Merge pull request #284 from basecamp/mention-menu-spacing

Fix mention menu spacing and check the registry login before releasing

.dockerignore

@@ -50,3 +50,6 @@
 
 # Ignore test files
 /test/
+
+# Agent session state — worktrees under .claude/ are whole extra checkouts of this repo
+.claude

.env.erb

@@ -1,4 +1,4 @@
-<% if (session_token = `op signin --account basecamp --raw`.strip) != "" %># Generated by mrsk envify
+<% if (session_token = `op signin --account 23QPQDKZC5BKBIIG7UGT5GR5RM --raw`.strip) != "" %># Generated by mrsk envify
 MRSK_REGISTRY_PASSWORD=<%= `op read "op://Deploy/Docker Hub MRSK/password" -n --session  #{session_token}` %>
 RAILS_MASTER_KEY=<%= `op read "op://Development/Chat-in-a-box/RAILS_MASTER_KEY" -n --session  #{session_token}` %>
 <% else raise ArgumentError, "Session token missing" end %>

.github/dependabot.yml

@@ -0,0 +1,31 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: bundler
+    directory: "/"
+    schedule:
+      interval: weekly
+    cooldown:
+      semver-major-days: 7
+      semver-minor-days: 3
+      semver-patch-days: 2
+      default-days: 7
+      exclude:
+        - "brakeman"
+
+  # No docker ecosystem. Our base image tag is a build arg
+  # (`FROM ruby:$RUBY_VERSION-slim`), which the updater cannot read, so the
+  # entry only ever matched nothing — worse than no entry, because it looked
+  # like coverage. Ruby base image bumps are a manual, reviewed step here, as
+  # they are across the rest of the fleet. Keep Dockerfile, Dockerfile-export
+  # and .ruby-version on the same version by hand.

.github/workflows/ci.yml

@@ -6,16 +6,22 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions: {}
+
 jobs:
   scan:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -25,12 +31,16 @@ jobs:
 
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -38,11 +48,32 @@ jobs:
       - name: Lint code for consistent style
         run: bin/rubocop
 
+  lint-actions:
+    name: GitHub Actions audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run actionlint
+        uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: false
+
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     services:
       redis:
-        image: redis
+        image: redis # zizmor: ignore[unpinned-images] -- version tag is fine for service containers
         ports:
           - 6379:6379
         options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
@@ -51,10 +82,12 @@ jobs:
         run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libsqlite3-0 libvips curl ffmpeg
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
         env:
           REDIS_URL: redis://localhost:6379/0
         with:
@@ -66,9 +99,11 @@ jobs:
 
   test_system:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     services:
       redis:
-        image: redis
+        image: redis # zizmor: ignore[unpinned-images] -- version tag is fine for service containers
         ports:
           - 6379:6379
         options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
@@ -77,10 +112,12 @@ jobs:
         run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libsqlite3-0 libvips curl ffmpeg
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
         env:
           REDIS_URL: redis://localhost:6379/0
         with:

.github/workflows/publish-image.yml

@@ -13,11 +13,7 @@ concurrency:
   group: publish-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-  packages: write
-  id-token: write
-  attestations: write
+permissions: {}
 
 env:
   IMAGE_DESCRIPTION: Campfire is a web-based chat application with multiple rooms, direct messages, file attachments with previews, search, web push notifications, @mentions, and bot integrations. Single-tenant; production-ready image with web app, background jobs, caching, file serving, and SSL.
@@ -27,6 +23,11 @@ jobs:
   build:
     name: Build and push image (${{ matrix.arch }})
     runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
     timeout-minutes: 45
     strategy:
       fail-fast: false
@@ -43,13 +44,15 @@ jobs:
       IMAGE_NAME: ${{ github.repository }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.11.1
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -64,9 +67,20 @@ jobs:
           CANONICAL_IMAGE="${REGISTRY}/${IMAGE_REF,,}"
           echo "canonical=${CANONICAL_IMAGE}" >> "$GITHUB_OUTPUT"
 
+      - name: Compute app version
+        id: version
+        shell: bash
+        run: |
+          set -eu
+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
+          else
+            echo "version=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Extract Docker metadata (tags, labels) with arch suffix
         id: meta
-        uses: docker/metadata-action@v5.8.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ steps.vars.outputs.canonical }}
           tags: |
@@ -84,13 +98,15 @@ jobs:
 
       - name: Build and push (${{ matrix.platform }})
         id: build
-        uses: docker/build-push-action@v6.18.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: Dockerfile
           build-args: |
             OCI_SOURCE=${{ env.SOURCE_URL }}
             OCI_DESCRIPTION=${{ env.IMAGE_DESCRIPTION }}
+            APP_VERSION=${{ steps.version.outputs.version }}
+            GIT_REVISION=${{ github.sha }}
           platforms: ${{ matrix.platform }}
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
@@ -102,7 +118,7 @@ jobs:
 
       - name: Attest image provenance (per-arch)
         if: github.event_name != 'pull_request'
-        uses: actions/attest-build-provenance@v3.0.0
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-name: ${{ steps.vars.outputs.canonical }}
           subject-digest: ${{ steps.build.outputs.digest }}
@@ -113,16 +129,20 @@ jobs:
     needs: build
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     timeout-minutes: 20
     env:
       REGISTRY: ghcr.io
       IMAGE_NAME: ${{ github.repository }}
     steps:
       - name: Set up Docker Buildx (for imagetools)
-        uses: docker/setup-buildx-action@v3.11.1
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -139,7 +159,7 @@ jobs:
 
       - name: Compute base tags (no suffix)
         id: meta
-        uses: docker/metadata-action@v5.8.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ steps.vars.outputs.canonical }}
           tags: |
@@ -157,9 +177,11 @@ jobs:
 
       - name: Create multi-arch manifests
         shell: bash
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           set -eu
-          tags="${{ steps.meta.outputs.tags }}"
+          tags="$TAGS"
           echo "Creating manifests for tags:"
           printf '%s\n' "$tags"
           while IFS= read -r tag; do
@@ -185,13 +207,15 @@ jobs:
           done <<< "$tags"
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v3.9.2
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Cosign sign all tags (keyless OIDC)
         shell: bash
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           set -eu
-          tags="${{ steps.meta.outputs.tags }}"
+          tags="$TAGS"
           printf '%s\n' "$tags"
           while IFS= read -r tag; do
             [ -z "$tag" ] && continue

.ruby-version

@@ -1 +1 @@
-3.4.5
+3.4.10

Dockerfile

@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1
 
 # Make sure it matches the Ruby version in .ruby-version and Gemfile
-ARG RUBY_VERSION=3.4.5
+ARG RUBY_VERSION=3.4.10
 FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base
 
 # Rails app lives here
@@ -26,7 +26,7 @@ FROM base AS build
 
 # Install packages need to build gems
 RUN apt-get update -qq && \
-    apt-get install -y build-essential git pkg-config libyaml-dev  && \
+    apt-get install -y build-essential git pkg-config libyaml-dev libssl-dev && \
     rm -rf /var/lib/apt/lists /var/cache/apt/archives
 
 # Install application gems
@@ -66,6 +66,9 @@ ENV HTTP_WRITE_TIMEOUT=300
 COPY --from=build --chown=rails:rails /usr/local/bundle /usr/local/bundle
 COPY --from=build --chown=rails:rails /rails /rails
 
+# Install ONCE backup/restore hooks
+COPY --chmod=755 hooks /hooks
+
 # Set version and revision
 ARG APP_VERSION
 ENV APP_VERSION=$APP_VERSION

Dockerfile-export

@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1
 
 # Make sure it matches the Ruby version in .ruby-version and Gemfile
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=3.4.10
 FROM ruby:$RUBY_VERSION-slim as base
 
 # Install the tools we need

Gemfile

@@ -12,7 +12,7 @@ gem "sqlite3"
 gem "redis", "~> 5.4"
 
 # Deployment
-gem "puma", "~> 6.6"
+gem "puma", "~> 7.2", ">= 7.2.1"
 
 # Jobs
 gem "resque", "~> 2.7.0"
@@ -26,6 +26,9 @@ gem "importmap-rails", github: "rails/importmap-rails"
 gem "turbo-rails", github: "hotwired/turbo-rails"
 gem "stimulus-rails"
 
+# Rich text
+gem "lexxy", "~> 0.9.24"
+
 # Media handling
 gem "image_processing", ">= 1.2"
 
@@ -41,6 +44,7 @@ gem "rails_autolink"
 gem "geared_pagination"
 gem "jbuilder"
 gem "net-http-persistent"
+gem "surfguard", github: "basecamp/surfguard" # The SSRF address policy behind RestrictedHTTP
 gem "kredis"
 gem "platform_agent"
 gem "thruster"
@@ -48,6 +52,7 @@ gem "thruster"
 group :development, :test do
   gem "debug"
   gem "rubocop-rails-omakase", require: false
+  gem "bundler-audit", require: false
   gem "faker", require: false
   gem "brakeman", require: false
 end

Gemfile.lock

@@ -1,3 +1,9 @@
+GIT
+  remote: https://github.com/basecamp/surfguard.git
+  revision: 59e278c01a537755f22791429051891949231ead
+  specs:
+    surfguard (0.2.0)
+
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
   revision: 30cd8fcc6f82c1ad4edd1ed6069ba878f21f02b3
@@ -128,18 +134,21 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    action_text-trix (2.1.15)
+    action_text-trix (2.1.19)
       railties
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
     base64 (0.3.0)
-    bcrypt (3.1.20)
+    bcrypt (3.1.22)
     benchmark (0.5.0)
     bigdecimal (3.3.1)
-    brakeman (7.1.1)
+    brakeman (8.0.6)
       racc
     builder (3.3.0)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
+      thor (~> 1.0)
     capybara (3.40.0)
       addressable
       matrix
@@ -150,21 +159,22 @@ GEM
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
     chunky_png (1.4.0)
-    concurrent-ruby (1.3.5)
+    concurrent-ruby (1.3.7)
     connection_pool (2.5.5)
     crack (1.0.0)
       bigdecimal
       rexml
-    crass (1.0.6)
-    date (3.5.0)
+    crass (1.0.7)
+    date (3.5.1)
     debug (1.11.0)
       irb (~> 1.10)
       reline (>= 0.3.8)
     drb (2.2.3)
-    erb (6.0.0)
+    erb (6.0.4)
     erubi (1.13.1)
     faker (3.5.2)
       i18n (>= 1.8.11, < 2)
+    ffi (1.17.2)
     ffi (1.17.2-aarch64-linux-gnu)
     ffi (1.17.2-arm64-darwin)
     ffi (1.17.2-x86_64-darwin)
@@ -188,20 +198,22 @@ GEM
     jbuilder (2.14.1)
       actionview (>= 7.0.0)
       activesupport (>= 7.0.0)
-    json (2.13.2)
-    jwt (3.1.2)
+    json (2.21.2)
+    jwt (3.2.0)
       base64
     kredis (1.8.0)
       activemodel (>= 6.0.0)
       activesupport (>= 6.0.0)
       redis (>= 4.2, < 6)
     language_server-protocol (3.17.0.5)
+    lexxy (0.9.24)
+      rails (>= 8.0.2)
     lint_roller (1.1.0)
     logger (1.7.0)
-    loofah (2.24.1)
+    loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    mail (2.9.0)
+    mail (2.9.1)
       logger
       mini_mime (>= 0.1.1)
       net-imap
@@ -213,7 +225,7 @@ GEM
       logger
     mini_mime (1.1.5)
     minitest (5.26.2)
-    mocha (2.7.1)
+    mocha (3.1.0)
       ruby2_keywords (>= 0.0.5)
     mono_logger (1.1.2)
     multi_json (1.17.0)
@@ -221,7 +233,7 @@ GEM
       ruby2_keywords (~> 0.0.1)
     net-http-persistent (4.0.6)
       connection_pool (~> 2.2, >= 2.2.4)
-    net-imap (0.5.12)
+    net-imap (0.6.4.1)
       date
       net-protocol
     net-pop (0.1.2)
@@ -231,15 +243,15 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.5)
-    nokogiri (1.18.10-aarch64-linux-gnu)
+    nokogiri (1.19.4-aarch64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.18.10-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.18.10-x86_64-darwin)
+    nokogiri (1.19.4-x86_64-darwin)
       racc (~> 1.4)
-    nokogiri (1.18.10-x86_64-linux-gnu)
+    nokogiri (1.19.4-x86_64-linux-gnu)
       racc (~> 1.4)
-    openssl (3.3.0)
+    openssl (4.0.2)
     ostruct (0.6.3)
     parallel (1.27.0)
     parser (3.3.9.0)
@@ -256,15 +268,15 @@ GEM
       date
       stringio
     public_suffix (6.0.2)
-    puma (6.6.1)
+    puma (7.2.1)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (3.2.4)
-    rack-protection (4.1.1)
+    rack (3.2.6)
+    rack-protection (4.2.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)
       rack (>= 3.0.0, < 4)
-    rack-session (2.1.1)
+    rack-session (2.1.2)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
     rack-test (2.2.0)
@@ -275,8 +287,8 @@ GEM
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.2)
-      loofah (~> 2.21)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     rails_autolink (1.1.8)
       actionview (> 3.1)
@@ -305,12 +317,12 @@ GEM
     resque-pool (0.7.1)
       rake (>= 10.0, < 14.0)
       resque (>= 1.22, < 3)
-    rexml (3.4.1)
-    rqrcode (3.1.0)
+    rexml (3.4.4)
+    rqrcode (3.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
-    rqrcode_core (2.0.0)
-    rubocop (1.80.0)
+    rqrcode_core (2.1.0)
+    rubocop (1.80.2)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -343,7 +355,7 @@ GEM
       ffi (~> 1.12)
       logger
     ruby2_keywords (0.0.5)
-    rubyzip (3.0.2)
+    rubyzip (3.4.0)
     securerandom (0.4.1)
     selenium-webdriver (4.35.0)
       base64 (~> 0.2)
@@ -357,44 +369,44 @@ GEM
     sentry-ruby (5.26.0)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
-    sinatra (4.1.1)
+    sinatra (4.2.1)
       logger (>= 1.6.0)
       mustermann (~> 3.0)
       rack (>= 3.0.0, < 4)
-      rack-protection (= 4.1.1)
+      rack-protection (= 4.2.1)
       rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    sqlite3 (2.7.3-aarch64-linux-gnu)
-    sqlite3 (2.7.3-arm64-darwin)
-    sqlite3 (2.7.3-x86_64-darwin)
-    sqlite3 (2.7.3-x86_64-linux-gnu)
+    sqlite3 (2.9.6-aarch64-linux-gnu)
+    sqlite3 (2.9.6-arm64-darwin)
+    sqlite3 (2.9.6-x86_64-darwin)
+    sqlite3 (2.9.6-x86_64-linux-gnu)
     stimulus-rails (1.3.4)
       railties (>= 6.0.0)
     stringio (3.1.8)
     thor (1.4.0)
-    thruster (0.1.15-aarch64-linux)
-    thruster (0.1.15-arm64-darwin)
-    thruster (0.1.15-x86_64-darwin)
-    thruster (0.1.15-x86_64-linux)
+    thruster (0.1.23-aarch64-linux)
+    thruster (0.1.23-arm64-darwin)
+    thruster (0.1.23-x86_64-darwin)
+    thruster (0.1.23-x86_64-linux)
     tilt (2.6.1)
-    timeout (0.4.4)
+    timeout (0.6.1)
     tsort (0.2.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    unicode-display_width (3.1.5)
-      unicode-emoji (~> 4.0, >= 4.0.4)
-    unicode-emoji (4.0.4)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.2.0)
     uri (1.1.1)
     useragent (0.16.11)
-    web-push (3.0.2)
+    web-push (3.1.0)
       jwt (~> 3.0)
-      openssl (~> 3.0)
+      openssl (>= 3.0)
     webmock (3.25.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     websocket (1.2.11)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
@@ -412,6 +424,7 @@ DEPENDENCIES
   bcrypt
   benchmark
   brakeman
+  bundler-audit
   capybara
   debug
   faker
@@ -420,12 +433,13 @@ DEPENDENCIES
   importmap-rails!
   jbuilder
   kredis
+  lexxy (~> 0.9.24)
   mocha
   net-http-persistent
   ostruct
   platform_agent
   propshaft!
-  puma (~> 6.6)
+  puma (~> 7.2, >= 7.2.1)
   rails!
   rails_autolink
   redis (~> 5.4)
@@ -438,10 +452,11 @@ DEPENDENCIES
   sentry-ruby
   sqlite3
   stimulus-rails
+  surfguard!
   thruster
   turbo-rails!
   web-push
   webmock
 
