Enhance Security, Testing, and Code Compatibility (#26)

[JudahSan]

Enhance Security, Testing, and Code Compatibility

This pull request introduces several key enhancements focused on improving application security, enabling more robust testing, and ensuring future Rails compatibility.

Key Changes & Improvements:

• Cloudflare Turnstile Integration for Enhanced Security:

  • Implemented invisible reCAPTCHA using the rails-cloudflare-turnstile gem.
  • This adds an additional layer of bot protection during user registration, making it harder for automated scripts to create accounts.
  • The verification is configured to run specifically in the production environment via a before_action and includes appropriate error handling for failed challenges.

• GitHub Account Verification for User Registration: TEMPORARY!!

  • Introduced a new GithubAccountVerifier service responsible for validating the existence of GitHub usernames via the GitHub API.
  • Integrated this service into the User model with a custom validation to ensure only valid GitHub accounts can be registered.
  • Added presence: true and uniqueness: true validations for the github_username field.
  • Included a robust format validation for GitHub usernames, ensuring they conform to GitHub's naming conventions.
  • Updated the user registration form (devise/registrations/new.html.erb) to include the GitHub username field.
  • Relevant tests for user registration and the GithubAccountVerifier service have been updated/added to ensure correct functionality and error handling.

• Improved Testing Capabilities with Mocha:

  • Added the mocha gem to the test environment.
  • This gem provides powerful mocking and stubbing capabilities, which are essential for writing isolated and efficient unit tests. It is particularly useful for components that interact with external services (like the GithubAccountVerifier), allowing us to simulate API responses without making actual network calls.

• Rails 8 Compatibility Update for User Model enum:

  • Updated the enum definition for the role attribute in the User model.
  • Switched from the deprecated keyword argument syntax (enum role: { ... }) to the new positional argument syntax (enum :role, { ... }).
  • This change addresses a deprecation warning and proactively ensures the code remains compatible with future Rails 8 releases.

How to Test/Verify:

1. User Registration (Manual):

   • Attempt to register a new user:
     • With a valid GitHub username.
     • With a non-existent GitHub username.
     • With a blank GitHub username.
     • With an invalid format GitHub username (e.g., user--name).
   • Verify that error messages are displayed correctly for invalid GitHub usernames.
   • Observe the Cloudflare Turnstile widget on the registration page (in development, you might need to temporarily remove if Rails.env.production? from the before_action in RegistrationsController to see it in action).

2. Run Test Suite:

   • Execute bundle exec rails test to ensure all existing and new tests pass, especially for the User model and GithubAccountVerifier service.

3. Code Review:

   • Verify the updated enum syntax in app/models/user.rb.
   • Review app/services/github_account_verifier.rb and its corresponding test file.
   • Check app/controllers/users/registrations_controller.rb for Turnstile integration and app/views/devise/registrations/new.html.erb for the Turnstile tag and GitHub username field.

[adamswonder]

Jolly good! Tested different scenarios