Address review: assert uploaded bytes in disk update test

direct_upload_url_for now returns [blob, url] so the authenticated update test can assert blob.download matches the uploaded payload, not just the 204 status — guarding against a write landing at the wrong key or with the wrong content. Both update call sites destructure the tuple.
Address review: cover DiskController#update in tests
2026-10-28 00:16:48 +09:00 · 2026-06-15 13:24:38 -07:00 · 2026-06-15 13:18:40 -07:00 · 2026-06-15 13:10:59 -07:00 · 2026-06-15 13:00:29 -07:00
49 changed files with 220 additions and 1298 deletions
@@ -67,17 +67,6 @@ jobs:
          CANONICAL_IMAGE="${REGISTRY}/${IMAGE_REF,,}"
          echo "canonical=${CANONICAL_IMAGE}" >> "$GITHUB_OUTPUT"

-      - name: Compute app version
-        id: version
-        shell: bash
-        run: |
-          set -eu
-          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
-            echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
-          else
-            echo "version=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
-          fi
-
      - name: Extract Docker metadata (tags, labels) with arch suffix
        id: meta
        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
@@ -105,8 +94,6 @@ jobs:
          build-args: |
            OCI_SOURCE=${{ env.SOURCE_URL }}
            OCI_DESCRIPTION=${{ env.IMAGE_DESCRIPTION }}
-            APP_VERSION=${{ steps.version.outputs.version }}
-            GIT_REVISION=${{ github.sha }}
          platforms: ${{ matrix.platform }}
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -66,9 +66,6 @@ ENV HTTP_WRITE_TIMEOUT=300
 COPY --from=build --chown=rails:rails /usr/local/bundle /usr/local/bundle
 COPY --from=build --chown=rails:rails /rails /rails

-# Install ONCE backup/restore hooks
-COPY --chmod=755 hooks /hooks
-
 # Set version and revision
 ARG APP_VERSION
 ENV APP_VERSION=$APP_VERSION
@@ -137,7 +137,7 @@ GEM
    bcrypt (3.1.22)
    benchmark (0.5.0)
    bigdecimal (3.3.1)
-    brakeman (8.0.5)
+    brakeman (8.0.4)
      racc
    builder (3.3.0)
    bundler-audit (0.9.3)
@@ -153,13 +153,13 @@ GEM
      regexp_parser (>= 1.5, < 3.0)
      xpath (~> 3.2)
    chunky_png (1.4.0)
-    concurrent-ruby (1.3.7)
+    concurrent-ruby (1.3.5)
    connection_pool (2.5.5)
    crack (1.0.0)
      bigdecimal
      rexml
-    crass (1.0.7)
-    date (3.5.1)
+    crass (1.0.6)
+    date (3.5.0)
    debug (1.11.0)
      irb (~> 1.10)
      reline (>= 0.3.8)
@@ -191,7 +191,7 @@ GEM
    jbuilder (2.14.1)
      actionview (>= 7.0.0)
      activesupport (>= 7.0.0)
-    json (2.20.0)
+    json (2.13.2)
    jwt (3.2.0)
      base64
    kredis (1.8.0)
@@ -201,7 +201,7 @@ GEM
    language_server-protocol (3.17.0.5)
    lint_roller (1.1.0)
    logger (1.7.0)
-    loofah (2.25.2)
+    loofah (2.24.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
    mail (2.9.0)
@@ -224,7 +224,7 @@ GEM
      ruby2_keywords (~> 0.0.1)
    net-http-persistent (4.0.6)
      connection_pool (~> 2.2, >= 2.2.4)
-    net-imap (0.6.4.1)
+    net-imap (0.6.4)
      date
      net-protocol
    net-pop (0.1.2)
@@ -234,13 +234,13 @@ GEM
    net-smtp (0.5.1)
      net-protocol
    nio4r (2.7.5)
-    nokogiri (1.19.4-aarch64-linux-gnu)
+    nokogiri (1.19.3-aarch64-linux-gnu)
      racc (~> 1.4)
-    nokogiri (1.19.4-arm64-darwin)
+    nokogiri (1.19.3-arm64-darwin)
      racc (~> 1.4)
-    nokogiri (1.19.4-x86_64-darwin)
+    nokogiri (1.19.3-x86_64-darwin)
      racc (~> 1.4)
-    nokogiri (1.19.4-x86_64-linux-gnu)
+    nokogiri (1.19.3-x86_64-linux-gnu)
      racc (~> 1.4)
    openssl (3.3.0)
    ostruct (0.6.3)
@@ -278,8 +278,8 @@ GEM
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.1)
-      loofah (~> 2.25, >= 2.25.2)
+    rails-html-sanitizer (1.6.2)
+      loofah (~> 2.21)
      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
    rails_autolink (1.1.8)
      actionview (> 3.1)
@@ -367,10 +367,10 @@ GEM
      rack-protection (= 4.2.1)
      rack-session (>= 2.0.0, < 3)
      tilt (~> 2.0)
-    sqlite3 (2.9.5-aarch64-linux-gnu)
-    sqlite3 (2.9.5-arm64-darwin)
-    sqlite3 (2.9.5-x86_64-darwin)
-    sqlite3 (2.9.5-x86_64-linux-gnu)
+    sqlite3 (2.7.3-aarch64-linux-gnu)
+    sqlite3 (2.7.3-arm64-darwin)
+    sqlite3 (2.7.3-x86_64-darwin)
+    sqlite3 (2.7.3-x86_64-linux-gnu)
    stimulus-rails (1.3.4)
      railties (>= 6.0.0)
    stringio (3.1.8)
@@ -380,7 +380,7 @@ GEM
    thruster (0.1.15-x86_64-darwin)
    thruster (0.1.15-x86_64-linux)
    tilt (2.6.1)
-    timeout (0.6.1)
+    timeout (0.4.4)
    tsort (0.2.0)
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
@@ -397,7 +397,7 @@ GEM
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
    websocket (1.2.11)
-    websocket-driver (0.8.2)
+    websocket-driver (0.8.0)
      base64
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
@@ -11,49 +11,51 @@ expect, including:
 - @mentions
 - API, with support for bot integrations

-## Running your own Campfire instance
+## Deploying with Docker

 Campfire's Docker image contains everything needed for a fully-functional,
 single-machine deployment. This includes the web app, background jobs, caching,
-file serving, and SSL. You can use our pre-built image at
-`ghcr.io/basecamp/once-campfire:latest`, or build your own from this repo.
+file serving, and SSL.

-### Deploying with ONCE
+To persist storage of the database and file attachments, map a volume to `/rails/storage`.

-The easiest way to self-host Campfire is with [ONCE](https://github.com/basecamp/once).
-It will guide you through the initial set up and then keep your instance up to date automatically.
+To configure additional features, you can set the following environment variables:

-If you don't already have `once` installed, run this on the machine you want to run Campfire on:
+- `SSL_DOMAIN` - enable automatic SSL via Let's Encrypt for the given domain name
+- `DISABLE_SSL` - alternatively, set `DISABLE_SSL` to serve over plain HTTP
+- `VAPID_PUBLIC_KEY`/`VAPID_PRIVATE_KEY` - set these to a valid keypair to
+  allow sending Web Push notifications. You can generate a new keypair by running
+  `/script/admin/create-vapid-key`
+- `SENTRY_DSN` - to enable error reporting to sentry in production, supply your
+  DSN here

-```sh
-curl https://get.once.com | sh
-```
+For example:

-`once` will launch as soon as the install is finished. 
+    docker build -t campfire .

-Choose Campfire from the list of applications, follow the instructions, and ONCE will take care of the rest.
+    docker run \
+      --publish 80:80 --publish 443:443 \
+      --restart unless-stopped \
+      --volume campfire:/rails/storage \
+      --env SECRET_KEY_BASE=$YOUR_SECRET_KEY_BASE \
+      --env VAPID_PUBLIC_KEY=$YOUR_PUBLIC_KEY \
+      --env VAPID_PRIVATE_KEY=$YOUR_PRIVATE_KEY \
+      --env TLS_DOMAIN=chat.example.com \
+      campfire

-If you prefer the command line to the dashboard, you can deploy directly:
+## Running in development

-```sh
-once deploy ghcr.io/basecamp/once-campfire --host chat.example.com
-```
+    bin/setup
+    bin/rails server

-### Deploying with Docker
+## Worth Noting

-If you'd rather run the Docker image yourself, you can read more about that in the [self-hosting guide](docs/self-hosting.md).
+When you start Campfire for the first time, you’ll be guided through
+creating an admin account.
+The email address of this admin account will be shown on the login page
+so that people who forget their password know who to contact for help.
+(You can change this email later in the settings)