 BUNDLED WITH
-   2.5.9
+  4.0.13

README.md

@@ -11,51 +11,49 @@ expect, including:
 - @mentions
 - API, with support for bot integrations
 
-## Deploying with Docker
+## Running your own Campfire instance
 
 Campfire's Docker image contains everything needed for a fully-functional,
 single-machine deployment. This includes the web app, background jobs, caching,
-file serving, and SSL.
+file serving, and SSL. You can use our pre-built image at
+`ghcr.io/basecamp/once-campfire:latest`, or build your own from this repo.
 
-To persist storage of the database and file attachments, map a volume to `/rails/storage`.
+### Deploying with ONCE
 
-To configure additional features, you can set the following environment variables:
+The easiest way to self-host Campfire is with [ONCE](https://github.com/basecamp/once).
+It will guide you through the initial set up and then keep your instance up to date automatically.
 
-- `SSL_DOMAIN` - enable automatic SSL via Let's Encrypt for the given domain name
-- `DISABLE_SSL` - alternatively, set `DISABLE_SSL` to serve over plain HTTP
-- `VAPID_PUBLIC_KEY`/`VAPID_PRIVATE_KEY` - set these to a valid keypair to
-  allow sending Web Push notifications. You can generate a new keypair by running
-  `/script/admin/create-vapid-key`
-- `SENTRY_DSN` - to enable error reporting to sentry in production, supply your
-  DSN here
+If you don't already have `once` installed, run this on the machine you want to run Campfire on:
 
-For example:
+```sh
+curl https://get.once.com | sh
+```
 
-    docker build -t campfire .
+`once` will launch as soon as the install is finished. 
 
-    docker run \
-      --publish 80:80 --publish 443:443 \
-      --restart unless-stopped \
-      --volume campfire:/rails/storage \
-      --env SECRET_KEY_BASE=$YOUR_SECRET_KEY_BASE \
-      --env VAPID_PUBLIC_KEY=$YOUR_PUBLIC_KEY \
-      --env VAPID_PRIVATE_KEY=$YOUR_PRIVATE_KEY \
-      --env TLS_DOMAIN=chat.example.com \
-      campfire
+Choose Campfire from the list of applications, follow the instructions, and ONCE will take care of the rest.
 
-## Running in development
+If you prefer the command line to the dashboard, you can deploy directly:
 
-    bin/setup
-    bin/rails server
+```sh
+once deploy ghcr.io/basecamp/once-campfire --host chat.example.com
+```
 
-## Worth Noting
+### Deploying with Docker
 
-When you start Campfire for the first time, you’ll be guided through
-creating an admin account.
-The email address of this admin account will be shown on the login page
-so that people who forget their password know who to contact for help.
-(You can change this email later in the settings)
+If you'd rather run the Docker image yourself, you can read more about that in the [self-hosting guide](docs/self-hosting.md).
 
-Campfire is single-tenant: any rooms designated "public" will be accessible by
-all users in the system. To support entirely distinct groups of customers, you
-would deploy multiple instances of the application.
+> [!TIP]
+> When you start Campfire for the first time, you'll be guided through a wizard to create an admin account.
+> The email address that you enter for the admin account will be visible on the sign-in page, it's there so
+> that people have someone to contact if they need help with their account. If that bothers you, put in any
+> email address you want and create yourself a new admin account.
+
+## Development
+
+You are welcome - and encouraged - to modify Campfire to your liking.
+Please see our [development guide](docs/development.md) for how to get Campfire set up for local development.
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for how to report a vulnerability and a description of our trust model.

SECURITY.md

@@ -0,0 +1,22 @@
+# Security
+
+Report vulnerabilities through our [HackerOne program](https://hackerone.com/basecamp) or at
+https://github.com/basecamp/once-campfire/security. Note that Campfire is in scope for our security
+program, but is not bounty eligible.
+
+## Trust model
+
+Campfire is self-hosted and single-tenant, so the administrator is the server operator,
+with shell, network, and database access already. Anything requiring the administrator
+role grants nothing they do not already have, and is not a vulnerability.
+
+We do want reports of anything a **non-administrator** can reach, and of any credential or
+network path held by the Campfire process but not by the operator's own shell.
+
+## Intentional behavior
+
+Bot webhook URLs are unrestricted: an administrator can point one at any address,
+including internal ones, because operators legitimately wire bots to their own services.
+Link unfurling is different because any member can trigger it by pasting a URL, so it
+validates destinations through `RestrictedHTTP::PrivateNetworkGuard`. The difference is who
+picks the destination.

app/assets/stylesheets/actiontext.css

@@ -1,165 +1,160 @@
-trix-toolbar {
-  display: none;
-  inset: auto 0 0 0;
-  min-width: 0;
-  position: sticky;
-  z-index: 3;
+/* Resolve Lexxy's palette to Campfire's, in the editor and in rendered messages,
+   so everything follows Campfire's light/dark color scheme */
+.lexxy-content {
+  --lexxy-color-canvas: transparent;
+  --lexxy-color-text: var(--color-text);
+  --lexxy-color-text-subtle: var(--color-text);
+  --lexxy-color-link: var(--color-link);
+  --lexxy-color-ink: var(--color-text);
+  --lexxy-color-ink-inverted: var(--color-text-reversed);
+  --lexxy-color-ink-medium: var(--color-text);
+  --lexxy-color-ink-lighter: var(--color-border-darker);
+  --lexxy-color-ink-lightest: var(--color-bg);
+  --lexxy-color-selected: var(--color-selected, var(--color-bg));
+  --lexxy-color-code-bg: var(--color-bg);
 
-  .trix-dialog {
-    bottom: 3rem !important;
-    top: auto !important;
-  }
-
-  .trix-button--icon {
-    height: auto !important;
-  }
-
-  .trix-dialog {
-    background-color: var(--color-bg) !important;
-    border-radius: 1rem !important;
-    border: 2px solid var(--color-text) !important;
-    box-shadow: none !important;
-    color: var(--color-text) !important;
-    gap: var(--inline-space);
-    padding: 0 !important;
-    overflow: clip;
-
-    .trix-input {
-      background: transparent !important;
-      border: 0 !important;
-      color: var(--color-text) !important;
-      font-size: max(16px, 1em) !important;
-      padding: var(--input-padding, 0.5em 0.8em) !important;
-    }
-
-    .trix-button {
-      color: var(--color-text) !important;
-    }
-  }
-
-  .trix-dialog--link {
-    .trix-dialog__link-fields {
-      align-items: center;
-      padding-right: 0.3em;
-    }
-
-    [value="Link"],
-    [value="Unlink"] {
-      width: 2.6em;
-      aspect-ratio: 1 / 1;
-      background-position: center center;
-      background-repeat: no-repeat;
-      text-indent: -9999%;
-      padding: 0;
-    }
-
-    [value="Link"] { background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' fill='none'%3E%3Cpath fill='%23000' fill-rule='evenodd' d='M18.948 5.258a4.337 4.337 0 0 0-6.108 0L11.217 6.87a.993.993 0 0 0 0 1.41c.392.39 1.027.39 1.418 0l1.623-1.613a2.323 2.323 0 0 1 3.271 0 2.29 2.29 0 0 1 0 3.251l-2.393 2.38a3.021 3.021 0 0 1-4.255 0l-.05-.049a1.007 1.007 0 0 0-1.418 0 .993.993 0 0 0 0 1.41l.05.049a5.036 5.036 0 0 0 7.091 0l2.394-2.38a4.275 4.275 0 0 0 0-6.072Zm-13.683 13.6a4.337 4.337 0 0 0 6.108 0l1.262-1.255a.993.993 0 0 0 0-1.41 1.007 1.007 0 0 0-1.418 0L9.954 17.45a2.323 2.323 0 0 1-3.27 0 2.29 2.29 0 0 1 0-3.251l2.344-2.331a2.579 2.579 0 0 1 3.631 0c.392.39 1.027.39 1.419 0a.993.993 0 0 0 0-1.41 4.593 4.593 0 0 0-6.468 0l-2.345 2.33a4.275 4.275 0 0 0 0 6.072Z' clip-rule='evenodd'/%3E%3C/svg%3E"); }
-
-    [value="Unlink"] {
-      background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' fill='none'%3E%3Cpath fill='%23000' fill-rule='evenodd' d='M18.954 5.264a3.58 3.58 0 0 0-5.04 0l-2.157 2.144a.993.993 0 0 0 0 1.41c.392.39 1.027.39 1.418 0l2.157-2.144a1.565 1.565 0 0 1 2.204 0c.607.603.609 1.58.005 2.186l-2.348 2.355a.993.993 0 0 0 .006 1.41 1.007 1.007 0 0 0 1.419-.007l2.347-2.354a3.528 3.528 0 0 0-.01-5ZM5.257 18.852a3.59 3.59 0 0 0 5.041.015l2.6-2.554a.993.993 0 0 0 .01-1.41 1.007 1.007 0 0 0-1.419-.009l-2.6 2.554c-.615.603-1.603.6-2.214-.006a1.554 1.554 0 0 1-.012-2.195l2.539-2.58a.993.993 0 0 0-.016-1.41 1.007 1.007 0 0 0-1.418.015l-2.539 2.58a3.54 3.54 0 0 0 .028 5Z' clip-rule='evenodd'/%3E%3Cpath stroke='%23000' stroke-linecap='round' stroke-width='2' d='M10.233 5.78V3.769M5.968 9.802H4.21M7.343 7.107 5.968 5.781M14.348 17.523v2.013M18.613 13.502h1.758M17.238 16.196l1.375 1.327'/%3E%3C/svg%3E%0A");
-      border-top-right-radius: 1em !important;
-      border-bottom-right-radius: 1em !important;
-    }
-  }
+  /* Campfire's message lines stack without extra block margins */
+  --lexxy-content-margin: 0;
 }
 
-trix-editor {
+lexxy-editor {
   &.input {
+    --lexxy-editor-padding: 0;
+
+    /* One line high when empty. Lexxy derives this from attr(rows lh, 8lh),
+       whose resolution differs between Chrome versions — pin it instead of
+       risking the 8-line fallback */
+    --lexxy-editor-rows: 1lh;
+
+    background: transparent;
+    border: 0;
+    border-radius: 0;
     min-height: 24px;
   }
 
   .attachment--content {
     margin: 0;
     display: inline-flex;
-
-    .attachment__toolbar {
-      top: 0;
-      z-index: 2;
-    }
   }
 }
 
-.trix-button-group--file-tools,
-.trix-button-group--history-tools {
-  display: none !important;
+/* The mentions menu needs a solid surface — the editor's transparent canvas
+   would let messages show through it */
+.lexxy-prompt-menu {
+  --lexxy-color-canvas: var(--color-bg);
+
+  border: 1px solid var(--color-border-dark);
 }
 
-.trix-button-group,
-.trix-button {
-  border: 0 !important;
-  margin: 0 !important;
-  border-radius: 0.3em !important;
-  box-shadow: none;
+/* Same for the code block language picker: with a transparent canvas the
+   native dropdown renders white-on-white in dark mode */
+lexxy-editor lexxy-code-language-picker select {
+  background-color: var(--color-bg);
+  color: var(--color-text);
 
-  &::before {
-    opacity: 1 !important;
-  }
-
-  @media (prefers-color-scheme: dark) {
-    &::before {
-      filter: invert(100);
-    }
-  }
-
-  &.trix-active {
-    background-color: var(--color-text) !important;
-
-    &::before {
-      filter: invert(100);
-    }
-
-    @media (prefers-color-scheme: dark) {
-      &::before {
-        filter: invert(0);
-      }
-    }
-  }
-
-  &.trix-button--remove {
-    background-color: var(--color-negative);
-    border-radius: 1.8em !important;
-
-    &::before {
-      filter: invert(100);
-      background-size: 70%;
-      background-image: url("minus.svg");
-    }
+  option {
+    background-color: var(--color-bg);
+    color: var(--color-text);
   }
 }
 
