mirror of
https://github.com/maybe-finance/maybe.git
synced 2025-07-18 20:59:39 +02:00
b803ddac96
* OAuth * Add API test routes and update Doorkeeper token handling for test environment - Introduced API namespace with test routes for controller testing in the test environment. - Updated Doorkeeper configuration to allow fallback to plain tokens in the test environment for easier testing. - Modified schema to change resource_owner_id type from bigint to string. * Implement API key authentication and enhance access control - Replaced Doorkeeper OAuth authentication with a custom method supporting both OAuth and API keys in the BaseController. - Added methods for API key authentication, including validation and logging. - Introduced scope-based authorization for API keys in the TestController. - Updated routes to include API key management endpoints. - Enhanced logging for API access to include authentication method details. - Added tests for API key functionality, including validation, scope checks, and access control enforcement. * Add API key rate limiting and usage tracking - Implemented rate limiting for API key authentication in BaseController. - Added methods to check rate limits, render appropriate responses, and include rate limit headers in responses. - Updated routes to include a new usage resource for tracking API usage. - Enhanced tests to verify rate limit functionality, including exceeding limits and per-key tracking. - Cleaned up Redis data in tests to ensure isolation between test cases. * Add Jbuilder for JSON rendering and refactor AccountsController - Added Jbuilder gem for improved JSON response handling. - Refactored index action in AccountsController to utilize Jbuilder for rendering JSON. - Removed manual serialization of accounts and streamlined response structure. - Implemented a before_action in BaseController to enforce JSON format for all API requests. * Add transactions resource to API routes - Added routes for transactions, allowing index, show, create, update, and destroy actions. - This enhancement supports comprehensive transaction management within the API. * Enhance API authentication and onboarding handling - Updated BaseController to skip onboarding requirements for API endpoints and added manual token verification for OAuth authentication. - Improved error handling and logging for invalid access tokens. - Introduced a method to set up the current context for API requests, ensuring compatibility with session-like behavior. - Excluded API paths from onboarding redirects in the Onboardable concern. - Updated database schema to change resource_owner_id type from bigint to string for OAuth access grants. * Fix rubocop offenses - Fix indentation and spacing issues - Convert single quotes to double quotes - Add spaces inside array brackets - Fix comment alignment - Add missing trailing newlines - Correct else/end alignment 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * Fix API test failures and improve test reliability - Fix ApiRateLimiterTest by removing mock users method and using fixtures - Fix UsageControllerTest by removing mock users method and using fixtures - Fix BaseControllerTest by using different users for multiple API keys - Use unique display_key values with SecureRandom to avoid conflicts - Fix double render issue in UsageController by returning after authorize_scope\! - Specify controller name in routes for usage resource - Remove trailing whitespace and empty lines per Rubocop All tests now pass and linting is clean. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * Add API transactions controller warning to brakeman ignore The account_id parameter in the API transactions controller is properly validated on line 79: family.accounts.find(transaction_params[:account_id]) This ensures users can only create transactions in accounts belonging to their family, making this a false positive. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Signed-off-by: Josh Pigford <josh@joshpigford.com> Co-authored-by: Claude <noreply@anthropic.com>
116 lines
2.1 KiB
Ruby
116 lines
2.1 KiB
Ruby
source "https://rubygems.org"
|
|
|
|
ruby file: ".ruby-version"
|
|
|
|
# Rails
|
|
gem "rails", "~> 7.2.2"
|
|
|
|
# Drivers
|
|
gem "pg", "~> 1.5"
|
|
gem "redis", "~> 5.4"
|
|
|
|
# Deployment
|
|
gem "puma", ">= 5.0"
|
|
gem "bootsnap", require: false
|
|
|
|
# Assets
|
|
gem "importmap-rails"
|
|
gem "propshaft"
|
|
gem "tailwindcss-rails"
|
|
gem "lucide-rails", github: "maybe-finance/lucide-rails"
|
|
|
|
# Hotwire + UI
|
|
gem "stimulus-rails"
|
|
gem "turbo-rails"
|
|
gem "view_component"
|
|
|
|
# https://github.com/lookbook-hq/lookbook/issues/712
|
|
# TODO: Remove max version constraint when fixed
|
|
gem "lookbook", "2.3.9"
|
|
|
|
gem "hotwire_combobox"
|
|
|
|
# Background Jobs
|
|
gem "sidekiq"
|
|
gem "sidekiq-cron"
|
|
|
|
# Monitoring
|
|
gem "vernier"
|
|
gem "rack-mini-profiler"
|
|
gem "sentry-ruby"
|
|
gem "sentry-rails"
|
|
gem "sentry-sidekiq"
|
|
gem "logtail-rails"
|
|
gem "skylight", groups: [ :production ]
|
|
|
|
# Active Storage
|
|
gem "aws-sdk-s3", "~> 1.177.0", require: false
|
|
gem "image_processing", ">= 1.2"
|
|
|
|
# Other
|
|
gem "ostruct"
|
|
gem "bcrypt", "~> 3.1"
|
|
gem "jwt"
|
|
gem "jbuilder"
|
|
|
|
# OAuth & API Security
|
|
gem "doorkeeper"
|
|
gem "rack-attack", "~> 6.6"
|
|
gem "faraday"
|
|
gem "faraday-retry"
|
|
gem "faraday-multipart"
|
|
gem "inline_svg"
|
|
gem "octokit"
|
|
gem "pagy"
|
|
gem "rails-settings-cached"
|
|
gem "tzinfo-data", platforms: %i[windows jruby]
|
|
gem "csv"
|
|
gem "redcarpet"
|
|
gem "stripe"
|
|
gem "intercom-rails"
|
|
gem "plaid"
|
|
gem "rotp", "~> 6.3"
|
|
gem "rqrcode", "~> 3.0"
|
|
gem "activerecord-import"
|
|
|
|
# State machines
|
|
gem "aasm"
|
|
gem "after_commit_everywhere", "~> 1.0"
|
|
|
|
# AI
|
|
gem "ruby-openai"
|
|
|
|
group :development, :test do
|
|
gem "debug", platforms: %i[mri windows]
|
|
gem "brakeman", require: false
|
|
gem "rubocop-rails-omakase", require: false
|
|
gem "i18n-tasks"
|
|
gem "erb_lint"
|
|
gem "dotenv-rails"
|
|
end
|
|
|
|
if ENV["BENCHMARKING_ENABLED"]
|
|
gem "dotenv-rails", groups: [ :production ]
|
|
end
|
|
|
|
group :development do
|
|
gem "hotwire-livereload"
|
|
gem "letter_opener"
|
|
gem "ruby-lsp-rails"
|
|
gem "web-console"
|
|
gem "faker"
|
|
gem "benchmark-ips"
|
|
gem "stackprof"
|
|
gem "derailed_benchmarks"
|
|
gem "foreman"
|
|
end
|
|
|
|
group :test do
|
|
gem "capybara"
|
|
gem "selenium-webdriver"
|
|
gem "mocha"
|
|
gem "vcr"
|
|
gem "webmock"
|
|
gem "climate_control"
|
|
gem "simplecov", require: false
|
|
end
|