Security patches

.env.sample

@@ -0,0 +1,32 @@
+# Base Rails config variables
+#   these settings are accessed during application initialization
+# ---------------------------------------------------------------
+export RAILS_ENV=development
+export HOST=localhost
+export RAILS_SERVE_STATIC_FILES=true
+export RAILS_LOG_TO_STDOUT=true
+export PORT=3000
+
+# Puma settings (accessed in config/puma.rb)
+export RAILS_MAX_THREADS=5
+export WEB_CONCURRENCY=2
+
+# Redis settings (accessed within cable.yml)
+# export REDIS_URL=redis://localhost:6379/1
+
+# Capistrano settings (accessed in the various deploy targets in config/deploy/)
+# export HOST_NAME=
+
+# Database settings (accessed within config/database.yml)
+export DB_ADAPTER=mysql2
+export DB_NAME=my_app
+export DB_POOL_SIZE=16
+
+# AnywayConfig variables
+#    these settings are accessed after the application has initialized
+# --------------------------------------------------------------------
+export DMPROADMAP_SERVER_HOST=https://localhost:3000
+export DMPROADMAP_NAME=MyApp
+export DMPROADMAP_DO_NOT_REPLY_EMAIL=do-not-reply-my-app-dev@example.org
+export DMPROADMAP_HELPDESK_EMAIL=help@example.org
+export DMPROADMAP_LOCALES=MyApp-Dev

.eslintignore

@@ -0,0 +1,6 @@
+# Ignore the locale files
+app/javascript/src/locale/
+
+config/
+node_modules/
+spec/

.github/workflows/brakeman.yml

@@ -1,9 +1,13 @@
 name: Brakeman
 
 on:
+  push:
+    branches:
+      - main
+
   pull_request:
     branches:
-      master
+      - main
 
 jobs:
   brakeman:

.github/workflows/eslint.yml

@@ -9,10 +9,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
+    - name: Install modules
+      run: yarn
 
-    # Will run ES Lint checks on javascript files
-    #   https://github.com/marketplace/actions/run-eslint
-    - name: 'ES Lint checks'
-      uses: stefanoeb/eslint-action@1.0.0
-      with:
-        args: './app/javascript/**/*.js'
+    - name: Run ESLint
+      run: npx eslint './app/javascript/**/*.js'

.github/workflows/mysql.yml

@@ -1,6 +1,6 @@
 name: Tests - MySQL
 
-on: [pull_request]
+on: [push, pull_request]
 
 jobs:
   mysql:
@@ -17,7 +17,7 @@ jobs:
       with:
         fetch-depth: 1
 
-    - name: 'Install MySQL Packages'
+    - name: 'Install  MySQL Packages'
       run: |
         sudo apt-get update
         sudo apt-get install -y mysql-client libmysqlclient-dev
@@ -28,18 +28,10 @@ jobs:
         echo "BUNDLER_VERSION=`cat ./Gemfile.lock | grep -A 1 'BUNDLED WITH' | grep -oE '[0-9]\.[0-9]'`" >> $GITHUB_ENV
 
     - name: 'Install Ruby'
-      uses: actions/setup-ruby@v1
+      uses: ruby/setup-ruby@v1.68.0
       with:
         ruby-version: ${{ env.RUBY_VERSION }}
 
-    # Copy all of the example configs over
-    - name: 'Setup Default Configuration'
-      run: |
-        # Make copies of all the example config files
-        cp config/database.yml.sample config/database.yml
-        cp config/initializers/contact_us.rb.example config/initializers/contact_us.rb
-        cp config/initializers/wicked_pdf.rb.example config/initializers/wicked_pdf.rb
-
     # Try to retrieve the gems from the cache
     - name: 'Cache Gems'
       uses: actions/cache@v2.1.5