-[data-trix-content-type~='application/vnd.campfire.mention'] {
-  .trix-button-group {
-    display: inline;
+/* The toolbar only shows when rich text mode is toggled on (see composer.css) */
+lexxy-toolbar {
+  /* Wide, airy button spacing like the Trix toolbar */
+  --lexxy-toolbar-gap: 1.3em;
+
+  /* Match the compact size of the Trix toolbar buttons */
+  --lexxy-toolbar-button-size: 1.7em;
+  --lexxy-toolbar-icon-size: 1.125em;
+
+  display: none;
+  border-block-end: 0;
+  min-width: 0;
+  z-index: 3;
+
+  /* Tools Campfire doesn't offer, matching the Trix toolbar: underline,
+     color highlights, tables, dividers and undo/redo (history tools were
+     hidden under Trix as well) */
+  button[name="underline"],
+  button[name="table"],
+  button[name="divider"],
+  button[name="undo"],
+  button[name="redo"],
+  lexxy-highlight-dropdown {
+    display: none !important;
+  }
+
+  /* No group separator pipes, like the Trix toolbar */
+  .lexxy-editor__toolbar-button.lexxy-editor__toolbar-group-end::after {
+    display: none;
+  }
+
+  /* Dropdown panels: a solid surface with a uniform radius. Lexxy derives
+     the panel's radius and gap from --lexxy-toolbar-gap, which Campfire
+     repurposes for button spacing */
+  .lexxy-editor__toolbar-dropdown [data-dropdown-panel] {
+    --lexxy-color-canvas: var(--color-bg);
+    --lexxy-color-ink-lightest: var(--color-message-bg);
+    --lexxy-color-selected: var(--color-selected);
+    --lexxy-color-selected-hover: var(--color-message-bg);
+
+    border: 1px solid var(--color-border-dark);
+    border-radius: 0.5em;
+    gap: 0.25em;
+    padding: 0.25em;
+  }
+
+  .lexxy-editor__toolbar-dropdown > .lexxy-editor__toolbar-button[aria-expanded="true"] {
+    border-radius: var(--lexxy-radius);
   }
 }
 
-[data-trix-content-type~="application/vnd.actiontext.opengraph-embed"] {
-  * {
-    text-decoration: none;
-  }
+/* Attachment markup contains formatting whitespace that must not turn into
+   line breaks under the editor's white-space: pre-wrap */
+lexxy-editor action-text-attachment {
+  white-space: normal;
+}
 
-  trix-editor & {
+action-text-attachment[content-type~="application/vnd.campfire.mention"] {
+  display: inline-flex;
+  margin: 0;
+  padding: 0;
+  position: relative;
+}
+
+action-text-attachment[content-type~="application/vnd.actiontext.opengraph-embed"] {
+  lexxy-editor & {
     display: block;
     inline-size: fit-content;
     max-inline-size: 100%;
   }
-}
 
-.trix-button:not(.trix-button--remove) {
-  @media (any-hover: hover) {
-    &:where(:not(:active):hover) {
-      filter: brightness(0.9);
-      background-color: var(--color-bg);
+  /* No selection background — it peeks through the card's rounded corners.
+     The lexxy-editor prefix out-specifies Lexxy's own selection rule. */
+  lexxy-editor &.node--selected {
+    --lexxy-attachment-bg-color: transparent;
+  }
+
+  /* A prominent remove button on the card's top edge, horizontally
+     centered, like the Trix one. The lexxy-editor prefix out-specifies
+     Lexxy's own placement rules. */
+  lexxy-editor & lexxy-node-delete-button {
+    inset-block-start: 0;
+    inset-inline-start: 50%;
+    inset-inline-end: auto;
+    transform: translate(-50%, -50%);
+
+    .lexxy-floating-controls__group {
+      --button-size: 2.2em;
+
+      background-color: var(--color-negative);
+      border-radius: 50%;
+      color: white;
     }
   }
-
-  &:disabled {
-    opacity: 0.33;
-  }
 }
 
-trix-editor,
-.trix-content {
+.lexxy-content {
   pre {
     background-color: var(--color-bg) !important;
     border-radius: 0.5em;
@@ -179,11 +174,13 @@ trix-editor,
   blockquote {
     border: 0 solid var(--color-border-darker) !important;
     border-inline-start-width: var(--blockquote-border) !important;
+    font-style: normal;
     margin: 0 var(--blockquote-margin) !important;
     padding-inline-start: var(--blockquote-padding) !important;
   }
 
   cite {
+    display: block;
     margin-inline-start: calc(var(--blockquote-padding));
     font-style: normal;
     font-size: 0.8rem;
@@ -199,13 +196,14 @@ trix-editor,
     color: var(--color-link);
   }
 
-  ul,
+  /* The composer's mention menu is a list inside the editor too, and keeps Lexxy's own spacing */
+  ul:not(.lexxy-prompt-menu),
   ol {
     margin: 0 !important;
     padding: 0 !important;
   }
 
-  li {
+  li:not(.lexxy-prompt-menu__item) {
     margin: 0 0 0 var(--inline-space-double) !important;
     padding: 0 !important;
   }

app/assets/stylesheets/autocomplete.css

@@ -33,7 +33,7 @@
   }
 }
 
-[data-trix-content-type~='application/vnd.campfire.mention'] {
+action-text-attachment[content-type~='application/vnd.campfire.mention'] {
   display: inline-flex;
   margin: 0;
   padding: 0;

app/assets/stylesheets/buttons.css

@@ -127,6 +127,13 @@
     }
   }
 
+  &:has(input[type=checkbox][disabled]) {
+    cursor: not-allowed;
+    filter: grayscale(100%) contrast(0.5);
+    opacity: 0.5;
+    pointer-events: none;
+  }
+
   [disabled] &[type=submit],
   &[type=submit]:disabled {
     cursor: not-allowed;

app/assets/stylesheets/composer.css

@@ -100,16 +100,42 @@
   }
 
   .composer--rich-text {
-    trix-toolbar {
-      display: block;
+    lexxy-toolbar {
+      display: flex;
     }
 
-    trix-editor.input {
+    lexxy-editor.input {
       margin-block-start: var(--block-space-half);
     }
   }
 
-  .composer--edit trix-toolbar {
+  /* In the message composer the toolbar goes below the text, on the same
+     row as the surrounding action buttons, like the Trix toolbar did.
+     The edit composer keeps it on top. */
+  #composer.composer--rich-text lexxy-editor.input {
+    display: flex;
+    flex-direction: column;
+
+    /* Sit the toolbar row on the same baseline as the composer's round
+       buttons, which pull themselves down with negative margins */
+    margin-block-end: -0.25em;
+
+    .lexxy-editor__content {
+      order: -1;
+    }
+
+    lexxy-toolbar {
+      margin-block-start: 0.4em;
+
+      /* Dropdowns open upward — the toolbar sits at the bottom of the screen */
+      [data-dropdown-panel] {
+        inset-block-start: auto;
+        inset-block-end: 100%;
+      }
+    }
+  }
+
+  .composer--edit lexxy-toolbar {
     border-block-end: 1px solid var(--color-border);
     margin-inline: -0.8em;
     padding-inline: 0.3em;
@@ -117,6 +143,16 @@
   }
 }
 
+/* The editor's container-type prevents it from sizing the message bubble by
+   its content, so give the bubble the full available width while editing */
+.message__body:has(.composer--edit) {
+  inline-size: 100%;
+
+  .message__body-content--editing {
+    flex-grow: 1;
+  }
+}
+
 /* Typing indicator */
 .typing-indicator {
   inset-block-start: var(--indicator-position, 0.15rem);

app/assets/stylesheets/embeds.css

@@ -1,5 +1,5 @@
-trix-editor,
-.trix-content {
+
+.lexxy-content {
   .og-embed {
     background: var(--color-bg);
     border: 1px solid var(--color-border-dark);
@@ -15,7 +15,7 @@ trix-editor,
       flex-direction: row;
     }
 
-    .cf-twitter-avatar & {
+    &.og-embed--twitter-avatar {
       flex-direction: row;
     }
   }
@@ -35,10 +35,11 @@ trix-editor,
 
   .og-embed__title {
     font-weight: 600;
-    text-decoration: underline;
 
+    /* Underline the link itself so the line is link-colored */
     a {
       color: var(--color-link);
+      text-decoration: underline;
     }
   }
 
@@ -53,7 +54,11 @@ trix-editor,
       inline-size: 15dvw;
     }
 
+    /* block-size/border-radius guard against Lexxy's 1em round avatar
+       styling for custom attachment images */
     > * {
+      block-size: auto;
+      border-radius: 0;
       object-position: top right;
       inline-size: 100%;
       object-fit: contain;
@@ -63,7 +68,7 @@ trix-editor,
       }
     }
 
-    .cf-twitter-avatar & {
+    .og-embed--twitter-avatar & {
       aspect-ratio: 1;
       border-radius: 50%;
       inline-size: 2lh;

app/assets/stylesheets/messages.css

@@ -537,7 +537,7 @@ img.message__attachment {
     padding: var(--content-padding-block) 0 var(--content-padding-block) var(--content-padding-inline);
     text-shadow: 0 0 3px var(--color-text-reversed);
 
-    .trix-content {
+    .lexxy-content {
       font-size: 2.4em;
       line-height: 1.4;
     }

app/channels/concerns/room_streams_are_authorized.rb

@@ -0,0 +1,13 @@
+# Prepended onto Turbo::StreamsChannel. The subscriber names the channel it wants, so
+# authorizing room messages only in RoomMessagesChannel would leave the stock channel as
+# a way around it: same signed stream name, no membership check. Turn those names away
+# here and RoomMessagesChannel becomes the only door.
+module RoomStreamsAreAuthorized
+  def subscribed
+    if RoomMessagesChannel.guarded_stream?(verified_stream_name_from_params)
+      reject
+    else
+      super
+    end
+  end
+end

app/channels/room_messages_channel.rb

@@ -0,0 +1,55 @@
+# Authorizes the room message stream when the subscription is made, so that revoking a
+# membership actually stops delivery.
+#
+# Turbo's stock channel verifies only the signature on the stream name. That name carries
+# no expiry and no binding to a user, so one harvested while a member keeps working after
+# the membership is gone. Reconnecting makes it worse rather than better: revoking a
+# membership disconnects the user with reconnect: true, and the client then replays its
+# subscriptions on the fresh socket.
+#
+# The room is derived from the verified stream name rather than taken as a parameter, so
+# there's nothing for a subscriber to point somewhere else. The subscriber also doesn't
+# get to choose the channel: Turbo::StreamsChannel turns these stream names away, so this
+# is the only way onto them. See config/initializers/turbo_streams_authorization.rb.
+class RoomMessagesChannel < ApplicationCable::Channel
+  extend  Turbo::Streams::StreamName
+  include Turbo::Streams::StreamName::ClassMethods
+
+  STREAM_SUFFIX = "messages"
+
+  class << self
+    # True for the stream names this channel exists to guard, whoever is asking.
+    def guarded_stream?(stream_name)
+      stream_name.to_s.split(":", 2).second == STREAM_SUFFIX
+    end
+
+    def subscribable_room(user, stream_name)
+      gid_param, suffix = stream_name.to_s.split(":", 2)
+
+      if suffix == STREAM_SUFFIX && room = room_from(gid_param)
+        user.rooms.find_by(id: room.id)
+      end
+    end
+
+    private
+      def room_from(gid_param)
+        GlobalID::Locator.locate gid_param, only: Room
+      rescue ActiveRecord::RecordNotFound
+        nil
+      end
+  end
+
+  def subscribed
+    if stream_name = authorized_stream_name
+      stream_from stream_name
+    else
+      reject
+    end
+  end
+
+  private
+    def authorized_stream_name
+      stream_name = verified_stream_name_from_params
+      stream_name if stream_name.present? && self.class.subscribable_room(current_user, stream_name)
+    end
+end

app/channels/unread_rooms_channel.rb

@@ -1,5 +1,12 @@
 class UnreadRoomsChannel < ApplicationCable::Channel
+  # Scoped per user, like ReadRoomsChannel. A single global stream would tell every
+  # authenticated connection when any room on the account is active, including closed
+  # rooms and direct conversations they're not part of.
+  def self.stream_name_for(user_id)
+    "user_#{user_id}_unreads"
+  end
+
   def subscribed
-    stream_from "unread_rooms"
+    stream_from self.class.stream_name_for(current_user.id)
   end
 end

app/controllers/accounts/logos_controller.rb

@@ -8,9 +8,8 @@ class Accounts::LogosController < ApplicationController
     if stale?(etag: Current.account)
       expires_in 5.minutes, public: true, stale_while_revalidate: 1.week
 
-      if Current.account&.logo&.attached?
-        logo = Current.account.logo.variant(logo_variant).processed
-        send_png_file ActiveStorage::Blob.service.path_for(logo.key)
+      if (logo_variant = Current.account&.logo_variant(logo_size))
+        send_png_file ActiveStorage::Blob.service.path_for(logo_variant.key)
       else
         send_stock_icon
       end
@@ -23,9 +22,6 @@ class Accounts::LogosController < ApplicationController
   end
 
   private
-    LARGE_SQUARE_PNG_VARIANT = { resize_to_limit: [ 512, 512 ], format: :png }
-    SMALL_SQUARE_PNG_VARIANT = { resize_to_limit: [ 192, 192 ], format: :png }
-
     def send_png_file(path)
       send_file path, content_type: "image/png", disposition: :inline
     end
@@ -38,8 +34,8 @@ class Accounts::LogosController < ApplicationController
       end
     end
 
-    def logo_variant
-      small_logo? ? SMALL_SQUARE_PNG_VARIANT : LARGE_SQUARE_PNG_VARIANT
+    def logo_size
+      small_logo? ? :small : :large
     end
 
     def small_logo?

app/controllers/accounts_controller.rb

@@ -3,7 +3,9 @@ class AccountsController < ApplicationController
   before_action :set_account
 
   def edit
-    set_page_and_extract_portion_from account_users.ordered, per_page: 500
+    users = account_users.ordered.without_bots
+    @administrators, @members = users.partition(&:administrator?)
+    set_page_and_extract_portion_from users, per_page: 500
   end
 
   def update

app/controllers/autocompletable/users_controller.rb

@@ -1,11 +1,26 @@
 class Autocompletable::UsersController < ApplicationController
   def index
     set_page_and_extract_portion_from find_autocompletable_users.with_attached_avatar.ordered, per_page: 20
+
+    respond_to do |format|
+      format.html { render layout: false } # <lexxy-prompt-item> elements for the mentions prompt
+      format.json
+    end
   end
 
   private
     def find_autocompletable_users
-      params[:query].present? ? users_scope.active.filtered_by(params[:query]) : users_scope.active
+      if query.present?
+        users_scope.active.filtered_by(query)
+      else
+        users_scope.active
+      end
+    end
+
+    # The rich text editor's mentions prompt filters with `filter`, the
+    # autocomplete inputs with `query`
+    def query
+      params[:filter].presence || params[:query].presence
     end
 
     def users_scope

app/controllers/concerns/active_storage_authentication.rb

@@ -0,0 +1,9 @@
+module ActiveStorageAuthentication
+  extend ActiveSupport::Concern
+  include Authentication::SessionLookup
+
+  private
+    def require_active_storage_authentication
+      head :unauthorized unless find_session_by_cookie
+    end
+end

app/controllers/concerns/authentication.rb

@@ -67,17 +67,34 @@ module Authentication
       authenticated_as session
     end
 
