternateName:  crop.alternate_names.map(&:name),
-      subjectOf:      subject_of_entities,
-      image:          images
-    }.compact
   end
 end

app/helpers/plantings_helper.rb

@@ -46,9 +46,13 @@ module PlantingsHelper
   # Returns a list of gardens the planting can be transplanted to
   # based on the planting's owner.
   def transplantable_gardens_by_owner(planting)
-    garden_ids = planting.owner.gardens.select(:id).to_a + GardenCollaborator.where(member_id: planting.owner.id).select(:garden_id).to_a
+    @transplantable_gardens ||= {}
+    cache_key = planting.id || planting.object_id
+    @transplantable_gardens[cache_key] ||= begin
+      garden_ids = planting.owner.gardens.select(:id).to_a + GardenCollaborator.where(member_id: planting.owner.id).select(:garden_id).to_a
 
-    Garden.active.where.not(id: planting.garden_id).where(id: garden_ids)
+      Garden.active.where.not(id: planting.garden_id).where(id: garden_ids)
+    end
   end
 
   def days_from_now_to_last_harvest(planting)

app/models/concerns/member_flickr.rb

@@ -40,8 +40,15 @@ module MemberFlickr
     # Fetches a collection of photos from Flickr
     # Returns a [[page of photos], total] pair.
     # Total is needed for pagination.
-    def flickr_photos(page_num = 1, set = nil)
-      result = if set
+    def flickr_photos(page_num = 1, set = nil, tags = nil)
+      result = if tags.present?
+                 flickr.photos.search(
+                   user_id:  'me',
+                   tags:     tags,
+                   page:     page_num,
+                   per_page: 30
+                 )
+               elsif set.present?
                  flickr.photosets.getPhotos(
                    photoset_id: set,
                    page:        page_num,

app/models/concerns/predict_harvest.rb

@@ -6,23 +6,31 @@ module PredictHarvest
   included do
     # dates
     def first_harvest_date
-      harvests_with_dates.minimum(:harvested_at)
+      return @first_harvest_date if defined?(@first_harvest_date)
+
+      @first_harvest_date = harvests_with_dates.minimum(:harvested_at)
     end
 
     def last_harvest_date
-      harvests_with_dates.maximum(:harvested_at)
+      return @last_harvest_date if defined?(@last_harvest_date)
+
+      @last_harvest_date = harvests_with_dates.maximum(:harvested_at)
     end
 
     def first_harvest_predicted_at
-      return unless crop.median_days_to_first_harvest.present? && planted_at.present?
+      return @first_harvest_predicted_at if defined?(@first_harvest_predicted_at)
 
-      planted_at + crop.median_days_to_first_harvest.days
+      @first_harvest_predicted_at = if crop.median_days_to_first_harvest.present? && planted_at.present?
+                                      planted_at + crop.median_days_to_first_harvest.days
+                                    end
     end
 
     def last_harvest_predicted_at
-      return unless crop.median_days_to_last_harvest.present? && planted_at.present?
+      return @last_harvest_predicted_at if defined?(@last_harvest_predicted_at)
 
-      planted_at + crop.median_days_to_last_harvest.days
+      @last_harvest_predicted_at = if crop.median_days_to_last_harvest.present? && planted_at.present?
+                                     planted_at + crop.median_days_to_last_harvest.days
+                                   end
     end
 
     # actions
@@ -65,16 +73,18 @@ module PredictHarvest
     end
 
     def neighbours_for_harvest_predictions
-      # use this planting's harvest if any
-      return harvests if harvests.size.positive?
-
-      # otherwise use nearby plantings
-      if location
-        return Harvest.where(planting: nearby_same_crop.has_harvests)
-            .where.not(planting_id: nil)
+      @neighbours_for_harvest_predictions ||= begin
+        # use this planting's harvest if any
+        if harvests.size.positive?
+          harvests
+        # otherwise use nearby plantings
+        elsif location
+          Harvest.where(planting: nearby_same_crop.has_harvests)
+              .where.not(planting_id: nil)
+        else
+          Harvest.none
+        end
       end
-
-      Harvest.none
     end
 