-> [!TIP]
-> When you start Campfire for the first time, you'll be guided through a wizard to create an admin account.
-> The email address that you enter for the admin account will be visible on the sign-in page, it's there so
-> that people have someone to contact if they need help with their account. If that bothers you, put in any
-> email address you want and create yourself a new admin account.
-
-## Development
-
-You are welcome - and encouraged - to modify Campfire to your liking.
-Please see our [development guide](docs/development.md) for how to get Campfire set up for local development.
-
-## Security
-
-See [SECURITY.md](SECURITY.md) for how to report a vulnerability and a description of our trust model.
+Campfire is single-tenant: any rooms designated "public" will be accessible by
+all users in the system. To support entirely distinct groups of customers, you
+would deploy multiple instances of the application.
@@ -1,22 +0,0 @@
-# Security
-
-Report vulnerabilities through our [HackerOne program](https://hackerone.com/basecamp) or at
-https://github.com/basecamp/once-campfire/security. Note that Campfire is in scope for our security
-program, but is not bounty eligible.
-
-## Trust model
-
-Campfire is self-hosted and single-tenant, so the administrator is the server operator,
-with shell, network, and database access already. Anything requiring the administrator
-role grants nothing they do not already have, and is not a vulnerability.
-
-We do want reports of anything a **non-administrator** can reach, and of any credential or
-network path held by the Campfire process but not by the operator's own shell.
-
-## Intentional behavior
-
-Bot webhook URLs are unrestricted: an administrator can point one at any address,
-including internal ones, because operators legitimately wire bots to their own services.
-Link unfurling is different because any member can trigger it by pasting a URL, so it
-validates destinations through `RestrictedHTTP::PrivateNetworkGuard`. The difference is who
-picks the destination.
@@ -1,13 +0,0 @@
-# Prepended onto Turbo::StreamsChannel. The subscriber names the channel it wants, so
-# authorizing room messages only in RoomMessagesChannel would leave the stock channel as
-# a way around it: same signed stream name, no membership check. Turn those names away
-# here and RoomMessagesChannel becomes the only door.
-module RoomStreamsAreAuthorized
-  def subscribed
-    if RoomMessagesChannel.guarded_stream?(verified_stream_name_from_params)
-      reject
-    else
-      super
-    end
-  end
-end
@@ -1,55 +0,0 @@
-# Authorizes the room message stream when the subscription is made, so that revoking a
-# membership actually stops delivery.
-#
-# Turbo's stock channel verifies only the signature on the stream name. That name carries
-# no expiry and no binding to a user, so one harvested while a member keeps working after
-# the membership is gone. Reconnecting makes it worse rather than better: revoking a
-# membership disconnects the user with reconnect: true, and the client then replays its
-# subscriptions on the fresh socket.
-#
-# The room is derived from the verified stream name rather than taken as a parameter, so
-# there's nothing for a subscriber to point somewhere else. The subscriber also doesn't
-# get to choose the channel: Turbo::StreamsChannel turns these stream names away, so this
-# is the only way onto them. See config/initializers/turbo_streams_authorization.rb.
-class RoomMessagesChannel < ApplicationCable::Channel
-  extend  Turbo::Streams::StreamName
-  include Turbo::Streams::StreamName::ClassMethods
-
-  STREAM_SUFFIX = "messages"
-
-  class << self
-    # True for the stream names this channel exists to guard, whoever is asking.
-    def guarded_stream?(stream_name)
-      stream_name.to_s.split(":", 2).second == STREAM_SUFFIX
-    end
-
-    def subscribable_room(user, stream_name)
-      gid_param, suffix = stream_name.to_s.split(":", 2)
-
-      if suffix == STREAM_SUFFIX && room = room_from(gid_param)
-        user.rooms.find_by(id: room.id)
-      end
-    end
-
-    private
-      def room_from(gid_param)
-        GlobalID::Locator.locate gid_param, only: Room
-      rescue ActiveRecord::RecordNotFound
-        nil
-      end
-  end
-
-  def subscribed
-    if stream_name = authorized_stream_name
-      stream_from stream_name
-    else
-      reject
-    end
-  end
-
-  private
-    def authorized_stream_name
-      stream_name = verified_stream_name_from_params
-      stream_name if stream_name.present? && self.class.subscribable_room(current_user, stream_name)
-    end
-end
@@ -1,12 +1,5 @@
 class UnreadRoomsChannel < ApplicationCable::Channel
-  # Scoped per user, like ReadRoomsChannel. A single global stream would tell every
-  # authenticated connection when any room on the account is active, including closed
-  # rooms and direct conversations they're not part of.
-  def self.stream_name_for(user_id)
-    "user_#{user_id}_unreads"
-  end
-
  def subscribed
-    stream_from self.class.stream_name_for(current_user.id)
+    stream_from "unread_rooms"
  end
 end
@@ -2,15 +2,15 @@ class Accounts::LogosController < ApplicationController
  include ActiveStorage::Streaming, ActionView::Helpers::AssetUrlHelper

  allow_unauthenticated_access only: :show
-  content_security_policy false, only: :show
  before_action :ensure_can_administer, only: :destroy

  def show
    if stale?(etag: Current.account)
      expires_in 5.minutes, public: true, stale_while_revalidate: 1.week

-      if (logo_variant = Current.account&.logo_variant(logo_size))
-        send_png_file ActiveStorage::Blob.service.path_for(logo_variant.key)
+      if Current.account&.logo&.attached?
+        logo = Current.account.logo.variant(logo_variant).processed
+        send_png_file ActiveStorage::Blob.service.path_for(logo.key)
      else
        send_stock_icon
      end
@@ -23,6 +23,9 @@ class Accounts::LogosController < ApplicationController
  end

  private
+    LARGE_SQUARE_PNG_VARIANT = { resize_to_limit: [ 512, 512 ], format: :png }
+    SMALL_SQUARE_PNG_VARIANT = { resize_to_limit: [ 192, 192 ], format: :png }
+
    def send_png_file(path)
      send_file path, content_type: "image/png", disposition: :inline
    end
@@ -35,8 +38,8 @@ class Accounts::LogosController < ApplicationController
      end
    end

-    def logo_size
-      small_logo? ? :small : :large
+    def logo_variant
+      small_logo? ? SMALL_SQUARE_PNG_VARIANT : LARGE_SQUARE_PNG_VARIANT
    end

    def small_logo?
@@ -1,6 +1,5 @@
 class QrCodeController < ApplicationController
  allow_unauthenticated_access
-  content_security_policy false

  def show
    url = Base64.urlsafe_decode64(params[:id])
@@ -42,12 +42,6 @@ class Rooms::ClosedsController < RoomsController
      @room = @room.becomes!(Rooms::Closed)
    end

-    # Open and closed rooms convert into each other, so both are in reach here. Direct
-    # rooms never are: converting one would let its creator revise who's in it.
-    def room_scope
-      Current.user.rooms.without_directs
-    end
-
    def grantees
      User.where(id: grantee_ids)
    end
@@ -29,13 +29,8 @@ class Rooms::DirectsController < RoomsController
      end
    end

-    # All users in a direct room can administer it. Only direct rooms, though: this
-    # relaxation is why room_scope below has to keep every other type out of reach.
+    # All users in a direct room can administer it
    def ensure_can_administer
      true
    end
-
-    def room_scope
-      Current.user.rooms.directs
-    end
 end
@@ -40,12 +40,6 @@ class Rooms::OpensController < RoomsController
      @room = @room.becomes!(Rooms::Open)
    end

-    # Open and closed rooms convert into each other, so both are in reach here. Direct
-    # rooms never are: promoting one would republish its history to the whole account.
-    def room_scope
-      Current.user.rooms.without_directs
-    end
-
    def broadcast_create_room(room)
      broadcast_prepend_to :rooms, target: :shared_rooms, partial: "users/sidebars/rooms/shared", locals: { room: room }
    end
@@ -20,19 +20,13 @@ class RoomsController < ApplicationController

  private
    def set_room
-      if room = room_scope.find_by(id: params[:room_id] || params[:id])
+      if room = Current.user.rooms.find_by(id: params[:room_id] || params[:id])
        @room = room
      else
        redirect_to root_url, alert: "Room not found or inaccessible"
      end
    end

-    # Subclasses narrow this to the room types they're allowed to act on, so that one
-    # room namespace can't be used to reach another's rooms.
-    def room_scope
-      Current.user.rooms
-    end
-
    def ensure_can_administer
      head :forbidden unless Current.user.can_administer?(@room)
    end
@@ -1,8 +1,6 @@
 class Users::AvatarsController < ApplicationController
  include ActiveStorage::Streaming

-  content_security_policy false, only: :show
-
  rescue_from(ActiveSupport::MessageVerifier::InvalidSignature) { head :not_found }

  def show
@@ -11,7 +9,8 @@ class Users::AvatarsController < ApplicationController
    if stale?(etag: @user)
      expires_in 30.minutes, public: true, stale_while_revalidate: 1.week

-      if (avatar_variant = @user.avatar_variant)
+      if @user.avatar.attached?
+        avatar_variant = @user.avatar.variant(SQUARE_WEBP_VARIANT).processed
        send_webp_blob_file avatar_variant.key
      elsif @user.bot?
        render_default_bot
@@ -27,6 +26,8 @@ class Users::AvatarsController < ApplicationController
  end

  private
+    SQUARE_WEBP_VARIANT = { resize_to_limit: [ 512, 512 ], format: :webp }
+
    def send_webp_blob_file(key)
      send_file ActiveStorage::Blob.service.path_for(key), content_type: "image/webp", disposition: :inline
    end
@@ -1,14 +1,6 @@
 class Account < ApplicationRecord
  include Joinable