+    def terminate_current_session
+      Current.session&.destroy!
+      reset_session
+      remove_authentication_cookie
+      disconnect_remote_connections
+    end
+
+    def disconnect_remote_connections
+      Current.user&.reset_remote_connections
+    rescue => error
+      Rails.logger.warn "Could not disconnect remote connections on sign out: #{error.class}"
+    end
+
     def authenticated_as(session)
-      Current.user = session.user
+      Current.session = session
       set_authenticated_by(:session)
-      cookies.signed.permanent[:session_token] = { value: session.token, httponly: true, same_site: :lax }
+      set_authentication_cookie(session)
     end
 
     def post_authenticating_url
       session.delete(:return_to_after_authenticating) || root_url
     end
 
-    def reset_authentication
+    def set_authentication_cookie(session)
+      cookies.signed.permanent[:session_token] = { value: session.token, httponly: true, same_site: :lax }
+    end
+
+    def remove_authentication_cookie
       cookies.delete(:session_token)
     end
 

app/controllers/concerns/raw_request_body.rb

@@ -0,0 +1,12 @@
+module RawRequestBody
+  extend ActiveSupport::Concern
+
+  private
+
+  def raw_request_body
+    request.body.rewind
+    request.body.read.force_encoding("UTF-8")
+  ensure
+    request.body.rewind
+  end
+end

app/controllers/first_runs_controller.rb

@@ -11,6 +11,8 @@ class FirstRunsController < ApplicationController
     user = FirstRun.create!(user_params)
     start_new_session_for user
 
+    redirect_to root_url
+  rescue ActiveRecord::RecordNotUnique
     redirect_to root_url
   end
 

app/controllers/messages/boosts/by_bots_controller.rb

@@ -0,0 +1,39 @@
+class Messages::Boosts::ByBotsController < Messages::BoostsController
+  include RawRequestBody
+
+  allow_bot_access only: %i[ create destroy ]
+
+  before_action :ensure_content_present, only: :create
+
+  def create
+    @boost = @message.boosts.create!(boost_params)
+
+    broadcast_create
+    render :show, status: :created
+  end
+
+  private
+    def set_message
+      if room = Current.user.rooms.find_by(id: params[:room_id])
+        @message = room.messages.find_by(id: params[:message_id])
+      end
+
+      head :not_found unless @message
+    end
+
+    def set_boost
+      super
+    rescue ActiveRecord::RecordNotFound
+      head :not_found
+    end
+
+    def ensure_content_present
+      if raw_request_body.blank?
+        head :unprocessable_content
+      end
+    end
+
+    def boost_params
+      { content: raw_request_body }
+    end
+end

app/controllers/messages/boosts_controller.rb

@@ -1,5 +1,6 @@
 class Messages::BoostsController < ApplicationController
   before_action :set_message
+  before_action :set_boost, only: :destroy
 
   def index
   end
@@ -15,7 +16,6 @@ class Messages::BoostsController < ApplicationController
   end
 
   def destroy
-    @boost = Current.user.boosts.find(params[:id])
     @boost.destroy!
 
     broadcast_remove
@@ -26,6 +26,10 @@ class Messages::BoostsController < ApplicationController
       @message = Current.user.reachable_messages.find(params[:message_id])
     end
 
+    def set_boost
+      @boost = @message.boosts.find_by!(id: params[:id], booster: Current.user)
+    end
+
     def boost_params
       params.require(:boost).permit(:content)
     end

app/controllers/messages/by_bots_controller.rb

@@ -1,24 +1,64 @@
 class Messages::ByBotsController < MessagesController
-  allow_bot_access only: :create
+  include RawRequestBody
+
+  allow_bot_access only: %i[ index create update destroy ]
+
+  before_action :set_room
+  before_action :set_message, only: %i[ update destroy ]
+  before_action :ensure_can_administer, only: %i[ update destroy ]
+  before_action :ensure_body_or_attachment_present, only: :create
+
+  def index
+    @messages = find_paged_messages
+    set_pagination_headers
+  end
 
   def create
     super
     head :created, location: message_url(@message)
   end
 
+  def destroy
+    super
+    head :no_content
+  end
+
   private
+    def set_room
+      @room = Current.user.rooms.find_by(id: params[:room_id])
+
+      head :not_found unless @room
+    end
+
+    def ensure_body_or_attachment_present
+      if params[:attachment].blank? && raw_request_body.blank?
+        head :unprocessable_content
+      end
+    end
+
+    def set_pagination_headers
+      headers["X-Total-Count"] = @room.messages.count.to_s
+
+      if next_page = next_page_params
+        headers["Link"] = %(<#{room_bot_messages_url(@room, params[:bot_key], **next_page)}>; rel="next")
+      end
+    end
+
+    def next_page_params
+      if @messages.any?
+        if params[:after].present?
+          { after: @messages.last.id } if @room.messages.after(@messages.last).exists?
+        else
+          { before: @messages.first.id } if @room.messages.before(@messages.first).exists?
+        end
+      end
+    end
+
     def message_params
       if params[:attachment]
         params.permit(:attachment)
       else
-        reading(request.body) { |body| { body: body } }
+        { body: raw_request_body }
       end
     end
-
-    def reading(io)
-      io.rewind
-      yield io.read.force_encoding("UTF-8")
-    ensure
-      io.rewind
-    end
 end

app/controllers/messages_controller.rb

@@ -37,7 +37,11 @@ class MessagesController < ApplicationController
     @message.update!(message_params)
 
     @message.broadcast_replace_to @room, :messages, target: [ @message, :presentation ], partial: "messages/presentation", attributes: { maintain_scroll: true }
-    redirect_to room_message_url(@room, @message)
+
+    respond_to do |format|
+      format.html { redirect_to room_message_url(@room, @message) }
+      format.json { render :show }
+    end
   end
 
   def destroy

app/controllers/rooms/closeds_controller.rb

@@ -42,6 +42,12 @@ class Rooms::ClosedsController < RoomsController
       @room = @room.becomes!(Rooms::Closed)
     end
 
+    # Open and closed rooms convert into each other, so both are in reach here. Direct
+    # rooms never are: converting one would let its creator revise who's in it.
+    def room_scope
+      Current.user.rooms.without_directs
+    end
+
     def grantees
       User.where(id: grantee_ids)
     end

app/controllers/rooms/directs_controller.rb

@@ -29,8 +29,13 @@ class Rooms::DirectsController < RoomsController
       end
     end
 
-    # All users in a direct room can administer it
+    # All users in a direct room can administer it. Only direct rooms, though: this
+    # relaxation is why room_scope below has to keep every other type out of reach.
     def ensure_can_administer
       true
     end
+
+    def room_scope
+      Current.user.rooms.directs
+    end
 end

app/controllers/rooms/involvements_controller.rb

@@ -1,8 +1,6 @@
 class Rooms::InvolvementsController < ApplicationController
   include RoomScoped
 
-  before_action :ensure_can_administer, only: %i[ update ]
-
   def show
     @involvement = @membership.involvement
   end

app/controllers/rooms/opens_controller.rb

@@ -40,6 +40,12 @@ class Rooms::OpensController < RoomsController
       @room = @room.becomes!(Rooms::Open)
     end
 
+    # Open and closed rooms convert into each other, so both are in reach here. Direct
+    # rooms never are: promoting one would republish its history to the whole account.
+    def room_scope
+      Current.user.rooms.without_directs
+    end
+
     def broadcast_create_room(room)
       broadcast_prepend_to :rooms, target: :shared_rooms, partial: "users/sidebars/rooms/shared", locals: { room: room }
     end

app/controllers/rooms_controller.rb

@@ -20,13 +20,19 @@ class RoomsController < ApplicationController
 
   private
     def set_room
-      if room = Current.user.rooms.find_by(id: params[:room_id] || params[:id])
+      if room = room_scope.find_by(id: params[:room_id] || params[:id])
         @room = room
       else
         redirect_to root_url, alert: "Room not found or inaccessible"
       end
     end
 
+    # Subclasses narrow this to the room types they're allowed to act on, so that one
+    # room namespace can't be used to reach another's rooms.
+    def room_scope
+      Current.user.rooms
+    end
+
     def ensure_can_administer
       head :forbidden unless Current.user.can_administer?(@room)
     end

app/controllers/sessions_controller.rb

@@ -18,7 +18,7 @@ class SessionsController < ApplicationController
 
   def destroy
     remove_push_subscription
-    reset_authentication
+    terminate_current_session
     redirect_to root_url
   end
 

app/controllers/users/avatars_controller.rb

@@ -9,8 +9,7 @@ class Users::AvatarsController < ApplicationController
     if stale?(etag: @user)
       expires_in 30.minutes, public: true, stale_while_revalidate: 1.week
 
-      if @user.avatar.attached?
-        avatar_variant = @user.avatar.variant(SQUARE_WEBP_VARIANT).processed
+      if (avatar_variant = @user.avatar_variant)
         send_webp_blob_file avatar_variant.key
       elsif @user.bot?
         render_default_bot
@@ -26,8 +25,6 @@ class Users::AvatarsController < ApplicationController
   end
 
   private
-    SQUARE_WEBP_VARIANT = { resize_to_limit: [ 512, 512 ], format: :webp }
-
     def send_webp_blob_file(key)
       send_file ActiveStorage::Blob.service.path_for(key), content_type: "image/webp", disposition: :inline
     end

app/controllers/users/push_subscriptions_controller.rb

@@ -6,12 +6,17 @@ class Users::PushSubscriptionsController < ApplicationController
 
   def create
     if subscription = @push_subscriptions.find_by(push_subscription_params)
-      subscription.touch
+      # Existing endpoints must pass current validations
+      if subscription.valid?
+        subscription.touch
+        head :ok
+      else
+        head :unprocessable_entity
+      end
     else
-      @push_subscriptions.create! push_subscription_params.merge(user_agent: request.user_agent)
+      subscription = @push_subscriptions.create push_subscription_params.merge(user_agent: request.user_agent)
+      head subscription.persisted? ? :ok : :unprocessable_entity
     end
-
-    head :ok
   end
 
   def destroy

app/controllers/users/sidebars_controller.rb

@@ -16,7 +16,7 @@ class Users::SidebarsController < ApplicationController
 
     def find_direct_placeholder_users
       exclude_user_ids = user_ids_already_in_direct_rooms_with_current_user.including(Current.user.id)
-      User.active.where.not(id: exclude_user_ids).order(:created_at).limit(DIRECT_PLACEHOLDERS - exclude_user_ids.count)
+      User.active.where.not(id: exclude_user_ids).order(:created_at).limit([ DIRECT_PLACEHOLDERS - exclude_user_ids.count, 0 ].max)
     end
 
     def user_ids_already_in_direct_rooms_with_current_user

app/helpers/content_filters.rb

@@ -1,3 +1,13 @@
 module ContentFilters
-  TextMessagePresentationFilters = ActionText::Content::Filters.new(RemoveSoloUnfurledLinkText, StyleUnfurledTwitterAvatars, SanitizeTags)
+  # Formatting the rich text editor produces that Rails' sanitizers don't
+  # allow by default. A message passes through three sanitization layers on
+  # its way to the screen, and each builds on this list:
+  #
+  #   * SanitizeTags strips disallowed markup from the message body
+  #   * Action Text sanitizes the rendered content (lib/rails_ext/action_text_allowed_tags.rb)
+  #   * auto_link re-sanitizes the final html (MessagesHelper#message_presentation)
+  EDITOR_FORMATTING_TAGS = %w[ s u mark table thead tbody tfoot tr th td ]
+  EDITOR_FORMATTING_ATTRIBUTES = %w[ data-language ]
+
+  TextMessagePresentationFilters = ActionText::Content::Filters.new(RemoveSoloUnfurledLinkText, SanitizeTags, SanitizeAttributes)
 end

app/helpers/content_filters/remove_solo_unfurled_link_text.rb

@@ -1,18 +1,22 @@
 class ContentFilters::RemoveSoloUnfurledLinkText < ActionText::Content::Filter
+  TWITTER_DOMAINS = %w[ x.com twitter.com ]
+  TWITTER_DOMAIN_MAPPING = { "x.com" => "twitter.com" }
+
   def applicable?
     normalize_tweet_url(solo_unfurled_url) == normalize_tweet_url(content.to_plain_text)
   end
 
   def apply
-    fragment.replace("div") { |node| node.tap { |n| n.inner_html = unfurled_links.first.to_s } }
+    if trix_body?
+      remove_link_text_from_wrapping_div
+    else
+      remove_link_paragraphs
+    end
   end
 
   private
-    TWITTER_DOMAINS = %w[ x.com twitter.com ]
-    TWITTER_DOMAIN_MAPPING = { "x.com" => "twitter.com" }
-
     def solo_unfurled_url
-      unfurled_links.first["href"] if unfurled_links.size == 1
+      ActionText::Attachment::OpengraphEmbed.from_node(unfurled_links.first)&.href if unfurled_links.size == 1
     end
 
     def unfurled_links
@@ -35,4 +39,20 @@ class ContentFilters::RemoveSoloUnfurledLinkText < ActionText::Content::Filter
     def twitter_url?(url)
       url.present? && TWITTER_DOMAINS.any? { |domain| url.strip.include?(domain) }
     end
+
+    def trix_body?
+      fragment.find_all("div").any?
+    end
+
+    def remove_link_text_from_wrapping_div
+      fragment.replace("div") { |node| node.tap { |n| n.inner_html = unfurled_links.first.to_s } }
+    end
+
+    def remove_link_paragraphs
+      fragment.replace("p") do |node|
+        if node.at_css("action-text-attachment")
+          node
+        end
+      end
+    end
 end

