<%= link_to "Edit", edit_container_contest_description_path([@container, @contest_description]) %> |
diff --git a/app/views/contest_instances/show.html.erb b/app/views/contest_instances/show.html.erb
index de8302ea..8dca995f 100644
--- a/app/views/contest_instances/show.html.erb
+++ b/app/views/contest_instances/show.html.erb
@@ -42,7 +42,9 @@
-
<%= render @contest_instance %>
+
+ <%= render partial: 'contest_instance', locals: { contest_instance: @contest_instance } %>
+
<%= render "contest_instance_entries", entries: @contest_instance_entries %>
<%= render "manage_judges", contest_instance: @contest_instance %>
<%= render "judging_results" %>
diff --git a/app/views/entries/show.html.erb b/app/views/entries/show.html.erb
index 046de53f..a37976ce 100644
--- a/app/views/entries/show.html.erb
+++ b/app/views/entries/show.html.erb
@@ -1,6 +1,6 @@
<%= notice %>
-<%= render @entry %>
+<%= render partial: 'entry', locals: { entry: @entry } %>
<%= link_to "Return to Dashboard", applicant_dashboard_path, class: "link_to" %>
diff --git a/app/views/shared/unauthorized.html.erb b/app/views/shared/unauthorized.html.erb
new file mode 100644
index 00000000..83a97201
--- /dev/null
+++ b/app/views/shared/unauthorized.html.erb
@@ -0,0 +1,8 @@
+
+
+ <%= flash.now[:alert] %>
+
+
+ <%= link_to "Back to Dashboard", applicant_dashboard_path, class: "btn btn-primary" %>
+
+
diff --git a/app/views/user_roles/show.html.erb b/app/views/user_roles/show.html.erb
index fbdcdf3a..1174019a 100644
--- a/app/views/user_roles/show.html.erb
+++ b/app/views/user_roles/show.html.erb
@@ -1,6 +1,6 @@
<%= notice %>
-<%= render @user_role %>
+<%= render partial: 'user_role', locals: { user_role: @user_role } %>
<%= link_to "Edit", edit_user_role_path(@user_role) %> |
diff --git a/config/database.test.yml b/config/database.test.yml
new file mode 100644
index 00000000..2b5d5a2d
--- /dev/null
+++ b/config/database.test.yml
@@ -0,0 +1,12 @@
+default: &default
+ adapter: mysql2
+ encoding: utf8mb4
+ collation: utf8mb4_unicode_ci
+ pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %>
+ username: <%= ENV.fetch("DATABASE_USERNAME") { "root" } %>
+ password: <%= ENV.fetch("LOCAL_MYSQL_DATABASE_PASSWORD") { "" } %>
+ port: 3306
+
+test:
+ <<: *default
+ database: lsa_evaluate_test
diff --git a/config/database.yml b/config/database.yml
index f82e2e44..ad9b4f22 100644
--- a/config/database.yml
+++ b/config/database.yml
@@ -1,11 +1,10 @@
-
default: &default
adapter: mysql2
encoding: utf8mb4
collation: utf8mb4_unicode_ci
pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %>
- username: root
- password: <%= ENV['LOCAL_MYSQL_DATABASE_PASSWORD'] %>
+ username: <%= ENV.fetch("DATABASE_USERNAME") { "root" } %>
+ password: <%= ENV.fetch("LOCAL_MYSQL_DATABASE_PASSWORD") { "" } %>
port: 3306
development:
@@ -26,7 +25,6 @@ staging:
production:
<<: *default
- # url: <%= ENV["DATABASE_URL"] %>
database: evaluate_db_prod
username: <%= Rails.application.credentials.mysql[:prod_user] %>
password: <%= Rails.application.credentials.mysql[:prod_password] %>
diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb
new file mode 100644
index 00000000..48e43e85
--- /dev/null
+++ b/config/initializers/rack_attack.rb
@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+class Rack::Attack
+ ### Configure Cache ###
+ Rack::Attack.cache.store = Rails.cache
+
+ ### Throttle Spammy Clients ###
+ throttle('req/ip', limit: 300, period: 5.minutes) do |req|
+ req.ip unless req.path.start_with?('/assets')
+ end
+
+ # Throttle login attempts by IP address
+ throttle('logins/ip', limit: 5, period: 20.seconds) do |req|
+ if req.path == '/users/sign_in' && req.post?