     private

app/models/concerns/predict_planting.rb

@@ -13,40 +13,49 @@ module PredictPlanting
 
     # dates
     def finish_predicted_at
-      if planted_at.blank? || failed?
-        nil
-      elsif crop.median_lifespan.present?
-        planted_at + crop.median_lifespan.days
-      elsif crop.parent.present? && crop.parent.median_lifespan.present?
-        planted_at + crop.parent.median_lifespan.days
-      end
+      return @finish_predicted_at if defined?(@finish_predicted_at)
+
+      @finish_predicted_at = if planted_at.blank? || failed?
+                               nil
+                             elsif crop.median_lifespan.present?
+                               planted_at + crop.median_lifespan.days
+                             elsif crop.parent.present? && crop.parent.median_lifespan.present?
+                               planted_at + crop.parent.median_lifespan.days
+                             end
     end
 
     # days
     def expected_lifespan
-      if actual_lifespan.present?
-        actual_lifespan
-      elsif crop.median_lifespan.present?
-        crop.median_lifespan
-      elsif crop.parent.present? && crop.parent.median_lifespan.present?
-        crop.parent.median_lifespan
-      end
+      return @expected_lifespan if defined?(@expected_lifespan)
+
+      @expected_lifespan = if actual_lifespan.present?
+                             actual_lifespan
+                           elsif crop.median_lifespan.present?
+                             crop.median_lifespan
+                           elsif crop.parent.present? && crop.parent.median_lifespan.present?
+                             crop.parent.median_lifespan
+                           end
     end
 
     def actual_lifespan
-      return unless planted_at.present? && finished_at.present? && !failed?
+      return @actual_lifespan if defined?(@actual_lifespan)
 
-      (finished_at - planted_at).to_i
+      @actual_lifespan = if planted_at.present? && finished_at.present? && !failed?
+                           (finished_at - planted_at).to_i
+                         end
     end
 
     def age_in_days
-      return if planted_at.blank?
-      return if failed?
+      return @age_in_days if defined?(@age_in_days)
 
-      known_last_day ||= finished_at || Time.zone.today
-      known_last_day = Time.zone.today if known_last_day > Time.zone.today
+      @age_in_days = if planted_at.blank? || failed?
+                       nil
+                     else
+                       known_last_day = finished_at || Time.zone.today
+                       known_last_day = Time.zone.today if known_last_day > Time.zone.today
 
-      (known_last_day - planted_at).to_i
+                       (known_last_day - planted_at).to_i
+                     end
     end
 
     def percentage_grown

app/models/harvest.rb

@@ -109,37 +109,49 @@ class Harvest < ApplicationRecord
   def to_s
     # 50 individual apples, weighing 3lb
     # 2 buckets of apricots, weighing 10kg
-    "#{quantity_to_human} #{unit_to_human} #{crop_name_to_human} #{weight_to_human}".strip
+    @to_s ||= "#{quantity_to_human} #{unit_to_human} #{crop_name_to_human} #{weight_to_human}".strip
   end
 
   def quantity_to_human
-    return number_to_human(quantity.to_s, strip_insignificant_zeros: true) if quantity
-
-    ""
+    @quantity_to_human ||= if quantity
+                             number_to_human(quantity.to_s, strip_insignificant_zeros: true)
+                           else
+                             ""
+                           end
   end
 
   def unit_to_human
-    return "" unless quantity && unit
-    return 'individual' if unit == 'individual'
-    return "#{unit} of" if quantity == 1
-
-    "#{unit.pluralize} of"
+    @unit_to_human ||= begin
+      if !quantity || !unit
+        ""
+      elsif unit == 'individual'
+        'individual'
+      elsif quantity == 1
+        "#{unit} of"
+      else
+        "#{unit.pluralize} of"
+      end
+    end
   end
 