app/helpers/content_filters/sanitize_attributes.rb

@@ -0,0 +1,47 @@
+class ContentFilters::SanitizeAttributes < ActionText::Content::Filter
+  def applicable?
+    true
+  end
+
+  # Scrub attributes on the tags that SanitizeTags allows, using Rails' safe-list
+  # sanitizer so unsafe URI schemes and event-handler attributes are stripped.
+  # Runs after SanitizeTags, so passing the same allowed tags makes the tag pass
+  # a no-op and only attributes are scrubbed.
+  def apply
+    sanitizer.sanitize fragment.to_html, tags: allowed_tags, attributes: allowed_attributes
+  end
+
+  private
+    # Presentation styling relies on class attributes (e.g. unfurled link embeds),
+    # which the standard ActionText set doesn't include.
+    EXTRA_ALLOWED_ATTRIBUTES = %w[ class ]
+
+    # ActionText::ContentHelper.sanitizer is a single process-wide instance, and
+    # rails-html-sanitizer reuses one mutable permit scrubber that it reconfigures
+    # from the tags/attributes on every #sanitize call. Sharing it here would race
+    # our stricter tag set against ActionText's default rendering on concurrent
+    # requests, so use a dedicated instance of the same sanitizer class to keep the
+    # scrubber isolated.
+    def sanitizer
+      sanitizer_class.new
+    end
+
+    def sanitizer_class
+      ActionText::ContentHelper.sanitizer.class
+    end
+
+    def allowed_tags
+      ContentFilters::SanitizeTags::ALLOWED_TAGS
+    end
+
+    def allowed_attributes
+      standard_allowed_attributes + EXTRA_ALLOWED_ATTRIBUTES
+    end
+
+    # Mirrors ActionText::ContentHelper#sanitizer_allowed_attributes, which isn't
+    # exposed at the module level.
+    def standard_allowed_attributes
+      ActionText::ContentHelper.allowed_attributes ||
+        (sanitizer_class.allowed_attributes + ActionText::Attachment::ATTRIBUTES).to_a
+    end
+end

app/helpers/content_filters/sanitize_tags.rb

@@ -1,4 +1,8 @@
 class ContentFilters::SanitizeTags < ActionText::Content::Filter
+  ALLOWED_TAGS = %w[ a abbr acronym address b big blockquote br cite code dd del dfn div dl dt em h1 h2 h3 h4 h5 h6 hr i ins kbd li ol
+    p pre samp small span strong sub sup time tt ul var ] + ContentFilters::EDITOR_FORMATTING_TAGS +
+    [ ActionText::Attachment.tag_name, "figure", "figcaption" ]
+
   def applicable?
     true
   end
@@ -8,9 +12,6 @@ class ContentFilters::SanitizeTags < ActionText::Content::Filter
   end
 
   private
-    ALLOWED_TAGS = %w[ a abbr acronym address b big blockquote br cite code dd del dfn div dl dt em h1 h2 h3 h4 h5 h6 hr i ins kbd li ol
-      p pre samp small span strong sub sup time tt ul var ] + [ ActionText::Attachment.tag_name, "figure", "figcaption" ]
-
     def not_allowed_tags_css_selector
       ALLOWED_TAGS.map { |tag| ":not(#{tag})" }.join("")
     end

app/helpers/content_filters/style_unfurled_twitter_avatars.rb

@@ -1,24 +0,0 @@
-class ContentFilters::StyleUnfurledTwitterAvatars < ActionText::Content::Filter
-  def applicable?
-    unfurled_twitter_avatars.present?
-  end
-
-  def apply
-    fragment.update do |source|
-      div = source.at_css("div")
-      div["class"] = UNFURLED_TWITTER_AVATAR_CSS_CLASS
-    end
-  end
-
-  private
-    UNFURLED_TWITTER_AVATAR_CSS_CLASS = "cf-twitter-avatar"
-    TWITTER_AVATAR_URL_PREFIX = "https://pbs.twimg.com/profile_images"
-
-    def unfurled_twitter_avatars
-      fragment.find_all("#{opengraph_css_selector}[url*='#{TWITTER_AVATAR_URL_PREFIX}']")
-    end
-
-    def opengraph_css_selector
-      "action-text-attachment[@content-type='#{ActionText::Attachment::OpengraphEmbed::OPENGRAPH_EMBED_CONTENT_TYPE}']"
-    end
-end

app/helpers/messages_helper.rb

@@ -1,4 +1,9 @@
 module MessagesHelper
+  # auto_link re-sanitizes with Rails' default safe list, which lacks the
+  # formatting the rich text editor produces
+  AUTO_LINK_ALLOWED_TAGS = Rails::HTML5::SafeListSanitizer.allowed_tags + ContentFilters::EDITOR_FORMATTING_TAGS
+  AUTO_LINK_ALLOWED_ATTRIBUTES = Rails::HTML5::SafeListSanitizer.allowed_attributes + ContentFilters::EDITOR_FORMATTING_ATTRIBUTES
+
   def message_area_tag(room, &)
     tag.div id: "message-area", class: "message-area", contents: true, data: {
       controller: "messages presence drop-target",
@@ -57,7 +62,8 @@ module MessagesHelper
     when "sound"
       message_sound_presentation(message)
     else
-      auto_link h(ContentFilters::TextMessagePresentationFilters.apply(message.body.body)), html: { target: "_blank" }
+      auto_link h(ContentFilters::TextMessagePresentationFilters.apply(message.body.body)),
+        html: { target: "_blank" }, sanitize_options: { tags: AUTO_LINK_ALLOWED_TAGS, attributes: AUTO_LINK_ALLOWED_ATTRIBUTES }
     end
   rescue Exception => e
     Sentry.capture_exception(e, extra: { message: message })

app/helpers/rich_text_helper.rb

@@ -1,11 +1,33 @@
 module RichTextHelper
   def rich_text_data_actions
-    default_actions =
-      "trix-change->typing-notifications#start keydown->composer#submitByKeyboard"
+    # submitByKeyboard runs in the capture phase so it can submit on Enter
+    # before the editor turns the keystroke into a newline
+    "lexxy:change->typing-notifications#start keydown->composer#submitByKeyboard:capture"
+  end
 
-    autocomplete_actions =
-      "trix-focus->rich-autocomplete#focus trix-change->rich-autocomplete#search trix-blur->rich-autocomplete#blur"
+  def mention_prompt_tag(room)
+    tag.lexxy_prompt trigger: "@", name: "mention", src: autocompletable_users_path(room_id: room.id),
+      "remote-filtering": true, "empty-results": "No matches"
+  end
 
-    [ default_actions, autocomplete_actions ].join(" ")
+  # The editor keeps an attachment's content as it finds it, so every
+  # attachment is rebuilt from its attachable before editing: a Trix-era
+  # embed carries its details as node attributes the editor doesn't
+  # round-trip, a mention edited under Trix carries the generic content type
+  # the editor doesn't permit, and a hand-written embed carries whatever
+  # markup the author put there.
+  def editable_body(message)
+    fragment = ActionText::Fragment.wrap(message.body.body_before_type_cast)
+
+    transformed = fragment.replace(ActionText::Attachment.tag_name) do |node|
+      attachment = ActionText::Attachment.from_node(node)
+
+      node.tap do |n|
+        n["content-type"] = attachment.attachable.attachable_content_type
+        n["content"] = render_action_text_attachment(attachment)
+      end
+    end
+
+    ActionText::RichText.new(body: transformed.to_html)
   end
 end

app/helpers/rooms_helper.rb

@@ -73,12 +73,12 @@ module RoomsHelper
     def composer_data_actions
       drag_and_drop_actions = "drop-target:drop@window->composer#dropFiles"
 
-      trix_attachment_actions =
-        "trix-file-accept->composer#preventAttachment refresh-room:online@window->composer#online"
+      attachment_actions =
+        "lexxy:file-accept->composer#preventAttachment refresh-room:online@window->composer#online"
 
       remaining_actions =
         "typing-notifications#stop paste->composer#pasteFiles turbo:submit-end->composer#submitEnd refresh-room:offline@window->composer#offline"
 
-      [ drop_target_actions, drag_and_drop_actions, trix_attachment_actions, remaining_actions ].join(" ")
+      [ drop_target_actions, drag_and_drop_actions, attachment_actions, remaining_actions ].join(" ")
     end
 end

app/javascript/application.js

@@ -1,6 +1,4 @@
 // Configure your import map in config/importmap.rb. Read more: https://github.com/rails/importmap-rails
 import "@hotwired/turbo-rails"
-import "trix"
-import "@rails/actiontext"
 import "initializers"
 import "controllers"

app/javascript/controllers/composer_controller.js

@@ -1,7 +1,7 @@
 import { Controller } from "@hotwired/stimulus"
 import FileUploader from "models/file_uploader"
 import { onNextEventLoopTick, nextFrame } from "helpers/timing_helpers"
-import { escapeHTML } from "helpers/dom_helpers"
+import { escapeHTML } from "helpers/string_helpers"
 
 export default class extends Controller {
   static classes = ["toolbar"]
@@ -12,11 +12,21 @@ export default class extends Controller {
   #files = []
 
   connect() {
+    this.#restoreDraft()
+
     if (!this.#usingTouchDevice) {
       onNextEventLoopTick(() => this.textTarget.focus())
     }
   }
 
+  saveDraft() {
+    if (this.textTarget.isBlank) {
+      localStorage.removeItem(this.#draftKey)
+    } else {
+      localStorage.setItem(this.#draftKey, this.textTarget.value)
+    }
+  }
+
   submit(event) {
     event.preventDefault()
 
@@ -44,21 +54,20 @@ export default class extends Controller {
   }
 
   replaceMessageContent(content) {
-    const editor = this.textTarget.editor
-
-    editor.recordUndoEntry("Format reply")
-    editor.setSelectedRange([0, editor.getDocument().toString().length])
-    editor.deleteInDirection("forward")
-    editor.insertHTML(content)
-    editor.setSelectedRange([editor.getDocument().toString().length - 1])
+    this.textTarget.value = content
+    this.textTarget.focus()
+    this.textTarget.selection.placeCursorAtTheEnd()
   }
 
   submitByKeyboard(event) {
+    if (event.key != "Enter" || this.textTarget.hasOpenPrompt) return
+
     const toolbarVisible = this.element.classList.contains(this.toolbarClass)
-    const metaEnter = event.key == "Enter" && (event.metaKey || event.ctrlKey)
-    const plainEnter = event.keyCode == 13 && !event.shiftKey && !event.isComposing
+    const metaEnter = event.metaKey || event.ctrlKey
+    const plainEnter = !event.shiftKey && !event.isComposing
 
     if (!this.#usingTouchDevice && (metaEnter || (plainEnter && !toolbarVisible))) {
+      event.stopPropagation()
       this.submit(event)
     }
   }
@@ -108,6 +117,19 @@ export default class extends Controller {
     this.fieldsTarget.disabled = true
   }
 
+  #restoreDraft() {
+    const draft = localStorage.getItem(this.#draftKey)
+
+    if (draft) {
+      this.textTarget.value = draft
+      this.textTarget.selection.placeCursorAtTheEnd()
+    }
+  }
+
+  get #draftKey() {
+    return `composer-draft-${this.roomIdValue}`
+  }
+
   get #usingTouchDevice() {
     return 'ontouchstart' in window || navigator.maxTouchPoints > 0 || navigator.msMaxTouchPoints > 0;
   }
@@ -126,7 +148,7 @@ export default class extends Controller {
   }
 
   #validInput() {
-    return this.textTarget.textContent.trim().length > 0
+    return !this.textTarget.isBlank
   }
 
   async #submitFiles() {
@@ -159,6 +181,7 @@ export default class extends Controller {
 
   #reset() {
     this.textTarget.value = ""
+    localStorage.removeItem(this.#draftKey)
   }
 
   #updateFileList() {

app/javascript/controllers/messages_controller.js

@@ -89,7 +89,7 @@ export default class extends Controller {
   }
 
   async editMyLastMessage() {
-    const editorEmpty = document.querySelector("#composer trix-editor").matches(":empty")
+    const editorEmpty = document.querySelector("#composer lexxy-editor").isBlank
 
     if (editorEmpty && this.#paginator.upToDate) {
       this.#myLastMessage?.querySelector(".message__edit-btn")?.click()

app/javascript/controllers/reply_controller.js

@@ -11,7 +11,7 @@ export default class extends Controller {
   }
 
   reply() {
-    const content = `<blockquote>${this.#bodyContent}</blockquote><cite>${this.authorTarget.innerHTML} ${this.#linkToOriginal}</cite><br>`
+    const content = `<blockquote>${this.#bodyContent}</blockquote><cite>${this.authorTarget.innerHTML} ${this.#linkToOriginal}</cite><p><br></p>`
     this.composerOutlet.replaceMessageContent(content)
   }
 