+ req.ip
+ end
+ end
+
+ # Throttle login attempts by email address
+ throttle('logins/email', limit: 5, period: 20.seconds) do |req|
+ if req.path == '/users/sign_in' && req.post?
+ req.params['email'].to_s.downcase.gsub(/\s+/, '')
+ end
+ end
+
+ # Block suspicious requests for PHP files or with PHP-related payload
+ blocklist('block-suspicious-requests') do |req|
+ php_patterns = [
+ /\.php$/i,
+ /php/i,
+ /eval\(/i,
+ /system\(/i,
+ /exec\(/i,
+ /\<\?php/i
+ ]
+
+ # Check path and parameters for PHP patterns
+ path_suspicious = php_patterns.any? { |pattern| req.path =~ pattern }
+ params_suspicious = req.params.values.any? do |value|
+ php_patterns.any? { |pattern| value.to_s =~ pattern }
+ end
+
+ path_suspicious || params_suspicious
+ end
+
+ # Block known malicious IP addresses
+ blocklist('block-known-attackers') do |req|
+ known_attackers = [
+ '58.211.18.68' # Add the malicious IP you've identified
+ ]
+ known_attackers.include?(req.ip)
+ end
+
+ ### Custom Throttle Response ###
+ self.throttled_response = lambda do |env|
+ now = Time.now
+ match_data = env['rack.attack.match_data']
+
+ headers = {
+ 'Content-Type' => 'application/json',
+ 'X-RateLimit-Limit' => match_data[:limit].to_s,
+ 'X-RateLimit-Remaining' => '0',
+ 'X-RateLimit-Reset' => (now + (match_data[:period] - now.to_i % match_data[:period])).to_s
+ }
+
+ [ 429, headers, [{ error: "Rate limit exceeded. Please try again later." }.to_json]]
+ end
+
+ ### Custom Blocklist Response ###
+ self.blocklisted_response = lambda do |env|
+ # Log the blocked request
+ Rails.logger.warn(
+ "[Security] Blocked suspicious request from IP: #{env['rack.attack.match_data'][:request].ip}, " \
+ "Path: #{env['rack.attack.match_data'][:request].path}"
+ )
+
+ # Send to Sentry
+ Sentry.capture_message(
+ "Blocked suspicious request",
+ level: 'warning',
+ extra: {
+ ip: env['rack.attack.match_data'][:request].ip,
+ path: env['rack.attack.match_data'][:request].path,
+ user_agent: env['rack.attack.match_data'][:request].user_agent
+ }
+ )
+
+ [
+ 403,
+ {'Content-Type' => 'application/json'},
+ [{ error: 'Forbidden' }.to_json]
+ ]
+ end
+end
diff --git a/config/routes.rb b/config/routes.rb
index 64087bb1..62857288 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -120,6 +120,7 @@
# Place this at the very end of the file to catch all undefined routes
match '*path', to: 'errors#not_found', via: :all, constraints: lambda { |req|
req.path.exclude?('/rails/active_storage') &&
- req.path.exclude?('/letter_opener')
+ req.path.exclude?('/letter_opener') &&
+ req.path != '/'
}
end
diff --git a/lib/tasks/security.rake b/lib/tasks/security.rake
new file mode 100644
index 00000000..763e5244
--- /dev/null
+++ b/lib/tasks/security.rake
@@ -0,0 +1,22 @@
+namespace :security do
+ desc 'Run security checks on dependencies'
+ task :audit do
+ puts 'Running bundle audit...'