   def weight_to_human
-    return "" unless weight_quantity
-
-    "weighing #{number_to_human(weight_quantity, strip_insignificant_zeros: true)} #{weight_unit}"
+    @weight_to_human ||= if weight_quantity
+                           "weighing #{number_to_human(weight_quantity, strip_insignificant_zeros: true)} #{weight_unit}"
+                         else
+                           ""
+                         end
   end
 
   def crop_name_to_human
-    if unit != 'individual' # buckets of apricot*s*
-      crop.name.pluralize
-    elsif quantity == 1
-      crop.name
-    else
-      crop.name.pluralize
-    end.to_s
+    @crop_name_to_human ||= begin
+      if unit != 'individual' # buckets of apricot*s*
+        crop.name.pluralize
+      elsif quantity == 1
+        crop.name
+      else
+        crop.name.pluralize
+      end.to_s
+    end
   end
 
   private

app/models/member.rb

@@ -196,4 +196,25 @@ class Member < ApplicationRecord
   def get_block(member)
     blocks.find_by(blocked_id: member.id) if already_blocking?(member)
   end
+
+  def has_activity?
+    (gardens.exists? && gardens.count > 1) ||
+      plantings.exists? ||
+      harvests.exists? ||
+      seeds.exists? ||
+      photos.exists? ||
+      forums.exists? ||
+      activities.exists? ||
+      posts.exists? ||
+      comments.exists? ||
+      requested_crops.exists? ||
+      created_crops.exists? ||
+      likes.exists? ||
+      created_alternate_names.exists? ||
+      created_scientific_names.exists? ||
+      follows.exists? ||
+      inverse_follows.exists? ||
+      blocks.exists? ||
+      inverse_blocks.exists?
+  end
 end

app/models/planting.rb

@@ -119,14 +119,18 @@ class Planting < ApplicationRecord
   end
 
   def nearby_same_crop
-    return Planting.none if location.blank? || latitude.blank? || longitude.blank?
+    return @nearby_same_crop if defined?(@nearby_same_crop)
 
-    # latitude, longitude = Geocoder.coordinates(location, params: { limit: 1 })
-    Planting.joins(:garden)
-      .where(crop:)
-      .located
-      .where('gardens.latitude < ? AND gardens.latitude > ?',
-             latitude + 10, latitude - 10)
+    @nearby_same_crop = if location.blank? || latitude.blank? || longitude.blank?
+                          Planting.none
+                        else
+                          # latitude, longitude = Geocoder.coordinates(location, params: { limit: 1 })
+                          Planting.joins(:garden)
+                            .where(crop:)
+                            .located
+                            .where('gardens.latitude < ? AND gardens.latitude > ?',
+                                   latitude + 10, latitude - 10)
+                        end
   end
 
   private

app/views/activities/index.html.haml

@@ -3,7 +3,7 @@
 - content_for :breadcrumbs do
   - if @owner
     %li.breadcrumb-item= link_to 'Activities', activities_path
-    %li.breadcrumb-item.active= link_to "#{@owner}'s activities", activities_path(owner: @owner)
+    %li.breadcrumb-item.active= link_to "#{@owner}'s activities", member_activities_path(@owner)
   - else
     %li.breadcrumb-item.active= link_to 'Activities', activities_path
 

app/views/alternate_names/_form.html.haml

@@ -22,8 +22,8 @@
       .form-group
         = f.label :crop_id, class: 'control-label col-md-2'
         .col-md-8
-          = collection_select(:alternate_name, :crop_id,
-                              Crop.all, :id, :name,
+          = select(:alternate_name, :crop_id,
+                              Crop.order(:name).pluck(:name, :id),
                               { selected: @alternate_name.crop_id || @crop.id },
                               class: 'form-control')
 

app/views/crops/_form.html.haml

@@ -85,7 +85,7 @@
 
       -# Only crop wranglers see the crop hierarchy (for now)
       - if can? :wrangle, @crop
-        = f.collection_select(:parent_id, Crop.all.order(:name), :id, :name,
+        = f.select(:parent_id, Crop.order(:name).pluck(:name, :id),
           { include_blank: true, label: 'Parent crop'})
         %span.help-block Optional. For setting up crop hierarchies for varieties etc.
 