@@ -23,7 +23,7 @@ export default class extends Controller {
   }
 
   get #bodyContent() {
-    const body = this.bodyTarget.querySelector(".trix-content").cloneNode(true)
+    const body = this.bodyTarget.querySelector(".lexxy-content").cloneNode(true)
     return this.#stripMentionAttachments(this.#stripUnfurledAttachments(body)).innerHTML
   }
 

app/javascript/controllers/rich_autocomplete_controller.js

@@ -1,46 +0,0 @@
-import { Controller } from "@hotwired/stimulus"
-import MentionsAutocompleteHandler from "lib/autocomplete/mentions_autocomplete_handler"
-import { debounce } from "helpers/timing_helpers"
-
-export default class extends Controller {
-  static values = { url: String }
-
-  initialize() {
-    this.handlers = []
-    this.search = debounce(this.search.bind(this), 300)
-  }
-
-  connect() {
-    if (this.element == document.activeElement) {
-      this.#installHandlers()
-    }
-  }
-
-  focus(event) {
-    this.#installHandlers()
-  }
-
-  search(event) {
-    const content = this.editor.getDocument().toString()
-    const position = this.editor.getPosition()
-    this.handlers.forEach(handler => handler.updateWithContentAndPosition(content, position))
-  }
-
-  blur(event) {
-    this.#uninstallHandlers()
-  }
-
-  #installHandlers() {
-    this.#uninstallHandlers()
-    this.handlers = [ new MentionsAutocompleteHandler(this.element, this.urlValue) ]
-  }
-
-  #uninstallHandlers() {
-    this.handlers.forEach(handler => handler.destroy())
-    this.handlers = []
-  }
-
-  get editor() {
-    return this.element.editor
-  }
-}

app/javascript/controllers/unfurl_controller.js

@@ -0,0 +1,84 @@
+import { Controller } from "@hotwired/stimulus"
+import { post } from "@rails/request.js"
+import { escapeHTML, truncateString } from "helpers/string_helpers"
+
+const OPENGRAPH_EMBED_CONTENT_TYPE = "application/vnd.actiontext.opengraph-embed"
+
+const UNFURLED_TWITTER_AVATAR_CSS_CLASS = "og-embed--twitter-avatar"
+const TWITTER_AVATAR_URL_PREFIX = "https://pbs.twimg.com/profile_images"
+
+export default class extends Controller {
+  #abortController
+
+  disconnect() {
+    this.#abortController?.abort()
+  }
+
+  async unfurl(event) {
+    if (!this.element.permitsAttachmentContentType(OPENGRAPH_EMBED_CONTENT_TYPE)) return
+
+    const { url, insertBelowLink } = event.detail
+
+    const metadata = await this.#fetchOpengraphMetadata(url)
+
+    if (metadata) {
+      insertBelowLink(this.#opengraphEmbedHTML(metadata), { attachment: { contentType: OPENGRAPH_EMBED_CONTENT_TYPE } })
+    }
+  }
+
+  async #fetchOpengraphMetadata(url) {
+    this.#abortController?.abort()
+    this.#abortController = new AbortController()
+
+    try {
+      const response = await post("/unfurl_link", {
+        body: { url },
+        contentType: "application/json",
+        signal: this.#abortController.signal
+      })
+
+      if (response.ok && response.statusCode !== 204) {
+        const { title, url: href, image, description } = await response.json
+        if (title && href) return { title, href, image, description }
+      }
+    } catch {
+      // Ignore aborted and failed requests
+    }
+
+    return null
+  }
+
+  #opengraphEmbedHTML({ title, href, image, description }) {
+    return `<actiontext-opengraph-embed>
+      <div class="og-embed gap ${this.#embedClass(image)}">
+        <div class="og-embed__content">
+          <div class="og-embed__title">
+            <a href="${escapeHTML(href)}" rel="noreferrer" target="_blank">${escapeHTML(truncateString(title, 280))}</a>
+          </div>
+          <div class="og-embed__description">${escapeHTML(truncateString(description, 560))}</div>
+        </div>
+        ${this.#imageHTML(image)}
+      </div>
+    </actiontext-opengraph-embed>`
+  }
+
+  #embedClass(image) {
+    if (this.#isTwitterAvatar(image)) {
+      return UNFURLED_TWITTER_AVATAR_CSS_CLASS
+    } else {
+      return ""
+    }
+  }
+
+  #isTwitterAvatar(image) {
+    return Boolean(image) && image.startsWith(TWITTER_AVATAR_URL_PREFIX)
+  }
+
+  #imageHTML(image) {
+    if (image) {
+      return `<div class="og-embed__image"><img src="${escapeHTML(image)}" class="image center" alt="" /></div>`
+    } else {
+      return ""
+    }
+  }
+}

app/javascript/helpers/dom_helpers.js

@@ -4,12 +4,6 @@ export function scrollToBottom(container) {
   container.scrollTop = container.scrollHeight
 }
 
-export function escapeHTML(html) {
-  const div = document.createElement("div")
-  div.textContent = html
-  return div.innerHTML
-}
-
 export function parseHTMLFragment(html) {
   const template = document.createElement("template")
   template.innerHTML = html

app/javascript/helpers/string_helpers.js

@@ -1,3 +1,5 @@
+const HTML_ESCAPES = { "&": "&amp;", "<": "&lt;", ">": "&gt;", "\"": "&quot;", "'": "&#39;" }
+
 export function truncateString(string, length, omission = "…") {
   if (string.length <= length) {
     return string
@@ -5,3 +7,7 @@ export function truncateString(string, length, omission = "…") {
     return string.slice(0, length - omission.length) + omission
   }
 }
+
+export function escapeHTML(string) {
+  return String(string ?? "").replace(/[&<>"']/g, character => HTML_ESCAPES[character])
+}

app/javascript/initializers/rich_text.js

@@ -1,10 +1,19 @@
-import Unfurler from "lib/rich_text/unfurl/unfurler"
+import * as Lexxy from "lexxy"
+import CampfireRichTextExtension from "lib/rich_text/campfire_extension"
 
-// Support a `cite` block for attribution links
-Trix.config.blockAttributes.cite = {
-  tagName: "cite",
-  inheritable: false,
-}
+Lexxy.configure({
+  global: {
+    // Keep the content type of mention attachments (application/vnd.campfire.mention)
+    // that Campfire has used since its Trix days
+    attachmentContentTypeNamespace: "campfire",
+    extensions: [ CampfireRichTextExtension ]
+  },
+  default: {
+    // Campfire sends files as separate messages via the composer's own
+    // attach button, never through the editor
+    toolbar: { attachments: false },
 
-const unfurler = new Unfurler()
-unfurler.install()
+    // Trix offered a single heading level, rendered as h1
+    headings: [ "h1" ]
+  }
+})

app/javascript/lib/autocomplete/mentions_autocomplete_handler.js

@@ -1,48 +0,0 @@
-import BaseAutocompleteHandler from "lib/autocomplete/base_autocomplete_handler"
-import { PUNCTUATION_PATTERN } from "lib/autocomplete/constants"
-
-export default class extends BaseAutocompleteHandler {
-  get pattern() {
-    return new RegExp(`^@(.*?)(${PUNCTUATION_PATTERN.source}*)$`)
-  }
-
-  insertAutocompletable(autocompletable, range, terminator, options = {}) {
-    const attachment = this.#createAttachmentForAutocompletable(autocompletable)
-    this.#insertAttachmentAndTerminatorIntoEditorAtRange(attachment, terminator, range, options)
-  }
-
-  // Override to set selector's position relative to the cursor in the editor
-  getOffsetsAtPosition(position) {
-    return this.#getOffsetsFromEditorAtPosition(this.#editor, position)
-  }
-
-  #createAttachmentForAutocompletable(mentionable) {
-    const mention = `
-      <span class="mention" sgid=${mentionable.sgid}>
-        <img src="${mentionable.avatar_url}" class="avatar" alt="${mentionable.name}">
-        ${mentionable.name}
-      </span>
-    `
-
-    return new Trix.Attachment({
-      content: mention,
-      contentType: "application/vnd.campfire.mention",
-      sgid: mentionable.sgid
-    })
-  }
-
-  #insertAttachmentAndTerminatorIntoEditorAtRange(attachment, terminator, range) {
-    if (range) { this.#editor.setSelectedRange(range) }
-    this.#editor.insertAttachment(attachment)
-    this.#editor.insertString(terminator)
-  }
-
-  get #editor() {
-    return this.element.editor
-  }
-
-  #getOffsetsFromEditorAtPosition(editor, position) {
-    const rect = this.#editor.getClientRectAtPosition(position)
-    return rect ? rect : {}
-  }
-}

app/javascript/lib/rich_text/campfire_extension.js

@@ -0,0 +1,24 @@
+import * as Lexxy from "lexxy"
+import CiteNode from "lib/rich_text/cite_node"
+
+export default class CampfireRichTextExtension extends Lexxy.Extension {
+  get allowedElements() {
+    return [
+      "cite",
+      "figure",
+      "figcaption",
+      "actiontext-opengraph-embed",
+      { tag: "div", attributes: [ "sgid" ] },
+      { tag: "span", attributes: [ "sgid" ] },
+      { tag: "img", attributes: [ "alt" ] },
+      { tag: "a", attributes: [ "rel", "target" ] }
+    ]
+  }
+
+  get lexicalExtension() {
+    return this.defineExtension({
+      name: "campfire/rich-text",
+      nodes: [ CiteNode ]
+    })
+  }
+}

app/javascript/lib/rich_text/cite_node.js

@@ -0,0 +1,39 @@
+import * as Lexxy from "lexxy"
+
+const { ElementNode } = Lexxy.Lexical
+
+export default class CiteNode extends ElementNode {
+  static getType() {
+    return "cite"
+  }
+
+  static clone(node) {
+    return new CiteNode(node.__key)
+  }
+
+  static importJSON(serializedNode) {
+    return new CiteNode().updateFromJSON(serializedNode)
+  }
+
+  static importDOM() {
+    return {
+      cite: () => ({ conversion: () => ({ node: new CiteNode() }), priority: 1 })
+    }
+  }
+
+  exportJSON() {
+    return { ...super.exportJSON(), type: "cite" }
+  }
+
+  createDOM() {
+    return document.createElement("cite")
+  }
+
+  updateDOM() {
+    return false
+  }
+
+  exportDOM() {
+    return { element: document.createElement("cite") }
+  }
+}

app/javascript/lib/rich_text/unfurl/lib/opengraph_embed_operation.js

@@ -1,80 +0,0 @@
-import { post } from "@rails/request.js"
-import { truncateString } from "helpers/string_helpers"
-
-const UNFURLED_TWITTER_AVATAR_CSS_CLASS = "cf-twitter-avatar"
-const TWITTER_AVATAR_URL_PREFIX = "https://pbs.twimg.com/profile_images"
-
-export default class OpengraphEmbedOperation {
-  constructor(paste) {
-    this.paste = paste
-    this.editor = this.paste.editor
-    this.url = this.paste.string
-
-    this.abortController = new AbortController()
-  }
-
-  perform() {
-    return this.#createOpenGraphMetadataRequest()
-      .then(response => response.json)
-      .then(this.#insertOpengraphAttachment.bind(this))
-      .catch(() => null)
-  }
-
-  abort() {
-    this.abortController.abort()
-  }
-
-  #createOpenGraphMetadataRequest() {
-    return post("/unfurl_link", {
-      body: { url: this.url },
-      contentType: "application/json",
-      signal: this.abortController.signal
-    })
-  }
-
-  #insertOpengraphAttachment(response) {
-    if (this.#shouldInsertOpengraphPreview) {
-      const currentRange = this.editor.getSelectedRange()
-      this.editor.setSelectedRange(this.editor.getSelectedRange())
-      this.editor.recordUndoEntry("Insert Opengraph preview for Pasted URL")
-      this.editor.insertAttachment(this.#createOpengraphAttachment(response))
-      this.editor.setSelectedRange(currentRange)
-    }
-  }
-
-  get #shouldInsertOpengraphPreview() {
-    return this.editor.getDocument().toString().includes(this.url)
-  }
-
-  #createOpengraphAttachment(response) {
-    const { title, url, image, description } = response
-    const html = this.#generateOpengraphEmbedHTML({ title, url, image, description })
-
-    return new Trix.Attachment({
-      contentType: "application/vnd.actiontext.opengraph-embed",
-      content: html,
-      filename: title,
-      href: url,
-      url: image,
-      caption: description
-    })
-  }
-
-  #generateOpengraphEmbedHTML(embed) {
-    return `<actiontext-opengraph-embed class="${this.#isTwitterAvatar(embed) ? UNFURLED_TWITTER_AVATAR_CSS_CLASS : ''}">
-      <div class="og-embed">
-        <div class="og-embed__content">
-          <div class="og-embed__title">${truncateString(embed.title, 560)}</div>
-          <div class="og-embed__description">${truncateString(embed.description, 560)}</div>
-        </div>
-        <div class="og-embed__image">
-          <img src="${embed.image}" class="image" alt="" />
-        </div>
-      </div>
-    </actiontext-opengraph-embed>`
-  }
-
-  #isTwitterAvatar(embed) {
-    return embed.image.startsWith(TWITTER_AVATAR_URL_PREFIX)
-  }
-}

app/javascript/lib/rich_text/unfurl/lib/paste.js

@@ -1,39 +0,0 @@
-export default class Paste {
-  constructor(range, editor, document) {
-    this.range = range
-    this.editor = editor
-    this.document = document
-    if (this.document == null) { this.document = this.editor.getDocument() }
-    this.string = this.document.getStringAtRange(this.range)
-  }
-
-  isURL() {
-    return /^(?:[a-z0-9]+:\/\/|www\.)[^\s]+$/.test(this.string)
-  }
-
-  getPathname() {
-    const a = document.createElement("a")
-    a.href = this.string
-    return a.pathname
-  }
-
-  isLinked() {
-    const {href} = this.getCommonAttributes()
-    return (href != null) && (href !== this.string)
-  }
-
-  getCommonAttributes() {
-    return this.document.getCommonAttributesAtRange(this.range)
-  }
-
-  getSignificantPaste() {
-    return new this.constructor(this.getSignificantRange(), this.editor, this.document)
-  }
-
-  getSignificantRange() {
-    const significantString = this.string.trim()
-    const startOffset = this.range[0] + this.string.indexOf(significantString)
-    const endOffset = startOffset + significantString.length
-    return [startOffset, endOffset]
-  }
-}

app/javascript/lib/rich_text/unfurl/unfurler.js

@@ -1,59 +0,0 @@
-import OpengraphEmbedOperation from "lib/rich_text/unfurl/lib/opengraph_embed_operation"
-import Paste from "lib/rich_text/unfurl/lib/paste"
-
-const performOperation = (function() {
-  let operation = null
-  let requestId = null
-
-  return function(operationToPerform) {
-    operation?.abort()
-    cancelAnimationFrame(requestId)
-
-    requestId = requestAnimationFrame(function() {
-      operation = operationToPerform
-      operation.perform().then(() => operation = null)
-    })
-  }
-})()
-
-export default class Unfurler {
-  install() {
-    this.#addEventListeners()
-  }
-
-  #addEventListeners() {
-    addEventListener("trix-initialize", function(event) {
-      if (this.#editorElementPermitsAttribute(event.target, "href")) {
-        return event.target.addEventListener("trix-paste", this.#didPaste.bind(this))
-      }
-    }.bind(this))
-  }
-
-  #didPaste(event) {
-    const {range} = event.paste
-    const {editor} = event.target
-
-    if (range != null) {
-      const paste = new Paste(range, editor).getSignificantPaste()
-
-      if (paste.isURL()) {
-        if (this.#editorElementPermitsOpengraphAttachment(event.target)) {
-          performOperation(new OpengraphEmbedOperation(paste))
-        }
-      }
-    }
-  }
-
-  #editorElementPermitsAttribute(element, attributeName) {
-    if (element.hasAttribute("data-permitted-attributes")) {
-      return Array.from(element.getAttribute("data-permitted-attributes").split(" ")).includes(attributeName)
-    } else {
-      return true
-    }
-  }
-
-  #editorElementPermitsOpengraphAttachment(element) {
-    const permittedAttachmentTypes = element.getAttribute("data-permitted-attachment-types")
-    return permittedAttachmentTypes && permittedAttachmentTypes.includes("application/vnd.actiontext.opengraph-embed")
-  }
-}

app/javascript/models/client_message.js

@@ -18,7 +18,7 @@ export default class ClientMessage {
       body,
       messageTimestamp: Math.floor(now.getTime()),
       messageDatetime: now.toISOString(),
-      messageClasses: this.#containsOnlyEmoji(node.textContent) ? "message--emoji" : "",
+      messageClasses: this.#messageClassesFromNode(node),
     })
   }
 