-  has_one_attached :logo do |attachable|
-    attachable.variant :large, resize_to_limit: [ 512, 512 ], format: :png
-    attachable.variant :small, resize_to_limit: [ 192, 192 ], format: :png
-  end
-
+  has_one_attached :logo
  has_json :settings, restrict_room_creation_to_administrators: false
-
-  def logo_variant(size)
-    logo.variant(size).processed if logo.variable?
-  end
 end
@@ -1,19 +1,10 @@
 module Message::Broadcasts
  def broadcast_create
    broadcast_append_to room, :messages, target: [ room, :messages ]
-    broadcast_unread_room
+    ActionCable.server.broadcast("unread_rooms", { roomId: room.id })
  end

  def broadcast_remove
    broadcast_remove_to room, :messages
  end
-
-  private
-    # Fanned out to the room's members rather than published on one global stream, so
-    # that the timing of activity in a room only reaches people who are in it.
-    def broadcast_unread_room
-      room.memberships.pluck(:user_id).each do |user_id|
-        ActionCable.server.broadcast UnreadRoomsChannel.stream_name_for(user_id), { roomId: room.id }
-      end
-    end
 end
@@ -22,8 +22,6 @@ class Room < ApplicationRecord

  belongs_to :creator, class_name: "User", default: -> { Current.user }

-  validate :direct_rooms_keep_their_type, on: :update
-
  scope :opens,           -> { where(type: "Rooms::Open") }
  scope :closeds,         -> { where(type: "Rooms::Closed") }
  scope :directs,         -> { where(type: "Rooms::Direct") }
@@ -67,15 +65,6 @@ class Room < ApplicationRecord
  end

  private
-    # Open and closed rooms convert into each other freely. A direct room can't become
-    # either: its participants agreed to a private conversation, not to one whose
-    # audience someone else gets to widen afterwards.
-    def direct_rooms_keep_their_type
-      if type_changed? && type_was == "Rooms::Direct"
-        errors.add :type, "can't be changed for a direct room"
-      end
-    end
-
    def unread_memberships(message)
      memberships.visible.disconnected.where.not(user: message.creator).update_all(unread_at: message.created_at, updated_at: Time.current)
    end
@@ -2,9 +2,7 @@ module User::Avatar
  extend ActiveSupport::Concern

  included do
-    has_one_attached :avatar do |attachable|
-      attachable.variant :square, resize_to_limit: [ 512, 512 ], format: :webp
-    end
+    has_one_attached :avatar
  end

  class_methods do
@@ -16,8 +14,4 @@ module User::Avatar
  def avatar_token
    signed_id(purpose: :avatar)
  end
-
-  def avatar_variant
-    avatar.variant(:square).processed if avatar.variable?
-  end
 end
@@ -24,8 +24,6 @@ class Webhook < ApplicationRecord
        Net::HTTP::Post.new(uri, "Content-Type" => "application/json").tap { |request| request.body = payload }
    end

-    # No PrivateNetworkGuard, unlike Opengraph::Fetch: only an administrator sets this URL,
-    # and operators legitimately point bots at their own internal services.
    def http
      Net::HTTP.new(uri.host, uri.port).tap do |http|
        http.use_ssl = (uri.scheme == "https")
@@ -17,7 +17,7 @@
    <%= render partial: "messages/message", collection: @messages, cached: true %>
  <% end %>

-  <%= turbo_stream_from @room, :messages, channel: "RoomMessagesChannel" %>
+  <%= turbo_stream_from @room, :messages %>
  <%= button_to_jump_to_newest_message %>
 <% end %>

@@ -15,7 +15,6 @@ include SSHKit::DSL
 ARCH = "linux/amd64,linux/arm64"
 BUILDER_NAME = "campfire-builder"
 GIT_SHA = `git rev-parse HEAD`.strip
-MANUAL_NOTES = ARGV.delete("--notes")
 VERSION = ARGV[0]

 DOCKER_IMAGE_NAME = "registry.once.com/campfire"
@@ -29,7 +28,7 @@ EXPORT_REMOTE_USER = "app"
 EXPORT_DEPLOY_HOSTS = %w[ once-store-app-101 once-store-app-102 ]
 EXPORT_DEPLOY_LOCATION = "/local/app/product_releases/"

-abort "You must specify a version, e.g. `bin/release 1.0.0` (pass --notes to write release notes manually)" unless VERSION
+abort "You must specify a version, e.g. `bin/release 1.0.0`" unless VERSION

 current_branch = `git rev-parse --abbrev-ref HEAD`.strip
 if current_branch != "main"
@@ -58,25 +57,19 @@ on(:local) do
 end

 announcing "Creating GitHub release v#{VERSION}..." do
+  notes_file = "tmp/release_notes.md"
+
  on(:local) do
-    if MANUAL_NOTES
-      notes_file = "tmp/release_notes.md"
+    execute :mkdir, "-p", "tmp"

-      execute :mkdir, "-p", "tmp"
+    File.write(notes_file, "# What's Changed\n\n- \n")
+    system ENV["EDITOR"] || "vim", notes_file

-      File.write(notes_file, "# What's Changed\n\n- \n")
-      system ENV["EDITOR"] || "vim", notes_file
-
-      unless system "gh", "release", "create", "v#{VERSION}", "--title", "v#{VERSION}", "--notes-file", notes_file
-        abort "Failed to create release; check that the version doesn't already exist"
-      end
-
-      execute :rm, notes_file
-    else
-      unless system "gh", "release", "create", "v#{VERSION}", "--title", "v#{VERSION}", "--generate-notes"
-        abort "Failed to create release; check that the version doesn't already exist"
-      end
+    unless system "gh", "release", "create", "v#{VERSION}", "--title", "v#{VERSION}", "--notes-file", notes_file
+      abort "Failed to create release; check that the version doesn't already exist"
    end
+
+    execute :rm, notes_file
  end
 end

@@ -1,7 +1,31 @@
 ActiveSupport.on_load(:active_storage_blob) do
-  ActiveStorage::DiskController.content_security_policy false, only: :show
-
  ActiveStorage::DiskController.after_action only: :show do
    response.set_header("Cache-Control", "max-age=3600, public")
  end
+
+  # Gate the ActiveStorage write path behind app authentication. These endpoints
+  # ship unauthenticated by Rails default; Campfire never uses direct upload for
+  # legit attachments (those go through MessagesController#create, and Trix file
+  # drops are disabled in the composer). Requiring a session on the write actions
+  # blocks anonymous blob writes and disk-fill while leaving blob serving public.
+  #
+  # ActiveStorage controllers live in ActiveStorage::Engine, so they see the
+  # engine's url helpers, not the main app's. Include the application helpers
+  # first so Authentication#request_authentication can redirect to new_session_url.
+  ActiveStorage::DirectUploadsController.include Rails.application.routes.url_helpers
+  ActiveStorage::DirectUploadsController.include Authentication # only action: #create
+
+  ActiveStorage::DiskController.include Rails.application.routes.url_helpers
+  ActiveStorage::DiskController.include Authentication
+
+  # Blob serving (#show) stays public so signed-token attachment URLs keep
+  # resolving for unauthenticated and bot clients alike.
+  ActiveStorage::DiskController.allow_unauthenticated_access only: :show
+  ActiveStorage::DiskController.allow_bot_access only: :show
+
+  # Including Authentication re-adds protect_from_forgery, but Active Storage's
+  # direct-upload service PUT (#update) carries only signed service headers and
+  # no authenticity token. Re-exempt it from CSRF so authenticated uploads can
+  # still store bytes; the signed URL token and the session check remain.
+  ActiveStorage::DiskController.skip_forgery_protection only: :update
 end
@@ -1,120 +1,25 @@
 # Be sure to restart your server when you modify this file.

-# Baseline application-wide Content-Security-Policy, deployed in Report-Only
-# mode: browsers evaluate the policy and report violations (once a report
-# endpoint is wired up) but enforce nothing, so rendering cannot break.
-# Tune the policy against observed violations, then flip
-# `content_security_policy_report_only` off to enforce it.
-#
+# Define an application-wide content security policy.
 # See the Securing Rails Applications Guide for more information:
 # https://guides.rubyonrails.org/security.html#content-security-policy-header