app/views/crops/_harvests.html.haml

@@ -5,14 +5,15 @@
       %p Nobody has harvested this crop yet.
   - unless crop.harvests.empty?
     %ul.list-group.list-group-flush
-      - Harvest.where(crop: crop).includes(:owner).order(harvested_at: :desc).limit(3).each do |harvest|
-        %li.list-group-item
-          = link_to harvest_path(harvest), class: 'card-link' do
-            = harvest_icon
-            #{harvest.owner} harvested #{display_quantity(harvest)}.
-          .float-right= render 'members/location', member: harvest.owner
-          .harvest-timeago
-            %small #{standard_time_distance(harvest.harvested_at, Time.zone.now.to_date)}
+      - Rails.cache.fetch([crop, "recent_harvests", Time.zone.today]) do
+        - Harvest.where(crop: crop).includes(:owner).order(harvested_at: :desc).limit(3).each do |harvest|
+          %li.list-group-item
+            = link_to harvest_path(harvest), class: 'card-link' do
+              = harvest_icon
+              #{harvest.owner} harvested #{display_quantity(harvest)}.
+            .float-right= render 'members/location', member: harvest.owner
+            .harvest-timeago
+              %small #{standard_time_distance(harvest.harvested_at, Time.zone.now.to_date)}
       %li.list-group-item= link_to "View all #{crop.name} harvests", crop_harvests_path(crop), class: 'card-link'
       - if crop.approved?
         - if current_member

app/views/crops/show.html.haml

@@ -73,10 +73,11 @@
               = pie_chart crop_harvested_for_path(@crop, format: :json), legend: "bottom"
 
     - if @crop.varieties.any?
-      %section.varieties
-        %h2 Varieties
-        .index-cards
-          = render 'varieties', crop: @crop
+      - cache [@crop, 'varieties'] do
+        %section.varieties
+          %h2 Varieties
+          .index-cards
+            = render 'varieties', crop: @crop
 
     %section.crop-map
       %h2
@@ -134,9 +135,11 @@
     = render 'harvests', crop: @crop
     = render 'find_seeds', crop: @crop
 
-    = render 'openfarm_data', crop: @crop
+    - cache [@crop, 'openfarm_data'] do
+      = render 'openfarm_data', crop: @crop
 
-    = render 'nutritional_data', crop: @crop
+    - cache [@crop, 'nutritional_data'] do
+      = render 'nutritional_data', crop: @crop
 
     = cute_icon
     .card

app/views/harvests/_popover.html.haml

@@ -1,3 +1,4 @@
-%p
-  %small
-    = harvest.harvested_at
+- cache harvest do
+  %p
+    %small
+      = harvest.harvested_at

app/views/harvests/index.html.haml

@@ -4,7 +4,7 @@
 - content_for :breadcrumbs do
   - if @owner
     %li.breadcrumb-item= link_to 'Harvests', harvests_path
-    %li.breadcrumb-item.active= link_to "#{@owner}'s harvests", harvests_path(owner: @owner)
+    %li.breadcrumb-item.active= link_to "#{@owner}'s harvests", member_harvests_path(@owner)
   - else
     %li.breadcrumb-item.active= link_to "Harvests", harvests_path
 .row

app/views/photos/new.html.haml

@@ -21,13 +21,14 @@
     Please select a photo from your recent uploads.
 
