Private spaces implementation

Gemfile

@@ -89,6 +89,7 @@ group :development do
   gem 'listen'
   gem 'puma'
   gem 'web-console'
+  gem 'rdoc', '>= 8.0'
 end
 
 group :test do

Gemfile.lock

@@ -547,6 +547,10 @@ GEM
     rb-fsevent (0.11.2)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
+    rbs (4.0.3)
+      logger
+      prism (>= 1.6.0)
+      tsort
     rdf (3.3.4)
       bcp47_spec (~> 0.2)
       bigdecimal (~> 3.1, >= 3.1.5)
@@ -615,9 +619,10 @@ GEM
     rdf-xsd (3.3.0)
       rdf (~> 3.3)
       rexml (~> 3.2)
-    rdoc (7.2.0)
+    rdoc (8.0.0)
       erb
-      psych (>= 4.0.0)
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
       tsort
     readline (0.0.4)
       reline
@@ -906,6 +911,7 @@ DEPENDENCIES
   rails-controller-testing
   rails-i18n
   rails_admin
+  rdoc (>= 8.0)
   recaptcha
   redcarpet
   redis

app/assets/config/manifest.js

@@ -1,3 +1,4 @@
 //= link_tree ../images
 //= link_directory ../stylesheets/themes .css
-//= link application.js
+//= link application.js
+//= link show_private_groups.js

app/assets/javascripts/autocompleters.js

@@ -45,7 +45,14 @@ var Autocompleters = {
                     return { value: name, data: { id: item[config.idField], item: item } };
                 })
             };
-        }
+        },
+        groups: function (response, config) {
+            return {
+                suggestions: $.map(response, function (item) {
+                    return { value: item.title, data: { id: item[config.idField], item: item } };
+                })
+            };
+        },
     },
 
     init: function () {

app/assets/javascripts/show_private_groups.js

@@ -0,0 +1,23 @@
+// executed for space form
+function show_private_groups() {
+    let checkbox = document.getElementById("space_is_private")
+    let container = document.getElementById("groups_container")
+
+    const toggleGroups = () => {
+        if (checkbox && checkbox.checked) {
+            container.style.display = "block"
+        } else {
+            container.style.display = "none"
+        }
+    }
+
+    if (checkbox) {
+        checkbox.addEventListener("change", toggleGroups)
+    }
+
+    toggleGroups()
+}
+
+window.addEventListener('turbolinks:load', function() {
+    show_private_groups();
+});

app/assets/javascripts/templates/autocompleter/group_id.hbs

@@ -0,0 +1,7 @@
+<li data-id="{{ item.id }}">
+    <input type="hidden" name="{{ prefix }}[]" value="{{ item.id }}" />
+    {{ item.title }}
+    <a href="#" class="delete-list-item btn btn-icon">
+        <i class="icon cross-icon icon-sm icon-greyscale"></i>
+    </a>
+</li>

app/assets/javascripts/templates/autocompleter/group_member.hbs

@@ -0,0 +1,18 @@
+<li data-id="{{ item.id }}">
+    <input type="hidden" name="{{ prefix }}[]" value="{{ item.id }}" />
+    <span class="group-member-name">{{ item.name }}</span>
+    {{#if item.email}}
+        <span class="group-member-email">{{ item.email }}</span>
+    {{/if}}
+    <label class="group-member-owner-label" title="Owner">
+        <input type="checkbox"
+               name="group[owner_ids][]"
+               value="{{ item.id }}"
+               class="group-owner-checkbox"
+               {{#if item.owner}}checked="checked"{{/if}} />
+        <i class="glyphicon glyphicon-star"></i> Owner
+    </label>
+    <a href="#" class="delete-list-item btn btn-icon" title="Remove member">
+        <i class="icon cross-icon icon-sm icon-greyscale"></i>
+    </a>
+</li>

app/controllers/application_controller.rb

@@ -1,7 +1,15 @@
 require 'private_address_check'
 require 'private_address_check/tcpsocket_ext'
 
-# The controller for actions related to the core application
+# Base controller for the whole application.
+#
+# ApplicationController centralizes cross-cutting concerns shared by every
+# controller in TeSS: authentication (Devise + token auth), authorization
+# (Pundit), multi-space resolution, error rendering, and a couple of small
+# utility endpoints (+test_url+, +job_status+).
+#
+# All other controllers should inherit from this class rather than directly
+# from <tt>ActionController::Base</tt>.
 class ApplicationController < ActionController::Base
   include BreadCrumbs
   include PublicActivity::StoreController
@@ -30,10 +38,29 @@ class ApplicationController < ActionController::Base
 
   rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized
 
+  # Builds the context object passed to every Pundit policy.
+  #
+  # Bundling +current_user+ together with the +request+ lets policies make
+  # decisions based on how the request was made (e.g. JSON API vs HTML),
+  # in addition to who is making it.
+  #
+  # Returns:: a Pundit::CurrentContext wrapping the current user and request.
   def pundit_user
     Pundit::CurrentContext.new(current_user, request)
   end
 
+  # Renders a generic error page/response for a given HTTP status code.
+  #
+  # Accepts either a numeric or symbolic status code (e.g. :forbidden,
+  # :not_found) and renders the appropriate HTML error page, or a JSON/JSON:API
+  # error payload depending on the requested format. Falls back to a
+  # translated default message when none is supplied.
+  #
+  # status_code:: Integer or Symbol HTTP status code (default: 500). May be
+  #               overridden by the <tt>params[:status_code]</tt> value set by
+  #               the routes for 500, 503, 422 and 404 errors.
+  # message::     optional String error message to display; defaults to a
+  #               localized message for the given status code.
   def handle_error(status_code = 500, message = nil)
     status_code = (params[:status_code] || status_code) # params[:status_code] comes from routes for 500, 503, 422 and 404 errors
     if status_code.is_a?(Symbol) # Convert :forbidden, :not_found, etc. to 403, 404 etc.
@@ -56,6 +83,12 @@ def handle_error(status_code = 500, message = nil)
     end
   end
 