-# Session-stable nonce for permitted inline scripts (the importmap JSON + shim,
-# auto-nonced by importmap-rails).
+# Rails.application.configure do
+#   config.content_security_policy do |policy|
+#     policy.default_src :self, :https
+#     policy.font_src    :self, :https, :data
+#     policy.img_src     :self, :https, :data
+#     policy.object_src  :none
+#     policy.script_src  :self, :https
+#     policy.style_src   :self, :https
+#     # Specify URI for violation reports
+#     # policy.report_uri "/csp-violation-report-endpoint"
+#   end
 #
-# The nonce is stable across a session's requests so Turbo snapshot restores
-# don't replay a stale nonce and trip CSP. It's the HMAC of a stable cookie
-# value keyed by the server secret: the cookie is client-settable, but the
-# client can't predict the resulting nonce without knowing secret_key_base.
+#   # Generate session nonces for permitted importmap and inline scripts
+#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+#   config.content_security_policy_nonce_directives = %w(script-src)
 #
-# Campfire sets no per-session verification cookie, so the lightweight
-# nonce_id cookie — set on first visit, present for every session including
-# unauthenticated ones — is the sole identifier.
-#
-# The generator runs for every response that carries the policy, so the cookie
-# write would otherwise land on public, shared-cacheable responses (QR codes,
-# logos, avatars, disk-served blobs) where a cache could replay one client's
-# identifier and nonce to others. Those endpoints opt out of the policy with
-# `content_security_policy false`; the nonce is only meaningful on documents.
-module CSP
-  module Nonce
-    COOKIE = "campfire_csp_nonce_id"
-
-    def self.generate(request)
-      hmac(nonce_id(request))
-    end
-
-    def self.hmac(identifier)
-      OpenSSL::HMAC.hexdigest("SHA256", Rails.application.secret_key_base, identifier)
-    end
-
-    # Read or initialize a stable nonce identifier cookie.
-    def self.nonce_id(request)
-      request.cookies[COOKIE] || set_nonce_id(request)
-    end
-
-    def self.set_nonce_id(request)
-      value = SecureRandom.base64(16)
-      request.cookie_jar[COOKIE] = { value: value, httponly: true, same_site: :lax }
-      value
-    end
-  end
-
-  # Per-install CSP extras.
-  #
-  # Campfire is a ONCE product: each customer self-hosts it on their own domain
-  # and an admin may embed or connect to external hosts — video/embed providers,
-  # image CDNs, analytics, form or webhook endpoints — that vary per install and
-  # are unknown at build time. `:self` already tracks this install's own origin;
-  # these ENV knobs let an admin allow additional hosts without editing this file
-  # (and without which enforcement would break their legitimate integrations).
-  #
-  # Each is a comma-, semicolon-, or whitespace-separated list of CSP source
-  # expressions, e.g.
-  #
-  #   CSP_EXTRA_FRAME_SRC="https://www.youtube.com https://player.vimeo.com"
-  #
-  # Leave them unset (the default) to keep each directive at :self only.
-  EXTRA_ENV = {
-    script_src:  "CSP_EXTRA_SCRIPT_SRC",
-    style_src:   "CSP_EXTRA_STYLE_SRC",
-    img_src:     "CSP_EXTRA_IMG_SRC",
-    connect_src: "CSP_EXTRA_CONNECT_SRC",
-    frame_src:   "CSP_EXTRA_FRAME_SRC",
-    form_action: "CSP_EXTRA_FORM_ACTION"
-  }.freeze
-
-  # Parse one ENV knob into a list of extra host sources.
-  #
-  # Semicolons are tokenized like commas/whitespace: because the nonce forces a
-  # per-request policy build, a stray `;` in a value (a plausible operator paste,
-  # e.g. "https://youtube.com; https://vimeo.com") would otherwise land inside a
-  # single source token and make Rails raise InvalidDirectiveError on every
-  # request — a site-wide 500 even in report-only mode. Splitting on `;` yields
-  # valid tokens instead; Rails still validates each one, so no injection is
-  # introduced (a token with an embedded space still fails validation).
-  def self.extra(directive)
-    ENV[EXTRA_ENV.fetch(directive)].to_s.split(/[,;\s]+/).reject(&:blank?)
-  end
-
-  # Build the baseline policy. Kept as a reusable method so it can be exercised
-  # in isolation by tests as well as at boot.
-  def self.apply(policy)
-    policy.default_src     :self
-    policy.script_src      :self, *extra(:script_src)  # nonce auto-appended via nonce_directives below
-    # unsafe_inline retained: many style="…" attributes across the message
-    # composer and ActionText content can't be nonced yet.
-    policy.style_src       :self, :unsafe_inline, *extra(:style_src)
-    # frame_src / img_src / connect_src start at :self plus any per-install extras
-    # and get tuned against violation reports during the report-only window.
-    policy.img_src         :self, :data, :blob, *extra(:img_src)
-    policy.connect_src     :self, *extra(:connect_src)
-    policy.frame_src       :self, *extra(:frame_src)
-    policy.frame_ancestors :self
-    policy.base_uri        :self
-    policy.form_action     :self, *extra(:form_action)
-    policy.object_src      :none
-    # Specify URI for violation reports once a report sink is available
-    # policy.report_uri "/csp-violation-report-endpoint"
-  end
-end
-
-Rails.application.configure do
-  config.content_security_policy { |policy| CSP.apply(policy) }
-
-  config.content_security_policy_nonce_generator = ->(request) { CSP::Nonce.generate(request) }
-  config.content_security_policy_nonce_directives = %w[ script-src ]
-
-  # Report violations without enforcing the policy.
-  config.content_security_policy_report_only = true
-end
+#   # Report violations without enforcing the policy.
+#   # config.content_security_policy_report_only = true
+# end
@@ -1,3 +0,0 @@
-Rails.application.config.to_prepare do
-  Turbo::StreamsChannel.prepend RoomStreamsAreAuthorized
-end
@@ -1,2 +1,2 @@
-Rails.application.config.app_version = ENV["APP_VERSION"].presence || ENV["GIT_REVISION"].presence || "0"
+Rails.application.config.app_version = ENV.fetch("APP_VERSION", "0")
 Rails.application.config.git_revision = ENV["GIT_REVISION"]
@@ -1,9 +0,0 @@
-# Disable unfuzzed libvips operations.
-#
-# To block loaders we need to call `Vips.block` after Rails and image_processing set their
-# defaults. Force the order of operations by autoloading the file now.
-ActiveStorage::Transformers::Vips
-Vips.block_untrusted(true)
-Vips.block("VipsForeignLoadOpenslide", true) # prevent sqlite segfault in forked parallel workers
-Rails.application.config.active_storage.variable_content_types -=
-    %w[ image/bmp image/vnd.microsoft.icon image/vnd.adobe.photoshop ]
@@ -1,69 +0,0 @@
-## Development
-
-### Setting up
-
-First, get everything installed and configured with:
-
-```sh
-bin/setup
-```
-
-This installs the system packages Campfire needs (SQLite, ffmpeg), the right Ruby version (via [mise](https://mise.jdx.dev)), and the app's gems; prepares the database; and starts Redis (in a Docker container called `campfire-redis`, if it isn't already running locally).
-
-If you want to start over at any point, run:
-
-```sh
-bin/setup --reset
-```
-
-### Running the server
-
-Start the development server with:
-
-```sh
-bin/dev
-```
-
-You'll be able to access the app at http://localhost:3000.
-
-On first run you'll be guided through creating your admin account, and you can sign in with that account from then on.
-
-Note that Campfire needs Redis (for Action Cable, caching, and background jobs), so if you've restarted your machine or stopped the container, `docker start campfire-redis` will bring it back.
-
-### Web Push notifications
-
-Campfire uses VAPID (Voluntary Application Server Identification) keys to send browser push notifications. For notifications to work in development you'll need to generate a key pair and set these environment variables:
-
- `VAPID_PRIVATE_KEY`
- `VAPID_PUBLIC_KEY`
-
-You can generate a fresh pair (along with a secret key base, which you can ignore in development) by running:
-
-```sh
-script/admin/generate-secrets
-```
-
-### Running tests
-
-Run the unit tests with:
-
-```sh
-bin/rails test
-```
-
-And the browser-based system tests with:
-
-```sh
-bin/rails test:system
-```
-
-Before pushing your changes, you can run the full CI suite locally - style checks, security audits, and all the tests - with a single command:
-
-```sh
-bin/ci
-```
-
-### Contributing
-
-You are welcome - and encouraged - to modify Campfire to your liking.
-If you'd like to contribute your changes back, please read our [contributing guide](../CONTRIBUTING.md) first.
@@ -1,213 +0,0 @@
-## Self-hosting Campfire
-
-Campfire's Docker image contains everything needed for a fully-functional, single-machine deployment.
-This includes the web app, background jobs, caching, file serving, and SSL.
-
-> [!TIP]
-> The easiest way to self-host Campfire is with [ONCE](https://github.com/basecamp/once), which handles installation, updates, and backups for you. See the [README](../README.md#deploying-with-once) for details. This guide covers running the Docker image by hand.
-
-We recommend using `ghcr.io/basecamp/once-campfire:latest`, which always points to the most recent tagged release - the most stable and battle-tested version of Campfire.
-
-We provide a tagged release for every major, minor and patch version of Campfire, so you can also pin your deployment to a specific version if you want to avoid unexpected changes. For example:
-
-```bash
-# exactly version 1.4.4
-ghcr.io/basecamp/once-campfire:1.4.4
-
-# any 1.4.x version
-# e.g. 1.4.4 or 1.4.5
-# the last number is usually changed for bug fixes
-ghcr.io/basecamp/once-campfire:1.4
-
-# any 1.x version
-# e.g. 1.4.4 or 1.5.0
-# the middle number is usually changed for changes to, or addition of, features
-ghcr.io/basecamp/once-campfire:1
-```
-
-If you want to live on the bleeding edge, the `main` tag tracks the main release branch instead.
-It changes with every merged pull request, so it's the newest - but least battle-tested - version of Campfire.
-
-To run it you'll need three things:
-1. a machine that runs Docker
-2. a mounted volume (so that your database and file attachments are kept around between restarts)
-3. some environment variables for configuration
-
-If you'd rather build the image yourself from your own copy of the source, you can do that too:
-
-```sh
-docker build -t campfire .
-```
-
-### Mounting a storage volume
-
-Campfire keeps all of its storage - the database and uploaded file attachments - inside the path `/rails/storage`.
-By default Docker containers don't persist storage between runs, so you'll want to mount a persistent volume into that location.
-
-The simplest way to do this is with the `--volume` flag with `docker run`. For example:
-
-```sh
-docker run --volume campfire:/rails/storage ghcr.io/basecamp/once-campfire:latest
-```
-
-That will create a named volume (called `campfire`) and mount it into the correct path.
-Docker will manage where that volume is actually stored on your server.
-
-You can also specify the data location yourself, mount a network drive, and more.
-Check the Docker documentation to find out more about what's available.
-
-### Configuring with environment variables
-
-To configure your Campfire installation, you can use environment variables.
-At a minimum you'll want to configure your secret key and your SSL domain.
-
-#### Secrets
-
-Campfire needs a few secret values that are specific to your instance:
-
- `SECRET_KEY_BASE` - the basis for cryptographic features like signed cookies. This should be a long, unguessable random string.
- `VAPID_PRIVATE_KEY`/`VAPID_PUBLIC_KEY` - a key pair used for sending Web Push notifications.
-
-You can generate them by running:
-
-```sh
-docker run --rm ghcr.io/basecamp/once-campfire:latest script/admin/generate-secrets
-```
-
-It prints a fresh set of values ready to set as environment variables:
-
-```
-SECRET_KEY_BASE=...
-VAPID_PRIVATE_KEY=...
-VAPID_PUBLIC_KEY=...
-```
-
-Keep them safe and reuse the same values across restarts and upgrades - changing them later will invalidate sessions and push notification subscriptions.
-
-#### SSL
-
-If you want the Campfire container to handle its own SSL (HTTPS) automatically (via Let's Encrypt), you just need to specify the domain name that you're running it on.
-You can do that with the `TLS_DOMAIN` environment variable.
-
-> [!NOTE]
-> If you're using SSL, you'll want to allow traffic on ports 80 and 443.
-
-So if you were running on `chat.example.com` you could enable SSL like this:
-
-```sh
-docker run --publish 80:80 --publish 443:443 --env TLS_DOMAIN=chat.example.com ...
-```
-
-If you are terminating SSL in some other proxy in front of Campfire, or aren't using SSL at all (for example, if you want to run it locally on your laptop), then you should set `DISABLE_SSL=true` instead and just publish port 80:
-
-```sh
-docker run --publish 80:80 --env DISABLE_SSL=true ...
-```
-
-#### Error reporting (optional)
-
-To enable error reporting to Sentry in production, supply your DSN in the `SENTRY_DSN` environment variable.
-To disable Sentry initialization entirely, set `SKIP_TELEMETRY=true`.
-
-### Example
-
-Putting it all together, here's a complete `docker run` invocation:
-
-```sh
-docker run \
-  --name campfire \
-  --publish 80:80 --publish 443:443 \
-  --restart unless-stopped \
-  --volume campfire:/rails/storage \
-  --env SECRET_KEY_BASE=$YOUR_SECRET_KEY_BASE \
-  --env VAPID_PUBLIC_KEY=$YOUR_PUBLIC_KEY \
-  --env VAPID_PRIVATE_KEY=$YOUR_PRIVATE_KEY \
-  --env TLS_DOMAIN=chat.example.com \
-  ghcr.io/basecamp/once-campfire:latest
-```
-
-And here's an equivalent `docker-compose.yml` that you could use to run Campfire via `docker compose up`:
-
-```yaml
-services:
-  web:
-    image: ghcr.io/basecamp/once-campfire:latest
-    restart: unless-stopped
-    ports:
-      - "80:80"
-      - "443:443"
-    environment:
-      - SECRET_KEY_BASE=abcdefabcdef
-      - TLS_DOMAIN=chat.example.com
-      - VAPID_PRIVATE_KEY=myvapidprivatekey
-      - VAPID_PUBLIC_KEY=myvapidpublickey
-    volumes:
-      - campfire:/rails/storage
-
-volumes:
-  campfire:
-```
-
-### First run
-
-When you start Campfire for the first time, you'll be guided through creating an admin account.
-
-> [!TIP]
-> The email address of this admin account will be shown on the login page so that people who forget their password know who to contact for help.
-> (You can change this email later in the settings.)
-
-Campfire is single-tenant: any rooms designated "public" will be accessible by all users in the system.
-To support entirely distinct groups of customers, you would deploy multiple instances of the application.
-
-### Upgrading
-
-All of Campfire's state lives in the mounted volume, so upgrading is a matter of pulling a newer image and recreating the container:
-
-```sh
-docker pull ghcr.io/basecamp/once-campfire:latest
-```
-
-Any pending database migrations run automatically when the container boots.
-
-### Backups
-
-To back up your instance, back up the contents of the `/rails/storage` volume.
-
-Because the SQLite database may be written to at any moment, you shouldn't copy its files directly while Campfire is running.
-Instead, first run `script/admin/prepare-backup` inside the running container to produce a consistent snapshot of the database (it's written to `storage/backups/` inside the volume):
-
-```sh
-docker exec campfire script/admin/prepare-backup
-```
-
-(If you're using Docker Compose, replace `docker exec campfire` with `docker compose exec web`)
-
-Then archive the whole storage volume to a file on the host:
-
-```sh
-docker run --rm \
-  --user root \
-  --volume campfire:/rails/storage \
-  --volume "$PWD":/backup \
-  ghcr.io/basecamp/once-campfire:latest \
-  tar czf "/backup/campfire-backup.tar.gz" -C /rails storage
-```
-
-This gives you a `campfire-backup.tar.gz` in your current directory containing the database snapshot and all uploaded files.
-Copy it somewhere safe, ideally off the machine.
-
-To restore, extract the archive back into a (stopped) instance's volume, and replace the live database with the snapshot:
-
-```sh
-docker run --rm \
-  --user root \
-  --volume campfire:/rails/storage \
-  --volume "$PWD":/backup \
-  ghcr.io/basecamp/once-campfire:latest \
-  bash -c "tar xzf /backup/campfire-backup.tar.gz -C /rails &&
-           cp /rails/storage/backups/production.sqlite3 /rails/storage/db/production.sqlite3 &&
-           rm -f /rails/storage/db/production.sqlite3-wal /rails/storage/db/production.sqlite3-shm &&
-           chown -R rails:rails /rails/storage"
-```
-
-Then start Campfire again.
@@ -1,12 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-db_name="${RAILS_ENV:-production}.sqlite3"
-snapshot="/rails/storage/backups/$db_name"
-db="/rails/storage/db/$db_name"
-
-if [ -f "$snapshot" ]; then
-  mkdir -p "$(dirname "$db")"
-  cp "$snapshot" "$db"
-  rm -f "$db-wal" "$db-shm"
-fi
@@ -1,2 +0,0 @@
-#!/bin/bash
-exec /rails/script/admin/prepare-backup
@@ -1,4 +1,3 @@
-require "ipaddr"
 require "resolv"