 
-  - if @sets && !@sets.empty?
-    %p
-      = bootstrap_form_tag(url: new_photo_path, method: :get, layout: :inline) do |f|
-        = f.select :set, options_for_select(@sets, @current_set), label: "Choose a photo album"
-        = hidden_field_tag :type, @type
-        = hidden_field_tag :id, @id
-        = f.submit "Search", class: "btn btn-success"
+  %p
+    = bootstrap_form_tag(url: new_photo_path, method: :get, layout: :inline) do |f|
+      - if @sets && !@sets.empty?
+        = f.select :set, options_for_select(@sets, @current_set), label: "Choose a photo album", include_blank: true
+      = f.text_field :tag, value: @current_tag, label: "or search by tag"
+      = hidden_field_tag :type, @type
+      = hidden_field_tag :id, @id
+      = f.submit "Search", class: "btn btn-success"
 
   - if @sets && @current_set
     %h2= @sets.key(@current_set)

app/views/plantings/index.html.haml

@@ -4,7 +4,7 @@
 - content_for :breadcrumbs do
   - if @owner
     %li.breadcrumb-item= link_to 'Plantings', plantings_path
-    %li.breadcrumb-item.active= link_to "#{@owner}'s plantings", plantings_path(owner: @owner)
+    %li.breadcrumb-item.active= link_to "#{@owner}'s plantings", member_plantings_path(@owner)
   - else
     %li.breadcrumb-item.active= link_to 'Plantings', plantings_path
 

app/views/scientific_names/_form.html.haml

@@ -17,8 +17,8 @@
   .form-group
     = f.label :crop_id, class: 'control-label col-md-2'
     .col-md-8
-      = collection_select(:scientific_name, :crop_id, Crop.all.order(:name), :id,
-        :name, { selected: @scientific_name.crop_id || @crop.id },
+      = select(:scientific_name, :crop_id, Crop.order(:name).pluck(:name, :id),
+        { selected: @scientific_name.crop_id || @crop.id },
         class: 'form-control')
   .form-group
     = f.label :name, class: 'control-label col-md-2'

app/views/seeds/index.html.haml

@@ -1,7 +1,7 @@
 - content_for :breadcrumbs do
   - if @owner
     %li.breadcrumb-item= link_to 'Seeds', seeds_path
-    %li.breadcrumb-item.active= link_to "#{@owner}'s seeds", seeds_path(owner: @owner)
+    %li.breadcrumb-item.active= link_to "#{@owner}'s seeds", member_seeds_path(@owner)
   - else
     %li.breadcrumb-item.active= link_to 'Seeds', seeds_path
 

config/application.rb

@@ -73,6 +73,8 @@ module Growstuff
     config.newsletter_list_id = ENV.fetch('GROWSTUFF_MAILCHIMP_NEWSLETTER_ID', nil)
 
     # config.active_record.raise_in_transactional_callbacks = true
+    config.middleware.insert_before 0, Rack::Attack
+
     config.middleware.insert_before 0, Rack::Cors do
       allow do
         origins '*'

config/initializers/rack_attack.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+class Rack::Attack
+  ### Throttle Config ###
+
+  if Rails.env.production?
+    # Throttle requests to /plantings, /harvests, and /members to 10 per minute per IP
+    # Includes API routes
+    throttle('req/ip/restricted_routes', limit: 20, period: 1.minute) do |req|
+      if req.path =~ %r{^/(plantings|harvests|members)(/|$)} || req.path =~ %r{^/api/v1/(plantings|harvests|members)(/|$)}
+        req.ip
+      end
+    end
+
+    ### Fail2Ban Config ###
+
+    # Block IPs that make too many requests to suspicious paths
+    # After 5 "bad" requests in 10 minutes, block the IP for 1 hour
+    blocklist('fail2ban/pentesters') do |req|
+      Fail2Ban.filter("pentesters-#{req.ip}", maxretry: 5, findtime: 10.minutes, bantime: 1.hour) do
+        # The count for the IP is incremented if the return value is truthy.
+        req.path.include?('wp-admin') ||
+          req.path.include?('wp-login') ||
+          req.path.include?('cgi-bin') ||
+          req.path.end_with?('.php', '.asp', '.aspx', '.jsp', '.exe', '.env', '.git')
+      end
+    end
+  end
+
+  ### Custom Response Headers ###
+
+  # Add Retry-After header to throttled responses
+  self.throttled_response_retry_after_header = true
+end