+ system('bundle audit check --update')
+
+ puts 'Checking for outdated dependencies...'
+ system('bundle outdated')
+
+ puts 'Checking for vulnerable gems...'
+ system('bundle exec brakeman -A')
+ end
+
+ desc 'Update dependencies with security patches'
+ task :update do
+ puts 'Updating dependencies...'
+ system('bundle update')
+
+ puts 'Running security audit after update...'
+ Rake::Task['security:audit'].invoke
+ end
+end
diff --git a/spec/policies/user_role_policy_spec.rb b/spec/policies/user_role_policy_spec.rb
index 93361f5f..98fc1d69 100644
--- a/spec/policies/user_role_policy_spec.rb
+++ b/spec/policies/user_role_policy_spec.rb
@@ -3,7 +3,7 @@
RSpec.describe UserRolePolicy do
let(:user_with_axis_mundi) { create(:user, :with_axis_mundi_role) }
let(:regular_user) { create(:user) }
- let(:user_role) { UserRole.first } # Use the first UserRole created by the :with_axis_mundi_role trait
+ let(:user_role) { create(:user_role, user: user_with_axis_mundi, role: create(:role, :axis_mundi)) }
shared_examples 'grants access to Axis Mundi role' do |action|
it "grants access to users with the Axis Mundi role for #{action}" do
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 48195a22..2fd9b113 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -42,11 +42,8 @@
config.example_status_persistence_file_path = "spec/examples.txt"
config.disable_monkey_patching!
- if config.files_to_run.one?
- config.default_formatter = "doc"
- end
+ config.default_formatter = "doc" if config.files_to_run.one?
config.profile_examples = 10
config.order = :random
- Kernel.srand config.seed
end
diff --git a/spec/support/driver.rb b/spec/support/driver.rb
index 5cee2913..73ad6d0c 100644
--- a/spec/support/driver.rb
+++ b/spec/support/driver.rb
@@ -17,6 +17,9 @@
webdriver_options[:url] = "http://#{ENV.fetch('HOST_MACHINE_IP', nil)}:9515"
end
+# Increase default wait time
+Capybara.default_max_wait_time = 10
+
# Register the non-headless selenium_firefox driver
Capybara.register_driver :selenium_firefox do |app|
Capybara::Selenium::Driver.new(app, **webdriver_options)
@@ -35,6 +38,15 @@
config.before(:each, type: :system) do
driven_by ENV['SHOW_BROWSER'].present? ? :selenium_firefox : :selenium_firefox_headless
end
+
+ # Add debugging for system tests
+ config.after(:each, type: :system) do |example|
+ if example.exception
+ puts "Page HTML at failure:"
+ puts page.html
+ puts "Current URL: #{page.current_url}"
+ end
+ end
end
# How to use this snippet:
diff --git a/spec/system/judge_management_spec.rb b/spec/system/judge_management_spec.rb
index b80d063c..426cb959 100644
--- a/spec/system/judge_management_spec.rb
+++ b/spec/system/judge_management_spec.rb
@@ -4,30 +4,42 @@
let(:container) { create(:container) }
let(:contest_description) { create(:contest_description, container: container) }
let(:contest_instance) { create(:contest_instance, contest_description: contest_description) }
- let(:admin_user) { create(:user) }
+ let(:admin_user) { create(:user, :axis_mundi) }
let(:admin_role) { create(:role, kind: 'Collection Administrator') }
let!(:judge_role) { create(:role, kind: 'Judge') }
before do
- # Assign admin role and create container assignment
+ # Create and assign the Collection Administrator role
admin_user.roles << admin_role
+
+ # Create the container assignment with the Collection Administrator role
create(:assignment, user: admin_user, container: container, role: admin_role)
+
sign_in admin_user
- end
- describe 'creating a new judge' do
- before do
- visit container_contest_description_contest_instance_judging_assignments_path(
+ # Visit the judging assignments page
+ visit container_contest_description_contest_instance_judging_assignments_path(
+ container, contest_description, contest_instance
+ )
+