 module RestrictedHTTP
@@ -7,32 +6,7 @@ module RestrictedHTTP
  module PrivateNetworkGuard
    extend self

-    # IPv4 special-use ranges (RFC 5735/6890) not already covered by the
-    # private?/loopback?/link_local? predicates in #disallowed_ipv4?.
-    DISALLOWED_IPV4 = %w[
-      0.0.0.0/8 100.64.0.0/10 192.0.0.0/24 192.0.2.0/24 192.88.99.0/24
-      198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4
-    ].map { |cidr| IPAddr.new(cidr) }.freeze
-
-    # IPv6 special-use ranges not caught by the predicates. 6to4 (2002::/16) and
-    # Teredo (2001::/32) are deprecated transition mechanisms with no legitimate
-    # fetch target, so they are blocked outright. ULA (fc00::/7, incl. the AWS
-    # IMDSv6 address fd00:ec2::254), link-local, and loopback are covered by the
-    # predicates in #disallowed_ipv6?.
-    DISALLOWED_IPV6 = %w[
-      ::/128 100::/64 2001::/32 2001:2::/48 2001:db8::/32 2002::/16
-      fec0::/10 ff00::/8
-    ].map { |cidr| IPAddr.new(cidr) }.freeze
-
-    # NAT64 prefixes: the well-known prefix (RFC 6052/6146) and the local-use
-    # prefix (RFC 8215). An address here embeds an IPv4 target in its low 32
-    # bits; we extract it and re-check against the IPv4 rules so NAT64 to a
-    # public address still resolves while NAT64 to an internal address is
-    # blocked.
-    NAT64_PREFIXES = [
-      IPAddr.new("64:ff9b::/96"),
-      IPAddr.new("64:ff9b:1::/48")
-    ].freeze
+    LOCAL_IP = IPAddr.new("0.0.0.0/8") # "This" network

    def resolve(hostname)
      Resolv.getaddress(hostname).tap do |ip|
@@ -41,36 +15,11 @@ module RestrictedHTTP
    end

    def private_ip?(ip)
-      ipaddr = IPAddr.new(ip)
-
-      # DNS never legitimately returns these embedded forms, so block them all
-      # regardless of the address they wrap.
-      if ipaddr.ipv4_mapped? || ipaddr.ipv4_compat?
-        true
-      elsif ipaddr.ipv4?
-        disallowed_ipv4?(ipaddr)
-      elsif NAT64_PREFIXES.any? { |prefix| prefix.include?(ipaddr) }
-        disallowed_ipv4?(embedded_ipv4(ipaddr))
-      else
-        disallowed_ipv6?(ipaddr)
+      IPAddr.new(ip).then do |ipaddr|
+        ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? || ipaddr.ipv4_mapped? || ipaddr.ipv4_compat? || LOCAL_IP.include?(ipaddr)
      end
    rescue IPAddr::InvalidAddressError
      true
    end
-
-    private
-      def disallowed_ipv4?(ipaddr)
-        ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? ||
-          DISALLOWED_IPV4.any? { |range| range.include?(ipaddr) }
-      end
-
-      def disallowed_ipv6?(ipaddr)
-        ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? ||
-          DISALLOWED_IPV6.any? { |range| range.include?(ipaddr) }
-      end
-
-      def embedded_ipv4(ipaddr)
-        IPAddr.new([ ipaddr.to_i & 0xffffffff ].pack("N").unpack("C4").join("."))
-      end
  end
 end
@@ -1,10 +0,0 @@
-#!/usr/bin/env ruby
-require "bundler/setup"
-require "securerandom"
-require "web_push"
-
-vapid_key = WebPush.generate_key
-
-puts "SECRET_KEY_BASE=#{SecureRandom.hex(64)}"
-puts "VAPID_PRIVATE_KEY=#{vapid_key.private_key}"
-puts "VAPID_PUBLIC_KEY=#{vapid_key.public_key}"
@@ -1,86 +0,0 @@
-require "test_helper"
-
-class RoomMessagesChannelTest < ActionCable::Channel::TestCase
-  tests RoomMessagesChannel
-
-  setup do
-    @room = rooms(:designers)
-    @signed_stream_name = Turbo::StreamsChannel.signed_stream_name [ @room, :messages ]
-  end
-
-  test "a member may subscribe to a room's message stream" do
-    stub_connection(current_user: users(:kevin))
-
-    subscribe signed_stream_name: @signed_stream_name
-
-    assert subscription.confirmed?
-    assert_has_stream Turbo.signed_stream_verifier.verified(@signed_stream_name)
-  end
-
-  test "a user who was never a member may not subscribe" do
-    stub_connection(current_user: users(:bender))
-
-    subscribe signed_stream_name: @signed_stream_name
-
-    assert subscription.rejected?
-  end
-
-  test "a revoked member may not re-subscribe with a stream name harvested while a member" do
-    stub_connection(current_user: users(:kevin))
-
-    subscribe signed_stream_name: @signed_stream_name
-    assert subscription.confirmed?, "kevin must start out able to subscribe"
-
-    @room.memberships.revoke_from users(:kevin)
-
-    subscribe signed_stream_name: @signed_stream_name
-
-    assert subscription.rejected?
-  end
-
-  test "an unsigned stream name is rejected" do
-    stub_connection(current_user: users(:kevin))
-
-    subscribe signed_stream_name: Turbo.signed_stream_verifier.verified(@signed_stream_name)
-
-    assert subscription.rejected?
-  end
-
-  test "a missing stream name is rejected" do
-    stub_connection(current_user: users(:kevin))
-
-    subscribe
-
-    assert subscription.rejected?
-  end
-
-  test "a validly signed stream name for another room the user isn't in is rejected" do
-    stub_connection(current_user: users(:bender))
-
-    subscribe signed_stream_name: Turbo::StreamsChannel.signed_stream_name([ rooms(:hq), :messages ])
-
-    assert subscription.rejected?
-  end
-end
-
-class RoomMessagesViaStockTurboChannelTest < ActionCable::Channel::TestCase
-  tests Turbo::StreamsChannel
-
-  # The subscriber picks the channel, so the stock channel has to turn these names away
-  # too. Otherwise a revoked member just names Turbo::StreamsChannel instead.
-  test "the stock turbo channel refuses to serve a room message stream" do
-    stub_connection(current_user: users(:kevin))
-
-    subscribe signed_stream_name: Turbo::StreamsChannel.signed_stream_name([ rooms(:designers), :messages ])
-
-    assert subscription.rejected?
-  end
-
-  test "the stock turbo channel still serves the room list stream" do
-    stub_connection(current_user: users(:kevin))
-
-    subscribe signed_stream_name: Turbo::StreamsChannel.signed_stream_name([ :rooms ])
-
-    assert subscription.confirmed?
-  end
-end
@@ -1,47 +0,0 @@
-require "test_helper"
-
-class UnreadRoomsChannelTest < ActionCable::Channel::TestCase
-  test "streams only the subscriber's own unread stream" do
-    stub_connection(current_user: users(:jz))
-
-    subscribe
-
-    assert subscription.confirmed?
-    assert_has_stream "user_#{users(:jz).id}_unreads"
-    assert_not_includes subscription.streams, "unread_rooms"
-  end
-
-  test "an outsider is not told about activity in a room they can't see" do
-    direct = rooms(:bender_and_kevin)
-    assert_not direct.users.include?(users(:jz)), "jz must be an outsider for this test to mean anything"
-
-    broadcasts = capture_unread_broadcasts_for(users(:jz)) do
-      direct.messages.create!(body: "Private", creator: users(:kevin), client_message_id: "outsider").broadcast_create
-    end
-
-    assert_empty broadcasts
-  end
-
-  test "a member is told about activity in their own room" do
-    direct = rooms(:bender_and_kevin)
-
-    broadcasts = capture_unread_broadcasts_for(users(:kevin)) do
-      direct.messages.create!(body: "Private", creator: users(:bender), client_message_id: "member").broadcast_create
-    end
-
-    assert_equal [ direct.id ], broadcasts.collect { |broadcast| broadcast["roomId"] }
-  end
-
-  private
-    def capture_unread_broadcasts_for(user)
-      stub_connection(current_user: user)
-      subscribe
-
-      stream = subscription.streams.sole
-      before = ActionCable.server.pubsub.broadcasts(stream).size
-
-      yield
-
-      ActionCable.server.pubsub.broadcasts(stream).drop(before).collect { |broadcast| JSON.parse(broadcast) }
-    end
-end
@@ -30,13 +30,6 @@ class Accounts::LogosControllerTest < ActionDispatch::IntegrationTest
    assert_valid_png_response size: 192
  end

