production hardening

Author: zalepa

app/controllers/admin/agenda_items_controller.rb

@@ -1,5 +1,7 @@
 module Admin
   class AgendaItemsController < BaseController
+    rate_limit to: 3, within: 1.minute, only: :auto_tag_all, with: -> { redirect_to untagged_admin_agenda_items_path, alert: "Too many requests. Please wait a moment." }
+
     def untagged
       scope = AgendaItem.left_joins(:agenda_item_tags)
                 .where(agenda_item_tags: { id: nil })
@@ -39,6 +41,7 @@ def auto_tag_all
                          .count
       tagged_now = items.size - still_untagged
 
+      audit("agenda_items.auto_tag_all", metadata: { tagged: tagged_now, still_untagged: still_untagged })
       redirect_to untagged_admin_agenda_items_path,
         notice: "Auto-tagged #{tagged_now} items. #{still_untagged} still need manual tagging."
     end

app/controllers/admin/audit_logs_controller.rb

@@ -0,0 +1,21 @@
+module Admin
+  class AuditLogsController < BaseController
+    before_action :require_site_admin
+
+    def index
+      @audit_logs = AdminAuditLog.includes(:user).recent
+
+      if params[:action_filter].present?
+        @audit_logs = @audit_logs.where(action: params[:action_filter])
+      end
+
+      if params[:user_id].present?
+        @audit_logs = @audit_logs.where(user_id: params[:user_id])
+      end
+
+      @audit_logs = @audit_logs.limit(100)
+      @action_types = AdminAuditLog.distinct.pluck(:action).sort
+      @admin_users = User.where(role: [ :content_admin, :site_admin ]).order(:name)
+    end
+  end
+end

app/controllers/admin/base_controller.rb

@@ -1,5 +1,7 @@
 module Admin
   class BaseController < ApplicationController
+    include Auditable
+
     before_action :require_content_admin_or_above
 
     layout "admin"

app/controllers/admin/blog_posts_controller.rb

@@ -18,6 +18,7 @@ def create
       @blog_post.user = Current.user
 
       if @blog_post.save
+        audit("blog_post.create", target: @blog_post)
         redirect_to admin_blog_post_path(@blog_post), notice: "Blog post created."
       else
         render :new, status: :unprocessable_entity
@@ -36,16 +37,19 @@ def update
     end
 
     def destroy
+      audit("blog_post.destroy", target: @blog_post, metadata: { title: @blog_post.title })
       @blog_post.destroy!
       redirect_to admin_blog_posts_path, notice: "Blog post deleted."
     end
 
     def publish
       if @blog_post.published?
         @blog_post.unpublish!
+        audit("blog_post.unpublish", target: @blog_post)
         redirect_to admin_blog_post_path(@blog_post), notice: "Blog post unpublished."
       else
         @blog_post.publish!
+        audit("blog_post.publish", target: @blog_post)
         redirect_to admin_blog_post_path(@blog_post), notice: "Blog post published."
       end
     end

app/controllers/admin/council_members_controller.rb

@@ -13,6 +13,7 @@ def create
       @council_member = CouncilMember.new(council_member_params)
 
       if @council_member.save
+        audit("council_member.create", target: @council_member)
         redirect_to admin_council_members_path, notice: "Council member added."
       else
         render :new, status: :unprocessable_entity
@@ -27,6 +28,7 @@ def update
       @council_member = CouncilMember.find(params[:id])
 
       if @council_member.update(council_member_params)
+        audit("council_member.update", target: @council_member)
         redirect_to admin_council_members_path, notice: "Council member updated."
       else
         render :edit, status: :unprocessable_entity
@@ -35,6 +37,7 @@ def update
 
     def destroy
       @council_member = CouncilMember.find(params[:id])
+      audit("council_member.destroy", target: @council_member, metadata: { name: @council_member.display_name })
       @council_member.destroy!
       redirect_to admin_council_members_path, notice: "Council member deleted."
     end

app/controllers/admin/dashboard_controller.rb

@@ -69,6 +69,9 @@ def show
 
       # --- Blog ---
       @draft_posts = BlogPost.draft.chronological.limit(3)
+
+      # --- Audit log ---
+      @recent_audit_logs = AdminAuditLog.includes(:user).recent.limit(10)
     end
   end
 end

app/controllers/admin/invitations_controller.rb

@@ -16,6 +16,7 @@ def create
       @invitation.invited_by = Current.session.user
 
       if @invitation.save
+        audit("invitation.create", target: @invitation, metadata: { role: @invitation.role })
         redirect_to admin_invitations_path, notice: "Invitation created."
       else
         render :new, status: :unprocessable_entity
@@ -24,6 +25,7 @@ def create
 