lib/tasks/members.rake

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+namespace :members do
+  desc "Remove inactive members with no activity and last login > 24 months ago"
+  # usage: rake members:cleanup_inactive
+  # usage: DRY_RUN=true rake members:cleanup_inactive
+  task cleanup_inactive: :environment do
+    limit_date = 3.years.ago
+    dry_run = ENV.fetch('DRY_RUN', 'false') == 'true'
+
+    inactive_members = Member.where("last_sign_in_at < ? OR (last_sign_in_at IS NULL AND created_at < ?)", limit_date, limit_date)
+
+    count = 0
+    inactive_members.find_each do |member|
+      # Check for activity using the model method
+      unless member.has_activity?
+        if dry_run
+          puts "[DRY RUN] Would delete inactive member: #{member.login_name} (ID: #{member.id}, Last login: #{member.last_sign_in_at || 'Never'}, Created: #{member.created_at})"
+        else
+          puts "Deleting inactive member: #{member.login_name} (ID: #{member.id}, Last login: #{member.last_sign_in_at || 'Never'}, Created: #{member.created_at})"
+          member.destroy
+        end
+        count += 1
+      end
+    end
+
+    if dry_run
+      puts "Total inactive members that would be deleted: #{count}"
+    else
+      puts "Total inactive members deleted: #{count}"
+    end
+  end
+end

public/robots.txt

@@ -123,13 +123,27 @@ Disallow: /
 User-agent: WebReaper
 Disallow: /
 
-# Per their statement, semrushbot respects crawl-delay directives
-# We want them to overall stay within reasonable request rates to
-# the backend (20 rps); keeping in mind that the crawl-delay will 
-# be applied by site and not globally by the bot, 5 seconds seem
-# like a reasonable approximation
+# Semrush seem to crawl everything.
 User-agent: SemrushBot
-Crawl-delay: 5
+Disallow: /
+ 
+User-agent: SiteAuditBot
+Disallow: /
+ 
+User-agent: SemrushBot-BA
+Disallow: /
+ 
+User-agent: SemrushBot-SI
+Disallow: /
+ 
+User-agent: SemrushBot-SWA
+Disallow: /
+ 
+User-agent: SplitSignalBot
+Disallow: /
+ 
+User-agent: SemrushBot-OCOB
+Disallow: /
 
 #
 # Friendly, low-speed bots are welcome viewing pages, but not

spec/controllers/charts/crops_controller_spec.rb

@@ -7,21 +7,42 @@ describe Charts::CropsController do
     let(:crop) { create(:crop) }
 
     describe 'sunniness' do
-      before { get :sunniness, params: { crop_slug: crop.to_param } }
+      it "returns a successful response" do
+        get :sunniness, params: { crop_slug: crop.to_param }
+        expect(response).to be_successful
+      end
 
-      it { expect(response).to be_successful }
+      it "caches the result" do
+        cache_key = "#{crop.cache_key_with_version}/sunniness"
+        expect(Rails.cache).to receive(:fetch).with(cache_key, expires_in: 1.day).and_call_original
+        get :sunniness, params: { crop_slug: crop.to_param }
+      end
     end
 
     describe 'planted_from' do
-      before { get :planted_from, params: { crop_slug: crop.to_param } }
+      it "returns a successful response" do
+        get :planted_from, params: { crop_slug: crop.to_param }
+        expect(response).to be_successful
+      end
 