-  test "show stock when custom logo cannot be resized" do
-    accounts(:signal).update! logo: fixture_file_upload("pixel.bmp", "image/bmp")
-
-    get account_logo_url
-    assert_valid_png_response size: 512
-  end
-
  test "destroy" do
    accounts(:signal).update! logo: fixture_file_upload("moon.jpg", "image/jpeg")

@@ -0,0 +1,83 @@
+require "test_helper"
+
+class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    host! "once.campfire.test"
+  end
+
+  test "create requires authentication" do
+    assert_no_difference -> { ActiveStorage::Blob.count } do
+      post rails_direct_uploads_url, params: { blob: blob_params }
+    end
+
+    assert_redirected_to new_session_url
+  end
+
+  test "create succeeds for an authenticated session" do
+    sign_in :david
+
+    assert_difference -> { ActiveStorage::Blob.count }, 1 do
+      post rails_direct_uploads_url, params: { blob: blob_params }
+    end
+
+    assert_response :success
+  end
+
+  test "disk show stays reachable without authentication" do
+    blob = ActiveStorage::Blob.create_and_upload! \
+      io: StringIO.new("hello"), filename: "hello.txt", content_type: "text/plain"
+
+    ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do
+      get blob.url
+    end
+
+    assert_response :success
+  end
+
+  test "disk update requires authentication" do
+    _blob, url = direct_upload_url_for("hello")
+
+    put url, params: "hello", headers: { "Content-Type" => "text/plain" }
+
+    assert_redirected_to new_session_url
+  end
+
+  test "disk update stores bytes for an authenticated session without a CSRF token" do
+    sign_in :david
+    blob, url = direct_upload_url_for("hello")
+
+    # Forgery protection is off in test by default; turn it on so this proves the
+    # signed-token service PUT stays CSRF-exempt even when the concern re-arms it.
+    with_forgery_protection do
+      put url, params: "hello", headers: { "Content-Type" => "text/plain" }
+    end
+
+    assert_response :no_content
+    assert_equal "hello", blob.download
+  end
+
+  private
+    def blob_params
+      content = "hello"
+      { filename: "hello.txt", byte_size: content.bytesize, content_type: "text/plain", \
+        checksum: Digest::MD5.base64digest(content) }
+    end
+
+    def direct_upload_url_for(content)
+      blob = ActiveStorage::Blob.create_before_direct_upload! \
+        filename: "hello.txt", byte_size: content.bytesize, \
+        checksum: Digest::MD5.base64digest(content), content_type: "text/plain"
+      url = ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do
+        blob.service_url_for_direct_upload
+      end
+      [ blob, url ]
+    end
+
+    def with_forgery_protection
+      original = ActionController::Base.allow_forgery_protection
+      ActionController::Base.allow_forgery_protection = true
+      yield
+    ensure
+      ActionController::Base.allow_forgery_protection = original
+    end
+end
@@ -57,22 +57,9 @@ class MessagesControllerTest < ActionDispatch::IntegrationTest
    end
  end

-  test "creating a message broadcasts unread room to each member" do
-    @room.users.each do |member|
-      assert_broadcasts UnreadRoomsChannel.stream_name_for(member.id), 1 do
-        post room_messages_url(@room, format: :turbo_stream), params: { message: { body: "New one #{member.id}", client_message_id: member.id } }
-      end
-    end
-  end
-
-  test "creating a message doesn't broadcast unread room to non-members" do
-    outsiders = User.where.not(id: @room.users.map(&:id))
-    assert outsiders.any?, "need someone outside the room for this test to mean anything"
-
-    outsiders.each do |outsider|
-      assert_no_broadcasts UnreadRoomsChannel.stream_name_for(outsider.id) do
-        post room_messages_url(@room, format: :turbo_stream), params: { message: { body: "New one", client_message_id: 999 } }
-      end
+  test "creating a message broadcasts unread room" do
+    assert_broadcasts "unread_rooms", 1 do
+      post room_messages_url(@room, format: :turbo_stream), params: { message: { body: "New one", client_message_id: 999 } }
    end
  end

@@ -66,18 +66,6 @@ class Rooms::ClosedsControllerTest < ActionDispatch::IntegrationTest
    assert rooms(:designers).reload.name, "Designers"
  end

-  test "a direct room can't be converted to closed and have its participants revised" do
-    sign_in :kevin
-    direct = rooms(:bender_and_kevin)
-
-    put rooms_closed_url(direct), params: {
-      room: { name: "Watercooler" }, user_ids: [ users(:kevin).id, users(:jz).id ]
-    }
-
-    assert_equal "Rooms::Direct", Room.find(direct.id).type
-    assert_equal [ users(:bender).id, users(:kevin).id ].sort, Room.find(direct.id).user_ids.sort
-  end
-
  test "remove yourself" do
    assert_difference -> { users(:david).rooms.count }, -1 do
      put rooms_closed_url(rooms(:designers), params: { room: { name: "Designers" }, user_ids: [ users(:jason).id, users(:jz).id ] })
@@ -29,34 +29,4 @@ class Rooms::DirectsControllerTest < ActionDispatch::IntegrationTest
      assert_redirected_to root_url
    end
  end
-
-  test "destroy can't reach a closed room the member didn't create" do
-    sign_in :kevin
-
-    assert_no_difference -> { Room.count } do
-      delete rooms_direct_url(rooms(:designers))
-    end
-
-    assert rooms(:designers).reload.persisted?
-  end
-
-  test "destroy can't reach an open room the member didn't create" do
-    sign_in :kevin
-
-    assert_no_difference -> { Room.count } do
-      delete rooms_direct_url(rooms(:hq))
-    end
-
-    assert rooms(:hq).reload.persisted?
-  end
-
-  test "destroy can't reach a room the member isn't in at all" do
-    sign_in :jz
-
-    assert_no_difference -> { Room.count } do
-      delete rooms_direct_url(rooms(:david_and_kevin))
-    end
-
-    assert rooms(:david_and_kevin).reload.persisted?
-  end
 end
@@ -57,23 +57,4 @@ class Rooms::OpensControllerTest < ActionDispatch::IntegrationTest
    put rooms_open_url(rooms(:designers)), params: { room: { name: "Doesn't matter" } }
    assert_equal rooms(:designers).memberships.count, User.count
  end
-
-  test "a direct room can't be promoted to open by its creator" do
-    sign_in :kevin
-    direct = rooms(:bender_and_kevin)
-
-    put rooms_open_url(direct), params: { room: { name: "Watercooler" } }
-
-    assert_equal "Rooms::Direct", Room.find(direct.id).type
-    assert_equal [ users(:bender).id, users(:kevin).id ].sort, Room.find(direct.id).user_ids.sort
-  end
-
-  test "a direct room can't be promoted to open by an administrator either" do
-    direct = rooms(:david_and_kevin)
-
-    put rooms_open_url(direct), params: { room: { name: "Watercooler" } }
-
-    assert_equal "Rooms::Direct", Room.find(direct.id).type
-    assert_equal [ users(:david).id, users(:kevin).id ].sort, Room.find(direct.id).user_ids.sort
-  end
 end
@@ -18,14 +18,6 @@ class Users::AvatarsControllerTest < ActionDispatch::IntegrationTest
    assert_equal "image/webp", @response.content_type
  end