@@ -52,26 +52,37 @@ export default class ClientMessage {
     }
   }
 
+  #messageClassesFromNode(node) {
+    if (this.#containsOnlyEmoji(this.#plainTextFromNode(node))) {
+      return "message--emoji"
+    } else {
+      return ""
+    }
+  }
+
 
   #isPlayCommand(node) {
     return this.#matchPlayCommand(node)
   }
 
   #matchPlayCommand(node) {
-    return this.#stripWrapperElement(node)?.match(new RegExp(`^/play (${SOUND_NAMES.join("|")})`))?.[1]
+    return this.#plainTextFromNode(node)?.match(new RegExp(`^/play (${SOUND_NAMES.join("|")})`))?.[1]
   }
 
-  #stripWrapperElement(node) {
-    return node.innerHTML?.replace(/<div>(?:<!--[\s\S]*?-->)*([\s\S]*?)<\/div>/i, '$1')
+  #plainTextFromNode(node) {
+    if (this.#isRichText(node)) {
+      return node.toString().trim()
+    } else {
+      return node
+    }
   }
 
-
   #isRichText(node) {
     return typeof(node) != "string"
   }
 
   #richTextContent(node) {
-    return `<div class="trix-content">${node.innerHTML}</div>`
+    return `<div class="lexxy-content">${node.value}</div>`
   }
 
 

app/javascript/models/message_formatter.js

@@ -76,7 +76,21 @@ export default class MessageFormatter {
   }
 
   #highlightCodeBlock(block) {
-    if (this.#isPlainText(block)) window.hljs.highlightElement(block)
+    this.#normalizeLineBreaks(block)
+
+    if (this.#isPlainText(block)) {
+      const language = block.dataset.language
+      if (language && window.hljs.getLanguage(language)) {
+        block.classList.add(`language-${language}`)
+      }
+
+      window.hljs.highlightElement(block)
+    }
+  }
+
+  // Lexxy breaks code block lines with <br>, Trix-era blocks used newlines
+  #normalizeLineBreaks(block) {
+    block.querySelectorAll("br").forEach(br => br.replaceWith("\n"))
   }
 
   #isPlainText(element) {

app/models/account.rb

@@ -1,6 +1,14 @@
 class Account < ApplicationRecord
   include Joinable
 
-  has_one_attached :logo
+  has_one_attached :logo do |attachable|
+    attachable.variant :large, resize_to_limit: [ 512, 512 ], format: :png
+    attachable.variant :small, resize_to_limit: [ 192, 192 ], format: :png
+  end
+
   has_json :settings, restrict_room_creation_to_administrators: false
+
+  def logo_variant(size)
+    logo.variant(size).processed if logo.variable?
+  end
 end

app/models/current.rb

@@ -1,8 +1,16 @@
 class Current < ActiveSupport::CurrentAttributes
-  attribute :user, :request
+  attribute :session, :user, :request
 
   delegate :host, :protocol, to: :request, prefix: true, allow_nil: true
 
+  def session=(value)
+    super(value)
+
+    if value.present?
+      self.user = session.user
+    end
+  end
+
   def account
     Account.first
   end

app/models/message/broadcasts.rb

@@ -1,10 +1,19 @@
 module Message::Broadcasts
   def broadcast_create
     broadcast_append_to room, :messages, target: [ room, :messages ]
-    ActionCable.server.broadcast("unread_rooms", { roomId: room.id })
+    broadcast_unread_room
   end
 
   def broadcast_remove
     broadcast_remove_to room, :messages
   end
+
+  private
+    # Fanned out to the room's members rather than published on one global stream, so
+    # that the timing of activity in a room only reaches people who are in it.
+    def broadcast_unread_room
+      room.memberships.pluck(:user_id).each do |user_id|
+        ActionCable.server.broadcast UnreadRoomsChannel.stream_name_for(user_id), { roomId: room.id }
+      end
+    end
 end

app/models/push/subscription.rb

@@ -1,7 +1,61 @@
+require "restricted_http/private_network_guard"
+
 class Push::Subscription < ApplicationRecord
+  PERMITTED_ENDPOINT_HOSTS = %w[
+    jmt17.google.com
+    fcm.googleapis.com
+    updates.push.services.mozilla.com
+    web.push.apple.com
+    notify.windows.com
+  ].freeze
+
   belongs_to :user
 
+  validates :endpoint, presence: true
+  validate :validate_endpoint_url
+
   def notification(**params)
-    WebPush::Notification.new(**params, badge: user.memberships.unread.count, endpoint: endpoint, p256dh_key: p256dh_key, auth_key: auth_key)
+    # Defer DNS lookup to the delivery worker to prevent rebinding
+    WebPush::Notification.new(**params, badge: user.memberships.unread.count, endpoint: endpoint, endpoint_ip_resolver: method(:resolved_endpoint_ip), p256dh_key: p256dh_key, auth_key: auth_key)
   end
+
+  # Validate at point of use, not just when saved.
+  def resolved_endpoint_ip
+    RestrictedHTTP::PrivateNetworkGuard.resolve(endpoint_uri.host) if permitted_endpoint_uri?
+  rescue RestrictedHTTP::Violation, Surfguard::Unresolvable
+    nil
+  end
+
+  private
+    # Validate endpoint shape. Belt & suspenders.
+    def permitted_endpoint_uri?
+      endpoint_uri&.scheme == "https" && endpoint_uri.port == 443 && permitted_endpoint_host?
+    end
+
+    def endpoint_uri
+      URI.parse(endpoint) if endpoint.present?
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    def validate_endpoint_url
+      if endpoint_uri.nil?
+        errors.add(:endpoint, "is not a valid URL")
+      elsif endpoint_uri.scheme != "https"
+        errors.add(:endpoint, "must use HTTPS")
+      elsif endpoint_uri.port != 443
+        errors.add(:endpoint, "must use the default HTTPS port")
+      elsif !permitted_endpoint_host?
+        errors.add(:endpoint, "is not a permitted push service")
+      elsif resolved_endpoint_ip.nil?
+        errors.add(:endpoint, "resolves to a private or invalid IP address")
+      end
+    end
+
+    def permitted_endpoint_host?
+      host = endpoint_uri&.host&.downcase
+      host.present? && PERMITTED_ENDPOINT_HOSTS.any? do |permitted|
+        host == permitted || host.end_with?(".#{permitted}")
+      end
+    end
 end

app/models/room.rb

@@ -22,6 +22,8 @@ class Room < ApplicationRecord
 
   belongs_to :creator, class_name: "User", default: -> { Current.user }
 
+  validate :direct_rooms_keep_their_type, on: :update
+
   scope :opens,           -> { where(type: "Rooms::Open") }
   scope :closeds,         -> { where(type: "Rooms::Closed") }
   scope :directs,         -> { where(type: "Rooms::Direct") }
@@ -65,6 +67,15 @@ class Room < ApplicationRecord
   end
 
   private
+    # Open and closed rooms convert into each other freely. A direct room can't become
+    # either: its participants agreed to a private conversation, not to one whose
+    # audience someone else gets to widen afterwards.
+    def direct_rooms_keep_their_type
+      if type_changed? && type_was == "Rooms::Direct"
+        errors.add :type, "can't be changed for a direct room"
+      end
+    end
+
     def unread_memberships(message)
       memberships.visible.disconnected.where.not(user: message.creator).update_all(unread_at: message.created_at, updated_at: Time.current)
     end

app/models/user/avatar.rb

@@ -2,7 +2,9 @@ module User::Avatar
   extend ActiveSupport::Concern
 
   included do
-    has_one_attached :avatar
+    has_one_attached :avatar do |attachable|
+      attachable.variant :square, resize_to_limit: [ 512, 512 ], format: :webp
+    end
   end
 
   class_methods do
@@ -14,4 +16,8 @@ module User::Avatar
   def avatar_token
     signed_id(purpose: :avatar)
   end
+
+  def avatar_variant
+    avatar.variant(:square).processed if avatar.variable?
+  end
 end

app/models/user/mentionable.rb

@@ -1,11 +1,13 @@
 module User::Mentionable
   include ActionText::Attachable
 
-  def to_attachable_partial_path
-    "users/mention"
+  MENTION_CONTENT_TYPE = "application/vnd.campfire.mention"
+
+  def attachable_content_type
+    MENTION_CONTENT_TYPE
   end
 
-  def to_trix_content_attachment_partial_path
+  def to_attachable_partial_path
     "users/mention"
   end
 

app/models/webhook.rb

@@ -24,6 +24,8 @@ class Webhook < ApplicationRecord
         Net::HTTP::Post.new(uri, "Content-Type" => "application/json").tap { |request| request.body = payload }
     end
 
+    # No PrivateNetworkGuard, unlike Opengraph::Fetch: only an administrator sets this URL,
+    # and operators legitimately point bots at their own internal services.
     def http
       Net::HTTP.new(uri.host, uri.port).tap do |http|
         http.use_ssl = (uri.scheme == "https")

app/views/accounts/edit.html.erb

@@ -100,7 +100,13 @@
 
     <menu class="flex flex-column gap margin-none pad">
       <turbo-frame id="account_users">
-        <%= render partial: "accounts/users/user", collection: @page.records, as: :user %>
+        <%= render partial: "accounts/users/user", collection: @administrators, as: :user %>
+
+        <% if @administrators.any? && @members.any? %>
+          <hr class="separator full-width" style="--border-style: solid">
+        <% end %>
+
+        <%= render partial: "accounts/users/user", collection: @members, as: :user %>
         <%= render "accounts/users/next_page_container", page: @page.next_param unless @page.last? %>
       </turbo-frame>
     </menu>

app/views/accounts/users/_user.html.erb

@@ -9,23 +9,26 @@
 
   <hr class="separator" aria-hidden="true">
 
-  <% if Current.user.can_administer? && user != Current.user && user.active? %>
+  <% if Current.user.can_administer? && user.active? %>
     <% unless user.bot? %>
       <%= form_with model: user, url: account_user_path(user), data: { controller: "form" }, method: :patch do | form | %>
         <label class="btn txt-small flex-item-no-shrink" for="<%= dom_id(user, :role) %>">
           <span class="for-screen-reader">Role: <%= user.administrator? ? "Administrator" : "Member" %></span>
           <%= image_tag "crown.svg", size: 20, aria: { hidden: "true" } %>
-          <%= form.check_box :role, { data: { action: "form#submit" }, hidden: true, id: dom_id(user, :role) }, "administrator", "member" %>
+          <%= form.check_box :role, { data: { action: "form#submit" }, hidden: true, id: dom_id(user, :role), disabled: user == Current.user }, "administrator", "member" %>
         </label>
       <% end %>
     <% end %>
 
-    <%= button_to account_user_path(user), method: :delete, class: "btn txt-small flex-item-no-shrink btn--negative", data: {
-          turbo_confirm: "Are you sure you want to permanently remove this person from the account? This can’t be undone."} do %>
-      <%= image_tag "minus.svg", size: 20, aria: { hidden: "true" } %>
-      <span class="for-screen-reader">Delete <%= user.name %></span>
+    <% unless user == Current.user %>
+      <%= button_to account_user_path(user), method: :delete, class: "btn txt-small flex-item-no-shrink btn--negative", data: {
+            turbo_confirm: "Are you sure you want to permanently remove this person from the account? This can’t be undone."} do %>
+        <%= image_tag "minus.svg", size: 20, aria: { hidden: "true" } %>
+        <span class="for-screen-reader">Delete <%= user.name %></span>
+      <% end %>
     <% end %>
-  <% elsif user == Current.user %>
+  <% end %>
+  <% if user == Current.user %>
     <%= link_to user_profile_path, class: "btn txt-small flex-item-no-shrink", target: "_top" do %>
       <%= image_tag "pencil.svg", size: 20, aria: { hidden: "true" } %>
       <span class="for-screen-reader">My settings</span>

app/views/action_text/attachables/_opengraph_embed.html.erb

@@ -1,11 +1,11 @@
 <figure class="attachment attachment--content attachment--og">
   <actiontext-opengraph-embed>
-    <div class="og-embed gap">
+    <div class="og-embed gap <%= "og-embed--twitter-avatar" if opengraph_embed.twitter_avatar? %>">
       <div class="og-embed__content">
         <div class="og-embed__title">
-          <%= link_to truncate(opengraph_embed.filename, length: 280, omission: "…"), opengraph_embed.href, rel: "noreferrer", target: "_blank" %>
+          <%= link_to_if opengraph_embed.href.present?, truncate(opengraph_embed.filename, length: 280, omission: "…"), opengraph_embed.href, rel: "noreferrer", target: "_blank" %>
         </div>
-        <div class="og-embed__description"><%= truncate(opengraph_embed.caption, length: 560, omission: "…").html_safe %></div>
+        <div class="og-embed__description"><%= truncate(opengraph_embed.description.to_s, length: 560, omission: "…") %></div>
       </div>
       <% if opengraph_embed.url %>
         <div class="og-embed__image">

app/views/autocompletable/users/_prompt_item.html.erb

@@ -0,0 +1,11 @@
+<lexxy-prompt-item search="<%= user.name %>" sgid="<%= user.attachable_sgid %>">
+  <template type="menu">
+    <span class="autocomplete__item flex align-center gap unpad">
+      <%= avatar_tag user %>
+      <span class="autocompletable__name"><%= user.name %></span>
+    </span>
+  </template>
+  <template type="editor">
+    <%= render "users/mention", user: user %>
+  </template>
+</lexxy-prompt-item>

app/views/autocompletable/users/index.html.erb

@@ -0,0 +1 @@
+<%= render partial: "autocompletable/users/prompt_item", collection: @page.records, as: :user %>

app/views/layouts/action_text/contents/_content.html.erb

@@ -1,3 +1,3 @@
-<div class="trix-content">
+<div class="lexxy-content">
   <%= yield -%>
 </div>

app/views/messages/_message.html.erb

@@ -1,6 +1,7 @@
 <%# Be sure to check/update messages/_template.html.erb when changing this file %>
 