+  # Checks whether a given URL is reachable, guarding against SSRF by only
+  # allowing connections to public addresses (via PrivateAddressCheck).
+  #
+  # Expects <tt>params[:url]</tt> to contain the URL to test. Responds with a
+  # JSON body describing the outcome (HTTP code on success, or an explanatory
+  # message on failure/invalid URL).
   def test_url
     body = {}
 
@@ -79,6 +112,11 @@ def test_url
     end
   end
 
+  # Returns the status of a background job (Sidekiq) as JSON.
+  #
+  # Expects <tt>params[:id]</tt> to be the Sidekiq job id. Responds with
+  # <tt>404</tt> and <tt>{ status: 'not-found' }</tt> if no status is found
+  # for that id.
   def job_status
     begin
       status = Sidekiq::Status::status(params[:id])
@@ -97,45 +135,93 @@ def job_status
 
   private
 
+  # Checks whether the given feature is enabled for the current space.
+  #
+  # feature:: String or Symbol feature key (see Space::FEATURES).
+  #
+  # Returns:: +true+ or +false+.
   def feature_enabled?(feature)
     Space.current_space.feature_enabled?(feature)
   end
 
   helper_method :feature_enabled?
 
+  # before_action-style guard that raises a routing error (resulting in a
+  # 404) when the given feature is disabled globally via TeSS::Config.
+  #
+  # feature:: String or Symbol feature key; defaults to the current
+  #           controller's name.
+  #
+  # Raises:: ActionController::RoutingError if the feature is explicitly
+  #          disabled in the application configuration.
   def ensure_feature_enabled(feature = controller_name)
     if TeSS::Config.feature.key?(feature) && !TeSS::Config.feature[feature]
       raise ActionController::RoutingError.new('Feature not enabled')
     end
   end
 
+  # Rescue handler for Pundit::NotAuthorizedError.
+  #
+  # Renders a localized "forbidden" error message based on the policy and
+  # query that denied access.
+  #
+  # exception:: the raised Pundit::NotAuthorizedError.
   def user_not_authorized(exception)
     policy_name = exception.policy.class.to_s.underscore
     handle_error(:forbidden, t("#{policy_name}.#{exception.query}", scope: 'pundit', default: :default))
   end
 
+  # before_action that resolves and stores the Space matching the current
+  # request host (or the default space if the +spaces+ feature is disabled),
+  # and redirects unauthorized users away from private spaces they cannot
+  # access.
   def set_current_space
     Space.current_space = TeSS::Config.feature['spaces'] ? Space.find_by_host(request.host) : Space.default
+    # if the current_space is a specific space (not the default one), we check if the user can access it
+    if TeSS::Config.feature['spaces'] && Space.current_space != Space.default
+      unless policy(Space.current_space).shown?
+        if current_user
+          flash[:alert] = "You are not authorized to access this page."
+          redirect_to TeSS::Config.base_url, allow_other_host: true
+        else
+          flash[:alert] = "Sign in to access this page."
+          redirect_to TeSS::Config.base_url + '/users/sign_in', allow_other_host: true
+        end
+      end
+    end
   end
 
+  # Returns:: the Space resolved for the current request by #set_current_space.
   def current_space
     Space.current_space
   end
 
   helper_method :current_space
 
+  # before_action that stores the current user on the User class (for
+  # convenience access outside the request cycle) and reports the user to
+  # Sentry, when Sentry is enabled.
   def set_current_user
     User.current_user = current_user
     if TeSS::Config.sentry_enabled?
       Sentry.set_user(current_user ? { id: current_user.id, username: current_user.username } : {})
     end
   end
 
+  # Looks up the country of the current request's IP address.
+  #
+  # Uses the <tt>MOCK_IP</tt> environment variable outside of production so
+  # geolocation can be tested locally.
+  #
+  # Returns:: a country code/name Hash entry from the Locator lookup, or
+  #           +nil+ if it could not be determined.
   def current_user_country
     remote_ip = ENV.fetch('MOCK_IP') { Rails.env.production? ? request.remote_ip : '130.88.0.0' }
     Locator.instance.lookup(remote_ip)&.dig('country')
   end
 
+  # Returns:: +true+ if the current request's country is in the configured
+  #           list of blocked countries, +false+ otherwise.
   def from_blocked_country?
     return unless TeSS::Config.blocked_countries.present?
     user_country = current_user_country
@@ -147,6 +233,8 @@ def from_blocked_country?
 
   protected
 
+  # Configures the extra parameters Devise should permit for sign up,
+  # sign in and account update, beyond its defaults.
   def configure_permitted_parameters
     devise_parameter_sanitizer.permit(:sign_up) do |u| u.permit(:username, :email, :password, :password_confirmation,
                                                                 :remember_me, :publicize_email, :processing_consent)
@@ -157,6 +245,8 @@ def configure_permitted_parameters
     end
   end
 
+  # Removes the <tt>X-Frame-Options</tt> header so the response can be
+  # embedded in an iframe on another site.
   def allow_embedding
     response.headers.delete 'X-Frame-Options'
   end