-  test "show initials when image cannot be resized" do
-    users(:kevin).update! avatar: fixture_file_upload("pixel.bmp", "image/bmp")
-    get user_avatar_url(users(:kevin).avatar_token)
-
-    assert_response :success
-    assert_select "text", text: "K"
-  end
-
  test "show image with invalid token responds 404" do
    get user_avatar_url("not-a-valid-token")

@@ -1,128 +0,0 @@
-require "test_helper"
-
-class CspNonceTest < ActionDispatch::IntegrationTest
-  test "policy is delivered Report-Only, not enforced" do
-    sign_in :david
-    get root_url
-    follow_redirect!  # root redirects to the last room
-
-    assert_response :success
-    assert response.headers["Content-Security-Policy-Report-Only"].present?,
-      "Expected a Report-Only CSP header"
-    assert_nil response.headers["Content-Security-Policy"],
-      "Policy must not be enforced yet"
-  end
-
-  test "nonce is stable across requests so Turbo restores don't trip CSP" do
-    sign_in :david
-
-    get root_url
-    nonce1 = report_only_nonce
-
-    get root_url
-    nonce2 = report_only_nonce
-
-    assert nonce1.present?, "Expected a nonce in the Report-Only CSP header"
-    assert_equal nonce1, nonce2, "Nonce must be stable across requests"
-  end
-
-  test "client-set identifier still yields an unpredictable HMAC nonce" do
-    fake_id = "attacker-controlled-value"
-    cookies[CSP::Nonce::COOKIE] = fake_id
-
-    get root_url
-    nonce = report_only_nonce
-
-    assert_equal CSP::Nonce.hmac(fake_id), nonce,
-      "Nonce must be HMAC-SHA256 of the identifier keyed by secret_key_base"
-  end
-
-  test "importmap script tag carries the nonce" do
-    sign_in :david
-    get root_url
-    follow_redirect!  # root redirects to the last room
-
-    assert_response :success
-    nonce = report_only_nonce
-    assert_select "script[type='importmap'][nonce=?]", nonce
-  end
-
-  test "a per-install ENV extra host is appended to its directive" do
-    with_env "CSP_EXTRA_FRAME_SRC" => "https://player.vimeo.com https://www.youtube.com",
-             "CSP_EXTRA_IMG_SRC"   => "https://cdn.example.test" do
-      header = ActionDispatch::ContentSecurityPolicy.new { |p| CSP.apply(p) }.build
-
-      assert_match %r{frame-src[^;]*\bhttps://player\.vimeo\.com\b}, header
-      assert_match %r{frame-src[^;]*\bhttps://www\.youtube\.com\b}, header
-      assert_match %r{img-src[^;]*\bhttps://cdn\.example\.test\b}, header
-      # :self is preserved alongside the extras.
-      assert_match %r{frame-src 'self'}, header
-    end
-  end
-
-  test "a semicolon-separated ENV extra tokenizes into valid sources without raising" do
-    # A plausible operator paste separates hosts with "; ". Because the nonce
-    # forces a per-request policy build, a semicolon left inside a single source
-    # token would make Rails raise InvalidDirectiveError on every request — a
-    # site-wide 500 even in report-only mode. Splitting on ';' must yield both
-    # hosts as valid tokens and never raise.
-    with_env "CSP_EXTRA_FRAME_SRC" => "https://a.example; https://b.example" do
-      header = nil
-      assert_nothing_raised do
-        header = ActionDispatch::ContentSecurityPolicy.new { |p| CSP.apply(p) }.build
-      end
-
-      assert_match %r{frame-src[^;]*\bhttps://a\.example\b}, header
-      assert_match %r{frame-src[^;]*\bhttps://b\.example\b}, header
-      # Both hosts share the one frame-src directive; the semicolon did not leak
-      # a second directive into the policy.
-      assert_equal 1, header.scan(/(?:^|;\s*)frame-src\b/).size,
-        "Expected exactly one frame-src directive"
-    end
-  end
-
-  test "public cacheable responses carry neither the policy nor the nonce cookie" do
-    sign_in :david
-    blob = ActiveStorage::Blob.create_and_upload!(io: file_fixture("moon.jpg").open, filename: "moon.jpg", content_type: "image/jpeg")
-    get rails_blob_path(blob)
-    disk_blob_url = response.location
-
-    [
-      qr_code_path(Base64.urlsafe_encode64("http://example.com")),
-      account_logo_path,
-      user_avatar_path(users(:kevin).avatar_token),
-      disk_blob_url
-    ].each do |path|
-      cookies.delete CSP::Nonce::COOKIE
-
-      get path
-
-      assert_response :success
-      assert response.cache_control[:public], "#{path} is expected to be publicly cacheable"
-      assert_nil response.headers["Content-Security-Policy-Report-Only"], "#{path} must not carry the policy"
-      assert_nil cookies[CSP::Nonce::COOKIE], "#{path} must not set the nonce cookie"
-    end
-  end
-
-  test "directives default to :self only when no ENV extras are set" do
-    with_env "CSP_EXTRA_FRAME_SRC" => nil, "CSP_EXTRA_IMG_SRC" => nil do
-      header = ActionDispatch::ContentSecurityPolicy.new { |p| CSP.apply(p) }.build
-
-      assert_match %r{frame-src 'self'(;|\z)}, header
-    end
-  end
-
-  private
-    def with_env(vars)
-      original = {}
-      vars.each_key { |k| original[k] = ENV.key?(k) ? ENV[k] : :__unset__ }
-      vars.each { |k, v| v.nil? ? ENV.delete(k) : ENV[k] = v }
-      yield
-    ensure
-      original.each { |k, v| v == :__unset__ ? ENV.delete(k) : ENV[k] = v }
-    end
-
-    def report_only_nonce
-      response.headers["Content-Security-Policy-Report-Only"].to_s[/'nonce-([^']+)'/, 1]
-    end
-end
@@ -64,50 +64,6 @@ class RestrictedHTTP::PrivateNetworkGuardTest < ActiveSupport::TestCase
    assert_private_ip "::93.184.216.34"
  end