     def destroy
       @invitation = Invitation.find(params[:id])
+      audit("invitation.revoke", target: @invitation)
       @invitation.destroy
       redirect_to admin_invitations_path, notice: "Invitation revoked."
     end

app/controllers/admin/meetings_controller.rb

@@ -1,5 +1,7 @@
 module Admin
   class MeetingsController < BaseController
+    rate_limit to: 5, within: 1.minute, only: %i[create import_minutes auto_tag], with: -> { redirect_back fallback_location: admin_meetings_path, alert: "Too many requests. Please wait a moment." }
+
     def index
       @meetings = Meeting.includes(agenda_versions: { agenda_sections: :agenda_items }).chronological
     end
@@ -48,6 +50,7 @@ def create
       service = AgendaImportService.new(data).call
 
       if service.success?
+        audit("agenda.import", target: service.meeting, metadata: { version: service.agenda_version.version_number })
         notice = if service.new_version?
           "New version (v#{service.agenda_version.version_number}) added for this meeting."
         else
@@ -98,6 +101,7 @@ def apply_agenda
       Rails.cache.delete(cache_key)
 
       if service.success?
+        audit("agenda.apply_changes", target: @meeting, metadata: { changes_applied: accepted.size })
         redirect_to admin_meeting_path(@meeting), notice: "#{accepted.size} change(s) applied successfully."
       else
         redirect_to admin_meeting_path(@meeting), alert: service.errors.join(", ")
@@ -129,6 +133,7 @@ def import_minutes
       service = MinutesImportService.new(data).call
 
       if service.success?
+        audit("minutes.import", target: @meeting)
         notice = "Minutes imported successfully."
         notice += " Warnings: #{service.warnings.join('; ')}" if service.warnings.any?
         redirect_to admin_meeting_path(@meeting), notice: notice
@@ -147,6 +152,7 @@ def delete_minutes
         end
       end
 
+      audit("minutes.delete", target: @meeting)
       redirect_to admin_meeting_path(@meeting), notice: "Minutes data deleted."
     end
 
@@ -155,9 +161,11 @@ def publish
       @agenda_version = @meeting.agenda_versions.find(params[:version_id])
       if @agenda_version.published?
         @agenda_version.unpublish!
+        audit("agenda.unpublish", target: @meeting, metadata: { version: @agenda_version.version_number })
         redirect_to admin_meeting_path(@meeting), notice: "Version #{@agenda_version.version_number} unpublished."
       else
         @agenda_version.publish!
+        audit("agenda.publish", target: @meeting, metadata: { version: @agenda_version.version_number })
         redirect_to admin_meeting_path(@meeting), notice: "Version #{@agenda_version.version_number} published."
       end
     end
@@ -170,12 +178,14 @@ def auto_tag
       AutoTaggingService.new(items).call
 
       tagged_count = items.count { |i| i.tags.reload.any? }
+      audit("meeting.auto_tag", target: @meeting, metadata: { tagged: tagged_count, total: items.size })
       redirect_to admin_meeting_path(@meeting),
         notice: "Auto-tagged #{tagged_count} of #{items.size} items."
     end
 
     def destroy
       @meeting = Meeting.find(params[:id])
+      audit("meeting.destroy", target: @meeting, metadata: { date: @meeting.date.to_s })
       @meeting.destroy!
       redirect_to admin_meetings_path, notice: "Meeting deleted."
     end

app/controllers/admin/tags_controller.rb

@@ -1,5 +1,7 @@
 module Admin
   class TagsController < BaseController
+    rate_limit to: 3, within: 1.minute, only: :seed_rules, with: -> { redirect_to admin_tags_path, alert: "Too many requests. Please wait a moment." }
+
     SORT_COLUMNS = {
       "name" => "LOWER(tags.name)",
       "items" => "COUNT(agenda_item_tags.id)"
@@ -40,12 +42,14 @@ def update
 
     def destroy
       @tag = Tag.find(params[:id])
+      audit("tag.destroy", target: @tag, metadata: { name: @tag.name })
       @tag.destroy
       redirect_to admin_tags_path(q: params[:q]), notice: "Tag \"#{@tag.name}\" deleted."
     end
 
     def seed_rules
       AutoTaggingService.seed_default_rules!
+      audit("tags.seed_rules")
       redirect_to admin_tags_path, notice: "Default auto-tag rules seeded."
     end
 

app/controllers/concerns/auditable.rb

@@ -0,0 +1,9 @@
+module Auditable
+  extend ActiveSupport::Concern
+
+  private
+
+  def audit(action, target: nil, metadata: {})
+    AdminAuditLog.log(action: action, target: target, metadata: metadata)
+  end
+end