Some options are:

• https://github.com/zipmark/rspec_api_documentation
• https://github.com/adrian-gomez/swaggard
• https://apiblueprint.org/

I'm creating this issue so we do a general update on our dependencies. It's been a while since we updated them.

Some examples are:

• draper
• jbuilder
• pg (this one in particular)
• activeadmin

I think it'd be a good idea to move from Carrierwave to ActiveStorage since it's the Rails way to manage files. I guess we can try it with one app before making the change here.

https://edgeguides.rubyonrails.org/active_storage_overview.html

Thoughts?

Check https://github.com/troessner/reek#working-with-rails and also disable UtilityFunction for controllers

Check jb, it's considered faster than jbuilder

Another alternative faster and cleaner is fast_jsonapi which is based on serializers, so it's like having views + decorators in the same file.

Feel free to close this issue if none of these gems is a good replacement.

After the server processes the request and renders the Jbuilder view, the server performs several queries to the users table and it's not clear why it's doing that. It also appears to do a transaction even though it doesn't perform an update on the database.

Below there's a screenshot of the server output:

Circle CI is finishing the support for the v1 on August 2018

Steps to reproduce the bug:

1. Go to the admin panel
2. Go to New User
3. Fill every field in the form

Expected result: the user should be created successfully.
Actual result: the user is not created.

Reason: the user is rejected if no password is set.

E.g.: https://github.com/rootstrap/kendr-api/pull/1

Check https://github.com/phurni/authlogic_api or http://railscasts.com/episodes/352-securing-an-api?view=asciicast

Right now you have to paste a huge method from the sessions controller from devise token auth and remove the constraint: q = “#{field.to_s} = ? AND provider=‘email’“, it will be great if the method is split, but the maintainers of the gem aren't active as before. Maybe we should paste the code to our sessions controller

It doesn't work anymore. Applying it will probably cause problems in the API with a lot of code conflicts and corrupting the gemfile.lock

If you request an endpoint that doesn't exist, the API should return a pre-defined 404 response. The ApiController has a line that rescues this exception but it doesn't work as expected.

We should remove this module because we are not using it.

rememberable is only applicable for cookie based authentication.

Nowadays, when there is any kind of error, the base returns a json response with:

• error key in case there is only one error. Example: https://github.com/rootstrap/rails_api_base/blob/master/app/controllers/api/v1/api_controller.rb#L27
• errors key in case there are more than one error: Example: https://github.com/rootstrap/rails_api_base/blob/master/app/controllers/api/v1/api_controller.rb#L37

However, we are using devise_token_auth_gem gem and they return a json response with the key errors doesn't matter if there is only one error or more than one. Example: https://github.com/lynndylanhurley/devise_token_auth/blob/master/app/controllers/devise_token_auth/sessions_controller.rb#L131

The proposed solution is override devise_token_auth render error methods and adjust them to our current standard.

When requesting POST api/v1/users/sign_in, the content type is text/html instead of application/json
even when the response body is a valid JSON with the signed in user.

• Replicable in http://rails5-api-base.herokuapp.com
• Environment: Production

When signups with facebook regardless the client, check:
lynndylanhurley/devise_token_auth#718
lynndylanhurley/devise_token_auth#835

This PR #90 removes the current Code Climate configuration since it was invalid.

We should discuss and define the proper configuration and creating a new code_climate.yml file according with what we want.

Tasks:

• Add gem

• Add config in rspec

• Add some tests with shoulda

https://github.com/kickstarter/rack-attack

Rack attack give apps the ability to throttle and block user IPs. This can be helpful for preventing brute-force passwords attacks, scrapers, DDoS attacks, or any other offenders by throttling requests from IP addresses making large volumes of requests.

They even provide a sample configuration that would work most of the times (maybe it doesn't work with sophisticated hackers). https://github.com/kickstarter/rack-attack/blob/master/docs/example_configuration.md

Would it be valuable to add rack attack and base config to this repo?

Reek is currently not running in CodeClimate because the channel that we specified (reek-5-3-1) is not available.

Apparently the only channel available is stable, which means that we don't have control over what version of reek to run in CodeClimate.

For this reason, I believe it would be best to remove it from CodeClimate and run it only in CircleCI, same as Rails Best Practices

Moving the code from env_variables.rb to application.rb solves the issue, but why is that?

Use it in every text that is going to be used. For example, error messaging in ApiController

Should we remove Database Cleaner? It seems to be unnecessary having a default Rails app.
https://anti-pattern.com/transactional-fixtures-in-rails

There is a identified issue in devise_token_auth, it has a workaround until Chrome fixes:

lynndylanhurley/devise_token_auth#702 (comment)

A request like this one

curl 
-H "Content-Type: application/json"
-X POST
-d '{ "user": { "username": "test", "email": "[email protected]", "password": "password", "password_confirmation": "password" } }' 
http://localhost:3000/api/v1/users

Is raising an ActionController::InvalidAuthenticityToken exception unless you add a "Accept: application/json" header too, which shouldn't be necessary

And make it run along with the other code quality tools.

https://github.com/flyerhzm/bullet

I'm creating this issue to keep track of the idea of adding Pagy as the default pagination gem.