-  test "private_ip? returns true for carrier-grade NAT addresses (RFC6598)" do
-    assert_private_ip "100.64.0.1"
-    assert_private_ip "100.127.255.255"
-  end
-
-  test "private_ip? returns true for NAT64 addresses embedding a private IPv4" do
-    assert_private_ip "64:ff9b::a9fe:a9fe"  # NAT64 -> 169.254.169.254 (AWS metadata)
-    assert_private_ip "64:ff9b::a00:5"       # NAT64 -> 10.0.0.5
-  end
-
-  test "private_ip? returns true for local-use NAT64 addresses embedding a private IPv4 (RFC8215)" do
-    assert_private_ip "64:ff9b:1::a00:1"  # local-use NAT64 -> 10.0.0.1
-  end
-
-  test "private_ip? returns false for local-use NAT64 addresses embedding a public IPv4 (RFC8215)" do
-    assert_not RestrictedHTTP::PrivateNetworkGuard.private_ip?("64:ff9b:1::808:808")  # -> 8.8.8.8
-  end
-
-  test "private_ip? returns false for NAT64 addresses embedding a public IPv4" do
-    # DNS64 legitimately synthesizes these for public sites on IPv6-only hosts.
-    assert_not RestrictedHTTP::PrivateNetworkGuard.private_ip?("64:ff9b::808:808")  # -> 8.8.8.8
-  end
-
-  test "private_ip? returns true for 6to4 and Teredo transition addresses" do
-    assert_private_ip "2002:a9fe:a9fe::"  # 6to4 embedding 169.254.169.254
-    assert_private_ip "2001::1"            # Teredo
-  end
-
-  test "private_ip? returns true for IPv6 loopback, ULA, and link-local" do
-    assert_private_ip "::1"
-    assert_private_ip "fd00:ec2::254"  # AWS IMDSv6 (ULA)
-    assert_private_ip "fe80::1"
-  end
-
-  test "private_ip? returns true for IPv6 multicast, documentation, and benchmarking ranges" do
-    assert_private_ip "ff02::1"
-    assert_private_ip "2001:db8::1"
-    assert_private_ip "2001:2::1"  # benchmarking (RFC5180), matches 198.18.0.0/15
-  end
-
-  test "private_ip? returns false for public IPv6 addresses" do
-    assert_not RestrictedHTTP::PrivateNetworkGuard.private_ip?("2606:4700:4700::1111")
-  end
-
  test "private_ip? returns true for invalid addresses" do
    assert RestrictedHTTP::PrivateNetworkGuard.private_ip?("not-an-ip")
    assert RestrictedHTTP::PrivateNetworkGuard.private_ip?("")
@@ -1,118 +0,0 @@
-require "test_helper"
-require "vips"
-require "tempfile"
-
-# libvips selects a loader from a file's actual bytes, not from its declared content type. These
-# tests pin which loader is selected for each file type under the app's configured loader policy
-# (config/initializers/vips.rb).
-class VipsLoaderPolicyTest < ActiveSupport::TestCase
-  # Header bytes are enough for libvips to identify a format; native types are encoded live, exotic
-  # ones are represented by their magic bytes.
-  FTYP_AVIF = "\x00\x00\x00\x1cftypavif\x00\x00\x00\x00avifmif1miaf".b
-  FTYP_HEIC = "\x00\x00\x00\x1cftypheic\x00\x00\x00\x00heicmif1miaf".b
-  BMP = "BM" + [ 0, 0, 54 ].pack("V3") + "\x00" * 40
-  PSD = "8BPS" + [ 1 ].pack("n") + "\x00" * 26
-  ICO = "\x00\x00\x01\x00\x01\x00" + "\x00" * 16
-  SVG = %q(<svg xmlns="http://www.w3.org/2000/svg" width="8" height="8"/>)
-
-  test "loads PNG" do
-    assert_equal "VipsForeignLoadPngFile", loader_for(encode("png"))
-  end
-
-  test "loads GIF" do
-    assert_equal "VipsForeignLoadNsgifFile", loader_for(encode("gif"))
-  end
-
-  test "loads JPEG" do
-    assert_equal "VipsForeignLoadJpegFile", loader_for(encode("jpg"))
-  end
-
-  test "loads TIFF" do
-    assert_equal "VipsForeignLoadTiffFile", loader_for(encode("tif"))
-  end
-
-  test "loads WebP" do
-    assert_equal "VipsForeignLoadWebpFile", loader_for(encode("webp"))
-  end
-
-  test "loads AVIF" do
-    assert_equal "VipsForeignLoadHeifFile", loader_for(FTYP_AVIF)
-  end
-
-  test "loads HEIC" do
-    assert_equal "VipsForeignLoadHeifFile", loader_for(FTYP_HEIC)
-  end
-
-  test "denies BMP through magickload" do
-    assert_nil loader_for(BMP)
-  end
-
-  test "denies PSD through magickload" do
-    assert_nil loader_for(PSD)
-  end
-
-  test "denies ICO through magickload" do
-    assert_nil loader_for(ICO)
-  end
-
-  test "denies SVG through svgload" do
-    assert_nil loader_for(SVG)
-  end
-
-  test "denies OpenSlide files through openslideload" do
-    # OpenSlide files can segfault the embedded sqlite in forked parallel workers
-    assert_loader_blocked :openslideload, ".svs"
-  end
-
-  test "denies FITS files through fitsload" do
-    assert_loader_blocked :fitsload, ".fits"
-  end
-
-  test "denies MATLAB files through matload" do
-    assert_loader_blocked :matload, ".mat"
-  end
-
-  test "denies NIFTI files through niftiload" do
-    assert_loader_blocked :niftiload, ".nii"
-  end
-
-  test "denies RAW files through dcrawload" do
-    assert_loader_blocked :dcrawload, ".raw"
-  end
-
-  test "denies VIPS files through vipsload" do
-    assert_loader_blocked :vipsload, ".vips"
-  end
-
-  private
-    # Invoke a specific libvips loader directly and assert it is refused because the
-    # operation is blocked (rather than because the bytes are not a valid image).
-    def assert_loader_blocked(operation, extension)
-      Tempfile.create([ "blocked_loader", extension ], binmode: true) do |file|
-        file.write "not an image"
-        file.flush
-
-        error = assert_raises(Vips::Error) { Vips::Image.public_send(operation, file.path) }
-        actual = error.message.chomp
-
-        # note that exception message may include multiple errors on separate lines,
-        # so `^` and `$` anchors are used instead of `\A` and `\z`.
-        if actual =~ /^VipsOperation: class \"#{operation}\" not found$/
-          skip "libvips does not support #{operation} on this system"
-        end
-        assert_match(/^#{operation}: operation is blocked$/, actual)
-      end
-    end
-
-    def encode(ext)
-      Vips::Image.black(8, 8).add(128).cast("uchar").write_to_buffer(".#{ext}")
-    end
-
-    def loader_for(bytes)
-      Tempfile.create(%w[loader_probe .img], binmode: true) do |file|
-        file.write bytes
-        file.flush
-        Vips.vips_foreign_find_load(file.path)
-      end
-    end
-end
@@ -15,20 +15,4 @@ class AccountTest < ActiveSupport::TestCase
    accounts(:signal).update!(settings: { "restrict_room_creation_to_administrators" => "false" })
    assert_not accounts(:signal).reload.settings.restrict_room_creation_to_administrators?
  end
-
-  test "logo_variant is a resized variant of a variable logo" do
-    accounts(:signal).logo.attach io: file_fixture("moon.jpg").open, filename: "moon.jpg", content_type: "image/jpeg"
-
-    assert_kind_of ActiveStorage::VariantWithRecord, accounts(:signal).logo_variant(:large)
-  end
-
-  test "logo_variant is nil when the logo cannot be resized" do
-    accounts(:signal).logo.attach io: file_fixture("pixel.bmp").open, filename: "pixel.bmp", content_type: "image/bmp"
-
-    assert_nil accounts(:signal).logo_variant(:large)
-  end
-
-  test "logo_variant is nil without a logo" do
-    assert_nil accounts(:signal).logo_variant(:large)
-  end
 end
@@ -49,8 +49,8 @@ class Opengraph::FetchTest < ActiveSupport::TestCase
    # to a resolved IP, not a hostname to re-resolve.
    WebMock.disable_net_connect! allow: [ @url.host ]
    Resolv.stubs(:getaddress).with(@url.host).returns("1.2.3.4", "127.0.0.1")
-    TCPSocket.expects(:open).with { |*args, **| args.first == @url.host }.never
-    TCPSocket.expects(:open).with { |*args, **| args.first == "1.2.3.4" && args[1] == 443 }.throws(:dns_not_rebound)
+    TCPSocket.expects(:open).with(@url.host, 443, nil, nil).never
+    TCPSocket.expects(:open).with("1.2.3.4", 443, nil, nil).throws(:dns_not_rebound)

    assert_throws :dns_not_rebound do
      @fetch.fetch_document(@url)
@@ -66,8 +66,8 @@ class Opengraph::FetchTest < ActiveSupport::TestCase
    # to a resolved IP, not a hostname to re-resolve.
    WebMock.disable_net_connect! allow: [ @url.host ]
    Resolv.stubs(:getaddress).with(@url.host).returns("1.2.3.4", "127.0.0.1")
-    TCPSocket.expects(:open).with { |*args, **| args.first == @url.host }.never
-    TCPSocket.expects(:open).with { |*args, **| args.first == "1.2.3.4" && args[1] == 443 }.throws(:dns_not_rebound)
+    TCPSocket.expects(:open).with(@url.host, 443, nil, nil).never
+    TCPSocket.expects(:open).with("1.2.3.4", 443, nil, nil).throws(:dns_not_rebound)

    assert_throws :dns_not_rebound do
      @fetch.fetch_document(URI.parse("https://www.other.com/"), ip: "1.2.3.4")
@@ -1,19 +0,0 @@
-require "test_helper"
-
-class User::AvatarTest < ActiveSupport::TestCase
-  test "avatar_variant is a resized variant of a variable avatar" do
-    users(:kevin).avatar.attach io: file_fixture("moon.jpg").open, filename: "moon.jpg", content_type: "image/jpeg"
-
-    assert_kind_of ActiveStorage::VariantWithRecord, users(:kevin).avatar_variant
-  end
-
-  test "avatar_variant is nil when the avatar cannot be resized" do
-    users(:kevin).avatar.attach io: file_fixture("pixel.bmp").open, filename: "pixel.bmp", content_type: "image/bmp"
-
-    assert_nil users(:kevin).avatar_variant
-  end
-
-  test "avatar_variant is nil without an avatar" do
-    assert_nil users(:kevin).avatar_variant
-  end
-end
Author	SHA1	Message	Date
Jeremy Daer	0141eae018	Address review: assert uploaded bytes in disk update test direct_upload_url_for now returns [blob, url] so the authenticated update test can assert blob.download matches the uploaded payload, not just the 204 status — guarding against a write landing at the wrong key or with the wrong content. Both update call sites destructure the tuple.	2026-06-15 13:24:38 -07:00
Jeremy Daer	c49c41a0d7	Address review: cover DiskController#update in tests Add integration coverage for the disk service PUT now that the initializer relies on it being both session-gated and CSRF-exempt: - unauthenticated PUT -> redirected to login (write blocked) - authenticated PUT with forgery protection enabled and no authenticity token -> 204 (proves the signed-token service PUT stays CSRF-exempt and guards against the concern's protect_from_forgery re-arming it)	2026-06-15 13:18:40 -07:00
Jeremy Daer	49f06d0b22	Address review: keep disk PUT CSRF-exempt, use intent helpers - Including Authentication re-arms protect_from_forgery on DiskController. Active Storage's direct-upload service PUT (#update) sends only signed service headers and no CSRF token, so a real authenticated upload would 422 storing bytes. Re-exempt #update from forgery protection; the signed URL token and session check still gate the write. - Swap the raw skip_before_action for the Authentication concern's intent-revealing allow_unauthenticated_access / allow_bot_access helpers on #show, matching the rest of the app. - Scope the test's ActiveStorage::Current.url_options override to a set { } block so it can't leak thread-local state into later tests.	2026-06-15 13:10:59 -07:00
Jeremy Daer	ed5a172871	Require authentication for ActiveStorage direct-upload write endpoints ActiveStorage's direct-upload endpoints ship unauthenticated by Rails default: ActiveStorage::DirectUploadsController and DiskController inherit from ActionController::Base, so they bypass the app's Authentication concern. That leaves the write path open — anyone could mint blob records and PUT bytes to local disk storage. Campfire never uses direct upload for legitimate attachments. Those flow through MessagesController#create (already authenticated), and Trix file drops are disabled in the composer. Gating the write path is therefore pure defense-in-depth with no functional cost. Require an authenticated session on the two write actions (DirectUploadsController#create and DiskController#update) by including the existing Authentication concern. Blob serving stays public — DiskController#show keeps its auth skip, and the Blobs/Representations controllers are untouched — so message attachments and the account logo keep loading. Because these controllers live in ActiveStorage::Engine and only see the engine's url helpers, also include the application route helpers so the concern can redirect to new_session_url on failure (302, write blocked).	2026-06-15 13:00:29 -07:00