.github/workflows/postgres.yml

@@ -50,12 +50,10 @@ jobs:
         ruby-version: ${{ env.RUBY_VERSION }}
 
     # Copy all of the example configs over
-    - name: 'Setup Default Configuration'
+    - name: 'Setup Default DB Configuration'
       run: |
         # Make copies of all the example config files
         cp config/database.yml.sample config/database.yml
-        cp config/initializers/contact_us.rb.example config/initializers/contact_us.rb
-        cp config/initializers/wicked_pdf.rb.example config/initializers/wicked_pdf.rb
 
     # Try to retrieve the gems from the cache
     - name: 'Cache Gems'

.gitignore

@@ -1,14 +1,44 @@
+# DMPTool specific rules
+# ----------------------
+# Ignore Dotenv file
+.env
+.*-env
+.set_env.sh
+
+# Version file generated by Capistrano
+.version
+
+# Homepage background images
+app/assets/images/homepage
+# ----------------------
+
 # Ignore rbenv files
 .ruby-version
 
 # Ignore bundler config
 /.bundle
+/ruby
+/vendor
+
+# Ignore locally build bundle outputs
+/ruby
 
 # Ignore all logfiles, tempfiles, public assets,
 /log/*.log
 /tmp
 
+# Ignore webpack generate images in public folder
+public/*.jpg
+public/*.png
+
+# Ignore .bak files
+*.bak
+
+# Ignore vim backup files
+*.swp
+
 # Ignore public subdirectories
+# public/*
 public/apidocs/*
 public/assets/*
 public/fonts/*
@@ -23,13 +53,9 @@ public/videos/*
 *.pot.bak
 
 # Ignore branded content
-app/views/branded/*
+app/assets/images/homepage
 config/locales/static_pages/*.yml
 
-
-# Ignore db schema.rb
-# db/schema.rb
-
 # Ignore seed DBs
 db/data.yml
 
@@ -46,22 +72,6 @@ db/test.sqlite3-journal
 # Ignore the SimpleCov output
 coverage
 
-# Ignore database configuration and token secrets
-config/database.yml
-config/secrets.yml
-config/branding.yml
-
-# Ignore some of the initializers
-config/initializers/wicked_pdf.rb
-config/initializers/fingerprint.rb
-
-# Ignore enviroments settings
-#config/environments/development.rb
-#config/environments/production.rb
-#config/environments/test.rb
-
-#config/initializers/contact_us.rb
-
 # ignore IDE files
 .idea/*
 
@@ -78,6 +88,7 @@ config/initializers/fingerprint.rb
 # ignore auto-generated gettext files when running gettext:find
 config/locale/*/app.edit.po
 config/locale/*/app.po.time_stamp
+config/secrets.yml
 
 # Front-end related
 !.keep
@@ -89,22 +100,20 @@ yarn-error.log
 yarn-debug.log*
 
 .env
+.version
+
 package-lock.json
-node_modules
-/public/packs
-/public/packs-test
 
 spec/examples.txt
 .postcssrc.yml
-/public/packs
-/public/packs-test
-/node_modules
-yarn-debug.log*
-.yarn-integrity
 
 # Ignore master key for decrypting credentials and more.
 /config/master.key
-/config/credentials.yml.enc
+/config/master*.key
+/config/credentials.yml
+/config/credentials*.yml.enc
+/config/credentials/
+/config/secrets.yml
 
 /public/packs
 /public/packs-test

Capfile

@@ -0,0 +1,18 @@
+# Load DSL and set up stages
+require "capistrano/setup"
+
+# Include default deployment tasks
+require "capistrano/deploy"
+
+# Load the SCM plugin appropriate to your project:
+require "capistrano/scm/git"
+install_plugin Capistrano::SCM::Git
+
+require "capistrano/bundler"
+
+require "capistrano/rails/assets"
+
+require "capistrano/rails/migrations"
+
+# Load custom tasks from `lib/capistrano/tasks` if you have any defined
+Dir.glob("lib/capistrano/tasks/*.rake").each { |r| import r }

Gemfile

@@ -40,6 +40,9 @@ gem "jbuilder"
 # Use Active Model has_secure_password
 # gem "bcrypt", "~> 3.1.7"
 