-<% cache message do %>
+<%# Bump this version when the message presentation filters change what they emit. Editing this line changes the template digest, which busts BOTH this fragment cache and the collection cache that keys on this partial's digest (helper Ruby changes alone don't). %>
+<% cache [ message, "presentation-v3" ] do %>
   <%= message_tag message do %>
     <h2 class="message__day-separator"><%= local_datetime_tag message.created_at, style: :date %></h2>
 

app/views/messages/_message.json.jbuilder

@@ -0,0 +1,18 @@
+json.cache! message do
+  json.(message, :id)
+
+  json.created_at message.created_at.utc
+
+  json.body do
+    json.plain_text message.plain_text_body
+    json.html message.body.to_s
+  end
+
+  json.creator message.creator, partial: "users/user", as: :user
+
+  json.room do
+    json.id message.room_id
+  end
+
+  json.url room_message_url(message.room, message)
+end

app/views/messages/boosts/_boost.json.jbuilder

@@ -0,0 +1,12 @@
+json.cache! boost do
+  json.(boost, :id, :content)
+
+  json.created_at boost.created_at.utc
+
+  json.booster boost.booster, partial: "users/user", as: :user
+
+  json.message do
+    json.id boost.message_id
+    json.url room_message_url(boost.message.room, boost.message)
+  end
+end

app/views/messages/boosts/by_bots/show.json.jbuilder

@@ -0,0 +1 @@
+json.partial! "messages/boosts/boost", boost: @boost

app/views/messages/by_bots/index.json.jbuilder

@@ -0,0 +1 @@
+json.array! @messages, partial: "messages/message", as: :message

app/views/messages/by_bots/show.json.jbuilder

@@ -0,0 +1 @@
+json.partial! "messages/message", message: @message

app/views/messages/edit.html.erb

@@ -14,17 +14,18 @@
       <% else %>
         <div class="composer--edit composer--rich-text">
           <%= form_with model: @message, url: room_message_path(@room, @message), id: dom_id(@message, :form), data: {
-                controller: "form", action: "trix-file-accept->form#preventAttachment keydown.esc->form#cancel keydown.ctrl+enter->form#submit:prevent keydown.meta+enter->form#submit:prevent" } do |form| %>
+                controller: "form", action: "lexxy:file-accept->form#preventAttachment keydown.esc->form#cancel keydown.ctrl+enter->form#submit:prevent keydown.meta+enter->form#submit:prevent" } do |form| %>
             <div class="full-width input input--actor min-width fill-white">
               <%= form.rich_text_area :body,
+                    value: editable_body(@message),
                     rows: 1,
-                    class: "input",
+                    class: "input lexxy-content",
                     aria: { multiline: "true", label: "Edit message" },
                     autofocus: true,
-                    data: {
-                      controller: "rich-autocomplete",
-                      action: rich_text_data_actions,
-                      rich_autocomplete_url_value: autocompletable_users_path(room_id: @room.id) } %>
+                    "permitted-attachment-types": "application/vnd.campfire.mention application/vnd.actiontext.opengraph-embed",
+                    data: { action: rich_text_data_actions } do %>
+                <%= mention_prompt_tag @room %>
+              <% end %>
             </div>
 
             <%= link_to "Close editor and discard changes", room_message_path(@room, @message), data: { form_target: "cancel" }, hidden: true %>

app/views/rooms/show.html.erb

@@ -17,7 +17,7 @@
     <%= render partial: "messages/message", collection: @messages, cached: true %>
   <% end %>
 
-  <%= turbo_stream_from @room, :messages %>
+  <%= turbo_stream_from @room, :messages, channel: "RoomMessagesChannel" %>
   <%= button_to_jump_to_newest_message %>
 <% end %>
 

app/views/rooms/show/_composer.html.erb

@@ -19,15 +19,16 @@
                 <div class="flex flex-column flex-item-grow min-width gap">
                   <%= form.rich_text_area :body,
                         rows: 1,
-                        class: "input",
+                        class: "input lexxy-content",
                         style: "order: -1",
                         aria: { multiline: "true", label: "Write a message" },
+                        "permitted-attachment-types": "application/vnd.campfire.mention application/vnd.actiontext.opengraph-embed",
                         data: {
-                          controller: "rich-autocomplete",
-                          action: rich_text_data_actions,
-                          rich_autocomplete_url_value: autocompletable_users_path(room_id: room.id),
-                          permitted_attachment_types: "application/vnd.actiontext.opengraph-embed",
-                          composer_target: "text" } %>
+                          controller: "unfurl",
+                          action: "#{rich_text_data_actions} lexxy:change->composer#saveDraft lexxy:insert-link->unfurl#unfurl",
+                          composer_target: "text" } do %>
+                    <%= mention_prompt_tag room %>
+                  <% end %>
                 </div>
 
                 <label class="btn btn--borderless txt-small flex-item-no-shrink composer__attachment-btn input--file">

app/views/users/_ban_button.html.erb

@@ -9,7 +9,7 @@
   <%= button_to user_ban_path(user), method: :delete,
         class: "btn btn--negative full-width",
         data: { turbo_confirm: "Are you sure you want to remove the ban on this user?" } do %>
-    <%= image_tag "cancel.svg", aria: { hidden: "true", label: "Ban #{@user.name}" } %>
+    <%= image_tag "cancel.svg", aria: { hidden: "true", label: "Remove Ban #{@user.name}" } %>
     <span>Remove ban</span>
   <% end %>
 <% end %>

app/views/users/_mention.html.erb

@@ -1,4 +1,4 @@
-<div class="mention" sgid="<%= user.attachable_sgid %>">
-  <%= avatar_tag user %>
-  <%= user.name %>
-</div>
+<%# A span rather than a div: mentions render inline inside the <p> paragraphs
+    the editor produces, and block elements would make the browser split the
+    paragraph when parsing %>
+<span class="mention" sgid="<%= user.attachable_sgid %>"><%= avatar_tag user %> <%= user.name %></span>

app/views/users/_user.json.jbuilder

@@ -0,0 +1,5 @@
+json.cache! user do
+  json.(user, :id, :name, :role)
+
+  json.avatar_url fresh_user_avatar_url(user)
+end

bin/brakeman

@@ -2,6 +2,6 @@
 require "rubygems"
 require "bundler/setup"
 
-ARGV.unshift("--ensure-latest")
+ARGV.unshift("--ensure-latest", "15")
 
 load Gem.bin_path("brakeman", "brakeman")

bin/release

@@ -15,9 +15,11 @@ include SSHKit::DSL
 ARCH = "linux/amd64,linux/arm64"
 BUILDER_NAME = "campfire-builder"
 GIT_SHA = `git rev-parse HEAD`.strip
+MANUAL_NOTES = ARGV.delete("--notes")
 VERSION = ARGV[0]
 
-DOCKER_IMAGE_NAME = "registry.once.com/campfire"
+DOCKER_REGISTRY = "registry.once.com"
+DOCKER_IMAGE_NAME = "#{DOCKER_REGISTRY}/campfire"
 DOCKER_LATEST_IMAGE_NAME = [ DOCKER_IMAGE_NAME, :latest ].join(":")
 DOCKER_TAGGED_IMAGE_NAME = [ DOCKER_IMAGE_NAME, GIT_SHA ].join(":")
 
@@ -28,13 +30,36 @@ EXPORT_REMOTE_USER = "app"
 EXPORT_DEPLOY_HOSTS = %w[ once-store-app-101 once-store-app-102 ]
 EXPORT_DEPLOY_LOCATION = "/local/app/product_releases/"
 
-abort "You must specify a version, e.g. `bin/release 1.0.0`" unless VERSION
+abort "You must specify a version, e.g. `bin/release 1.0.0` (pass --notes to write release notes manually)" unless VERSION
+
+current_branch = `git rev-parse --abbrev-ref HEAD`.strip
+if current_branch != "main"
+  print "\e[1;33mWarning: You are on branch '#{current_branch}', not 'main'. Continue? [y/N] \e[0m"
+  abort "Release aborted." unless $stdin.gets.strip.downcase.chars.first == "y"
+end
+
+unless `git status --porcelain`.strip.empty?
+  print "\e[1;33mWarning: You have uncommitted changes. Continue? [y/N] \e[0m"
+  abort "Release aborted." unless $stdin.gets.strip.downcase.chars.first == "y"
+end
 
 def announcing(message)
   puts "\n\e[1;36m#{message}\e[0m"
   yield
 end
 
+announcing "Checking #{DOCKER_REGISTRY} login..." do
+  unless system "docker", "manifest", "inspect", DOCKER_LATEST_IMAGE_NAME, out: File::NULL, err: File::NULL
+    abort <<~MESSAGE
+      Not logged in to #{DOCKER_REGISTRY}. Run:
+
+        docker login #{DOCKER_REGISTRY}
+
+      The credentials are in the "chatinabox" entry in 1Password.
+    MESSAGE
+  end
+end
+
 on(:local) do
   builder_found = test :docker, :buildx, :inspect, BUILDER_NAME
 
@@ -46,19 +71,25 @@ on(:local) do
 end
 
 announcing "Creating GitHub release v#{VERSION}..." do
-  notes_file = "tmp/release_notes.md"
-
   on(:local) do
-    execute :mkdir, "-p", "tmp"
+    if MANUAL_NOTES
+      notes_file = "tmp/release_notes.md"
 
-    File.write(notes_file, "# What's Changed\n\n- \n")
-    system ENV["EDITOR"] || "vim", notes_file
+      execute :mkdir, "-p", "tmp"
 
-    unless system "gh", "release", "create", "v#{VERSION}", "--title", "v#{VERSION}", "--notes-file", notes_file
-      abort "Failed to create release; check that the version doesn't already exist"
+      File.write(notes_file, "# What's Changed\n\n- \n")
+      system ENV["EDITOR"] || "vim", notes_file
+
+      unless system "gh", "release", "create", "v#{VERSION}", "--title", "v#{VERSION}", "--notes-file", notes_file
+        abort "Failed to create release; check that the version doesn't already exist"
+      end
+
+      execute :rm, notes_file
+    else
+      unless system "gh", "release", "create", "v#{VERSION}", "--title", "v#{VERSION}", "--generate-notes"
+        abort "Failed to create release; check that the version doesn't already exist"
+      end
     end
-
-    execute :rm, notes_file
   end
 end
 

bin/setup

@@ -60,7 +60,10 @@ echo
 if command -v brew &>/dev/null; then
   step "Installing packages" brew install sqlite ffmpeg mise
 elif command -v pacman &>/dev/null; then
-  step "Installing packages" sudo pacman -S --noconfirm --needed sqlite ffmpeg mise
+  packages=(sqlite ffmpeg mise)
+  if ! pacman -Q "${packages[@]}" >/dev/null 2>&1; then
+    step "Installing packages" sudo pacman -S --noconfirm --needed "${packages[@]}"
+  fi
 elif command -v apt &>/dev/null; then
   step "Installing packages" sudo apt-get install --no-install-recommends -y libsqlite3-0 ffmpeg
 fi
@@ -100,6 +103,20 @@ if ! redis_running; then
   fi
 fi
 
+# Install GitHub Actions linting tools
+for tool in actionlint shellcheck zizmor; do
+  if ! command -v "$tool" &> /dev/null; then
+    if command -v brew &> /dev/null; then
+      step "Installing $tool" brew install "$tool"
+    elif command -v pacman &> /dev/null; then
+      step "Installing $tool" sudo pacman -S --noconfirm "$tool"
+    else
+      echo "Error: install $tool manually" >&2
+      exit 1
+    fi
+  fi
+done
+
 step "Cleaning up logs and tempfiles" rails log:clear tmp:clear
 
 step "Restarting services" rails restart

config/cable.yml

@@ -1,6 +1,6 @@
 default: &default
   adapter: redis
-  url: redis://localhost:6379
+  url: <%= ENV.fetch("REDIS_URL") { "redis://localhost:6379" } %>
 
 development:
   <<: *default

config/ci.rb

@@ -4,6 +4,8 @@ CI.run do
   step "Setup", "bin/setup --skip-server"
 
   step "Style: Ruby", "bin/rubocop"
+  step "Style: GitHub Actions (actionlint)", "actionlint"
+  step "Style: GitHub Actions (zizmor)", "zizmor ."
 
   step "Security: Gem audit", "bin/bundler-audit"
   step "Security: Importmap vulnerability audit", "bin/importmap audit"

config/environments/production.rb

@@ -1,5 +1,6 @@
 require "active_support/core_ext/integer/time"
 require "active_support/core_ext/numeric/bytes"
+require_relative "../../lib/rails_ext/log_scrubbing_formatter"
 
 Rails.application.configure do
   # Settings specified here will take precedence over those in config/application.rb.
@@ -50,7 +51,7 @@ Rails.application.configure do
 
   # Log to STDOUT by default
   config.logger = ActiveSupport::Logger.new(STDOUT)
-    .tap  { |logger| logger.formatter = ::Logger::Formatter.new }
+    .tap  { |logger| logger.formatter = LogScrubbingFormatter.new }
     .then { |logger| ActiveSupport::TaggedLogging.new(logger) }
 
   # Prepend all log lines with the following tags.

config/importmap.rb

@@ -5,8 +5,7 @@ pin "@hotwired/stimulus-loading", to: "stimulus-loading.js"
 pin "@hotwired/turbo-rails", to: "turbo.js"
 pin "@rails/actioncable", to: "actioncable.esm.js"
 pin "@rails/request.js", to: "@rails--request.js" # @0.0.8
-pin "trix", to: "trix.esm.min.js" # @2.0.10
-pin "@rails/actiontext", to: "actiontext.js"
+pin "lexxy", to: "lexxy.js"
 pin "highlight.js", to: "highlight.js/core.js"
 
 pin_all_from "app/javascript/initializers", under: "initializers"

config/initializers/active_storage_authentication.rb

@@ -0,0 +1,15 @@
+# Active Storage mounts its direct-upload write endpoints
+# (POST /rails/active_storage/direct_uploads and the disk-service PUT) on
+# framework controllers that inherit from ActiveStorage::BaseController, so
+# they never pass through ApplicationController's require_authentication.
+# Campfire uploads attachments through MessagesController instead and does not
+# use direct uploads at all, leaving these endpoints reachable by anyone who
+# can read the public login page. Require a valid Campfire session before an
+# anonymous caller can allocate a Blob or persist bytes to disk.
+Rails.application.config.to_prepare do
+  ActiveStorage::DirectUploadsController.include ActiveStorageAuthentication
+  ActiveStorage::DirectUploadsController.before_action :require_active_storage_authentication
+
+  ActiveStorage::DiskController.include ActiveStorageAuthentication
+  ActiveStorage::DiskController.before_action :require_active_storage_authentication, only: :update
+end