+ # Wait for the page to load with more specific expectations
+ expect(page).to have_current_path(
+ container_contest_description_contest_instance_judging_assignments_path(
container, contest_description, contest_instance
)
- end
+ )
+ expect(page).to have_selector('div.container')
+ expect(page).to have_css('h2', text: /Manage Judging for/)
+ end
+ describe 'creating a new judge' do
context 'with non-umich email' do
it 'creates a new judge with transformed email' do
- click_on 'Judges assigned to this contest instance'
# Click the pool of judges tab button and wait for content
- find('button[data-bs-target="#pool-of-judges"]').click
+ expect(page).to have_selector('button#pool-of-judges-tab')
+ find('button#pool-of-judges-tab').click
+ expect(page).to have_selector('#pool-of-judges.tab-pane')
# Wait for the table to be visible in the pool of judges tab
within('#pool-of-judges') do
@@ -45,7 +57,7 @@
expect(page).to have_css('.alert.alert-success', text: 'Judge was successfully created/updated and assigned')
# Click the pool of judges tab button again after page reload
- find('button[data-bs-target="#pool-of-judges"]').click
+ find('button#pool-of-judges-tab').click
# Wait for the table to be visible and check for the new judge
within('#pool-of-judges') do
@@ -63,8 +75,8 @@
context 'with umich email' do
it 'creates a new judge with original email' do
- # Click the pool of judges tab button and wait for content
- find('button[data-bs-target="#pool-of-judges"]').click
+ # Click the pool of judges tab button
+ find('button#pool-of-judges-tab').click
# Wait for the table to be visible in the pool of judges tab
within('#pool-of-judges') do
@@ -82,7 +94,7 @@
expect(page).to have_css('.alert.alert-success', text: 'Judge was successfully created/updated and assigned')
# Click the pool of judges tab button again after page reload
- find('button[data-bs-target="#pool-of-judges"]').click
+ find('button#pool-of-judges-tab').click
# Wait for the table to be visible and check for the new judge
within('#pool-of-judges') do
@@ -101,8 +113,8 @@
it 'shows validation messages' do
initial_user_count = User.count
- # Click the pool of judges tab button and wait for content
- find('button[data-bs-target="#pool-of-judges"]').click
+ # Click the pool of judges tab button
+ find('button#pool-of-judges-tab').click
# Wait for the table to be visible in the pool of judges tab
within('#pool-of-judges') do
@@ -124,7 +136,7 @@
expect(User.count).to eq(initial_user_count)
# Click the pool of judges tab button again after error
- find('button[data-bs-target="#pool-of-judges"]').click
+ find('button#pool-of-judges-tab').click
# Wait for the table to be visible in the pool of judges tab
within('#pool-of-judges') do
@@ -160,8 +172,8 @@
end
it 'displays judge with formatted email' do
- # Click the pool of judges tab button and wait for content
- find('button[data-bs-target="#pool-of-judges"]').click
+ # Click the pool of judges tab button
+ find('button#pool-of-judges-tab').click
# Wait for the table to be visible and check for the judge
within('#pool-of-judges') do
@@ -175,8 +187,8 @@
it 'allows removing a judge' do
assignment = JudgingAssignment.last
- # Click the pool of judges tab button and wait for content
- find('button[data-bs-target="#pool-of-judges"]').click
+ # Click the pool of judges tab button
+ find('button#pool-of-judges-tab').click
# Wait for the table to be visible and remove the judge
within('#pool-of-judges') do
@@ -191,7 +203,7 @@
expect(page).to have_css('.alert.alert-success', text: 'Judge assignment was successfully removed')
# Click the pool of judges tab button again after page reload
- find('button[data-bs-target="#pool-of-judges"]').click
+ find('button#pool-of-judges-tab').click
# Verify the judge is no longer in the table
within('#pool-of-judges') do