-      it { expect(response).to be_successful }
+      it "caches the result" do
+        cache_key = "#{crop.cache_key_with_version}/planted_from"
+        expect(Rails.cache).to receive(:fetch).with(cache_key, expires_in: 1.day).and_call_original
+        get :planted_from, params: { crop_slug: crop.to_param }
+      end
     end
 
     describe 'harvested_for' do
-      before { get :harvested_for, params: { crop_slug: crop.to_param } }
+      it "returns a successful response" do
+        get :harvested_for, params: { crop_slug: crop.to_param }
+        expect(response).to be_successful
+      end
 
-      it { expect(response).to be_successful }
+      it "caches the result" do
+        cache_key = "#{crop.cache_key_with_version}/harvested_for"
+        expect(Rails.cache).to receive(:fetch).with(cache_key, expires_in: 1.day).and_call_original
+        get :harvested_for, params: { crop_slug: crop.to_param }
+      end
     end
   end
 end

spec/controllers/photos_controller_spec.rb

@@ -60,6 +60,7 @@ describe PhotosController, :search do
       sign_in member
       member.stub(:flickr_photos) { [[], 0] }
       member.stub(:flickr_sets) { { "foo" => "bar" } }
+      member.stub(:flickr_auth_valid?) { true }
       controller.stub(:current_member) { member }
     end
 
@@ -85,6 +86,16 @@ describe PhotosController, :search do
       it { expect(assigns(:item)).to eq garden }
       it { expect(flash[:alert]).not_to be_present }
     end
+
+    describe "filtering by tag" do
+      let(:tag) { "tomato" }
+
+      it "passes the tag to flickr_photos" do
+        expect(member).to receive(:flickr_photos).with(anything, nil, tag).and_return([[], 0])
+        get :new, params: { type: "planting", id: planting.id, tag: tag }
+        expect(assigns(:current_tag)).to eq tag
+      end
+    end
   end
 
   describe "POST create" do

spec/tasks/members_spec.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+require 'rake'
+
+describe 'members:cleanup_inactive' do
+  before :all do
+    Rails.application.load_tasks
+  end
+
+  let(:cleanup_task) { Rake::Task['members:cleanup_inactive'] }
+
+  before do
+    cleanup_task.reenable
+  end
+
+  it "deletes inactive members with no gardens and no other activity" do
+    inactive_no_activity = create(:member, last_sign_in_at: 25.months.ago)
+
+    # We must explicitly remove the default garden to test the "no gardens" condition
+    inactive_no_activity.gardens.destroy_all
+    expect(inactive_no_activity.gardens.count).to eq(0)
+
+    cleanup_task.invoke
+
+    expect(Member.exists?(inactive_no_activity.id)).to be_falsey
+  end
+
+  it "does not delete inactive members with a garden (even if empty)" do
+    inactive_with_garden = create(:member, last_sign_in_at: 25.months.ago)
+    # They have 1 default garden
+    expect(inactive_with_garden.gardens.count).to eq(1)
+
+    cleanup_task.invoke
+
+    expect(Member.exists?(inactive_with_garden.id)).to be_truthy
+  end
+
+  it "does not delete members with recent login" do
+    recent_member = create(:member, last_sign_in_at: 1.month.ago)
+    recent_member.gardens.destroy_all
+
+    cleanup_task.invoke
+
+    expect(Member.exists?(recent_member.id)).to be_truthy
+  end
+
+  it "does not delete inactive members with activity (posts)" do
+    inactive_with_post = create(:member, last_sign_in_at: 25.months.ago)
+    inactive_with_post.gardens.destroy_all
+    create(:post, author: inactive_with_post)
+
+    cleanup_task.invoke
+
+    expect(Member.exists?(inactive_with_post.id)).to be_truthy
+  end
+
+  it "honors DRY_RUN environment variable" do
+    inactive_no_activity = create(:member, last_sign_in_at: 25.months.ago)
+    inactive_no_activity.gardens.destroy_all
+
+    ENV['DRY_RUN'] = 'true'
+    cleanup_task.invoke
+    ENV['DRY_RUN'] = nil
+
+    expect(Member.exists?(inactive_no_activity.id)).to be_truthy
+  end
+end