+# Use Resque to manage the ActiveJob queue
+# gem 'resque'
+
 # Use Active Storage variant
 # gem "image_processing", "~> 1.2"
 
@@ -54,6 +57,17 @@ gem "bootsnap", require: false
 # (http://github.com/plataformatec/responders)
 # gem "responders"
 
+# ============= #
+# CONFIGURATION #
+# ============= #
+
+# Anyway Config is a configuration library for Ruby gems and applications.
+gem "anyway_config"
+
+# Our homegrown artisinal SSM gem
+gem "uc3-ssm", git: "https://github.com/CDLUC3/uc3-ssm", branch: "0.3.1"
+
+
 # ============== #
 # ERROR HANDLING #
 # ============== #
@@ -90,7 +104,11 @@ gem "devise_invitable"
 
 # A generalized Rack framework for multiple-provider authentication.
 # (https://github.com/omniauth/omniauth)
-gem "omniauth"
+
+# TODO: unlock this once devise creates an official release that includes this commit:
+#       https://github.com/heartcombo/devise/commit/1d138dd40cdc291a427b89027d16a869818a5c19#diff-59866e40fe6196ebb76fa63d186b09ba0856de17e2e938743e99add37bb83f5c
+#       or updates to accommodate the new version of omniauth
+gem "omniauth", "~> 1.9"
 
 # OmniAuth Shibboleth strategies for OmniAuth 1.x
 gem "omniauth-shibboleth"
@@ -106,7 +124,12 @@ gem "omniauth-orcid"
 #   https://nvd.nist.gov/vuln/detail/CVE-2015-9284
 gem "omniauth-rails_csrf_protection"
 
+# Doorkeeper is a gem (Rails engine) that makes it easy to introduce OAuth 2 provider functionality
+# to your Ruby on Rails or Grape application. https://github.com/doorkeeper-gem/doorkeeper
+gem "doorkeeper", "~> 5.5"
+
 # A ruby implementation of the RFC 7519 OAuth JSON Web Token (JWT) standard.
+# https://github.com/jwt/ruby-jwt
 gem "jwt"
 
 # Gems for repository integration
@@ -176,7 +199,15 @@ gem "autoprefixer-rails"
 # ========= #
 
 # Provides binaries for WKHTMLTOPDF project in an easily accessible package.
-gem "wkhtmltopdf-binary"
+# ------------------------------------------------
+# Start DMPTool customization
+# 0.12.5 does not work on our new linux2 instances. Pegging at 0.12.4 for now
+# ------------------------------------------------
+# gem 'wkhtmltopdf-binary'
+gem "wkhtmltopdf-binary", "0.12.4"
+# ------------------------------------------------
+# End DMPTool customization
+# ------------------------------------------------
 
 # PDF generator (from HTML) gem for Ruby on Rails
 # (https://github.com/mileszs/wicked_pdf)
@@ -213,6 +244,10 @@ gem "httparty"
 # Autoload dotenv in Rails. (https://github.com/bkeepers/dotenv)
 gem "dotenv-rails"
 
+# A library that retrieves an citation for the specified DOI.
+# https://github.com/CDLUC3/uc3-citation
+gem 'uc3-citation'
+
 # ================================= #
 # ENVIRONMENT SPECIFIC DEPENDENCIES #
 # ================================= #
@@ -243,6 +278,10 @@ group :test do
   # Guard gem for RSpec (https://github.com/guard/guard-rspec)
   gem "guard-rspec"
 
+  gem "capistrano"
+
+  gem "capistrano-rails"
+
   # Library for stubbing HTTP requests in Ruby.
   # (http://github.com/bblimke/webmock)
   gem "webmock"
@@ -323,7 +362,7 @@ group :development do
 
   # Better error page for Rails and other Rack apps
   # (https://github.com/charliesome/better_errors)
-  gem "better_errors"
+  gem "better_errors", "2.8.1"
 
   # Retrieve the binding of a method's caller. Can also retrieve bindings
   # even further up the stack. (http://github.com/banister/binding_of_caller)