Feel free to discuss other alternatives like Kaminari, Will Paginate, etc

When:
When trying to call a helper method inside a view and the helper hasn't been called before

What:
If the record is not found, it raises an error that it's catched by the render_error method in the ApiController instead of the render_record_not_found method.

Why:
When raising the error in the view, instead of raising an ActiveRecord:RecordNotFound error, it's raising an ActionViewTemplateError and that's why is not being catched by the render_record_not_found

For further details, ask @jdrosales17 who is the one that found the issue

When the content-type header is missing, the match? method in check_json_request causes a 500 error as try to do match? for a nil object.

• Version: v.1.0.5
• Ruby Version: 2.4.1
• Environment: development and staging
• Rails Stacktrace:
  2018-05-18T13:22:39.551097+00:00 app[web.1]: E, [2018-05-18T13:22:39.549374 #4] ERROR -- : [042ea98c-c045-4129-814b-1429ebeaf83e] undefined method `match?' for nil:NilClass 2018-05-18T13:22:39.553823+00:00 app[web.1]: I, [2018-05-18T13:22:39.553748 #4] INFO -- : [042ea98c-c045-4129-814b-1429ebeaf83e] Completed 500 Internal Server Error in 5ms (Views: 0.3ms | ActiveRecord: 0.0ms)

last time i try this and i don't have a problem and last night i try to clone and everything setup but i got this problem with Fog?

after i try to bundle exec rake db:migrate

rake aborted!
NameError: uninitialized constant CarrierWave::Storage::Fog
/Users/ericsonluciano/code/side_projects/www.hospitalitycareers.com/server/config/initializers/carrierwave.rb:9:in `block in <top (required)>'
/Users/ericsonluciano/code/side_projects/www.hospitalitycareers.com/server/config/initializers/carrierwave.rb:1:in `<top (required)>'
/Users/ericsonluciano/code/side_projects/www.hospitalitycareers.com/server/config/environment.rb:5:in `<top (required)>'
/Users/ericsonluciano/.rbenv/versions/2.4.1/bin/bundle:22:in `load'
/Users/ericsonluciano/.rbenv/versions/2.4.1/bin/bundle:22:in `<main>'
Tasks: TOP => db:migrate => environment
(See full trace by running task with `--trace)`

As discussed, draper adds complexity that we don't really need. We'll replace our current presenter by making a PORO that inherits from a BasePresenter. We should also add some documentation to this BasePresenter on when and how to use presenters, maybe by linking to a place where this is well explained.

The current version of rubocop complains if you try to use the Ruby Safe navigator.

Using the newest version should resolve the issue.

Check https://github.com/rootstrap/rails_api_base/community

You can take a look into https://codeclimate.com/github/rootstrap/rails_api_base/issues

• Disable "Missing frozen string literal comment." in the code climate config file like CC explains in that screen (click exclude)
• Fix order of gems
• Fix ActiveAdmin long line

In update password, client_id is wrong, and the test runs successfully wrong.

It happens randomically when:

• When there are several requests together, it should be resolved with batch requests, but there are issues reported about it
• A request right away another one in iOS, maybe it isn't stored correctly for the first request in the frontend side.

This problem was mitigated temporally disabling the headers refreshing in #43

Check https://github.com/carrierwaveuploader/carrierwave/wiki/How-to:-Create-random-and-unique-filenames-for-all-versioned-files

Also routing tests, remove controller tests

It is wrong closed in lynndylanhurley/devise_token_auth#681, the workaround is https://stackoverflow.com/questions/38424068/devise-token-auth-rails-5-indexerror-string-not-matched

The current implementation it's not compatible with the officially supported npm module. It requires a token to be added to a header.
Maybe a previously generated token could be sent during the handshake, as explained in this Heroku article

I'm creating this issue to keep track of an idea that has been going around for some time: forced updates for mobile apps.

Pasting @grilix's arguments here which makes totally sense:

Testing factories doesn't really make sense, factories are part of the specs so it's like writing tests for the specs. Secs for the models are already in place in /spec/models.

Also, FactoryGirl will load and execute all the files inside /spec/factories with no specific order, which means: 1. There's no guarantee this spec is going to test all the factories, 2. There's no way of turning these specs (for example if we want to run just one specific file), which results in confusing output.

So we should remove them, another possibility will be using FactoryBot.lint.