Merge branch 'develop'

.env.example

@@ -17,6 +17,8 @@ REDIS_URL=redis://localhost:6379
 # Miscellaneous
 DAYS_A_JOURNEY_CAN_BE_INACTIVE_FOR=30
 
+SUPPORT_EMAIL=[email protected]
+
 # Contentful
 CONTENTFUL_URL=cdn.contentful.com
 CONTENTFUL_SPACE=

.env.test

@@ -21,3 +21,5 @@ CONTENTFUL_DEFAULT_CATEGORY_ENTRY_ID=contentful-category-entry
 
 # API
 CONTENTFUL_WEBHOOK_API_KEY=
+
+SUPPORT_EMAIL=[email protected]

.github/workflows/deploy.yml

@@ -36,6 +36,14 @@ jobs:
         run: echo "::set-output name=value::$TF_VAR_docker_image"
       - name: Build
         run: script/docker-push-ghcr
+      - name: Notify
+        uses: 8398a7/action-slack@v3
+        if: failure()
+        with:
+          fields: workflow,job,commit,repo,ref,author,took
+          status: ${{ job.status }}
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
 
   deploy:
     needs: build
@@ -69,3 +77,11 @@ jobs:
         run: |
           script/deploy-terraform
         if: github.ref == 'refs/heads/main'
+      - name: Notify
+        uses: 8398a7/action-slack@v3
+        if: failure()
+        with:
+          fields: workflow,job,commit,repo,ref,author,took
+          status: ${{ job.status }}
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

CHANGELOG.md

@@ -6,6 +6,22 @@ The format is based on [Keep a Changelog 1.0.0].
 
 ## [Unreleased]
 
+## [release-010] - 2021-05-27
+
+- add header and footer information for feedback and data requests
+- force SSL in production to only accept HTTPS traffic, enable HSTS and secure tower cookies
+- prevent concurrent sign ins
+- Create Task model; fetch tasks from Contentful and create them in the
+  database.
+- Break direct association between Journey and Steps. Create new association
+  between Tasks and Steps.
+- Show Tasks on Journey page; clicking on a Task name takes you to a task page.
+- Show Steps on Task page and allow users to answer questions from Task page
+- fix CI not running RSpec
+- existing specification page displays useful message when no specs exist
+- fix text input field width to fit full screen width
+- document where to find the service in the readme
+
 ## [release-009] - 2021-05-21
 
 - fix multiple specification fields
@@ -133,7 +149,8 @@ Contentful fixture
 - Contentful can redirect users to preview endpoints
 - users can be asked to answer a long text question
 
-[unreleased]: https://github.com/DFE-Digital/buy-for-your-school/compare/release-009...HEAD
+[unreleased]: https://github.com/DFE-Digital/buy-for-your-school/compare/release-010...HEAD
+[release-010]: https://github.com/DFE-Digital/buy-for-your-school/compare/release-009...release-010
 [release-009]: https://github.com/DFE-Digital/buy-for-your-school/compare/release-008...release-009
 [release-008]: https://github.com/DFE-Digital/buy-for-your-school/compare/release-007...release-008
 [release-007]: https://github.com/DFE-Digital/buy-for-your-school/compare/release-006...release-007

Dockerfile

@@ -44,6 +44,7 @@ COPY lib ${INSTALL_PATH}/lib
 COPY config ${INSTALL_PATH}/config
 COPY db ${INSTALL_PATH}/db
 COPY script ${INSTALL_PATH}/script
+COPY spec ${INSTALL_PATH}/spec
 COPY app ${INSTALL_PATH}/app
 # End
 

Gemfile

@@ -23,6 +23,7 @@ gem "puma", "~> 5.2"
 gem "redcarpet", "~> 3.5"
 gem "redis", "~> 4.2"
 gem "redis-namespace"
+gem "redis-rails"
 gem "rollbar"
 gem "rails", "~> 6.1.3"
 gem "sass-rails", "~> 6.0"

Gemfile.lock

@@ -71,7 +71,7 @@ GEM
       rack (>= 0.9.0)
     bindata (2.4.8)
     bindex (0.8.1)
-    bootsnap (1.7.3)
+    bootsnap (1.7.4)
       msgpack (~> 1.0)
     brakeman (5.0.0)
     builder (3.2.4)
@@ -277,8 +277,24 @@ GEM
       ffi (~> 1.0)
     redcarpet (3.5.1)
     redis (4.2.5)
+    redis-actionpack (5.2.0)
+      actionpack (>= 5, < 7)
+      redis-rack (>= 2.1.0, < 3)
+      redis-store (>= 1.1.0, < 2)
+    redis-activesupport (5.2.0)
+      activesupport (>= 3, < 7)
+      redis-store (>= 1.3, < 2)
     redis-namespace (1.8.1)
       redis (>= 3.0.4)
+    redis-rack (2.1.3)
+      rack (>= 2.0.8, < 3)
+      redis-store (>= 1.2, < 2)
+    redis-rails (5.0.2)
+      redis-actionpack (>= 5.0, < 6)
+      redis-activesupport (>= 5.0, < 6)
+      redis-store (>= 1.2, < 2)
+    redis-store (1.9.0)
+      redis (>= 4, < 5)
     regexp_parser (2.1.1)
     rexml (3.2.5)
     rollbar (3.1.2)
@@ -441,6 +457,7 @@ DEPENDENCIES
   redcarpet (~> 3.5)
   redis (~> 4.2)
   redis-namespace
+  redis-rails
   rollbar
   rspec-rails
   sass-rails (~> 6.0)

README.md

@@ -7,6 +7,7 @@ A service to help school buying professionals create tender documents that compl
 1. [Managing environment variables](/doc/managing-environment-variables.md)
 1. [DfE Sign-in](/doc/dfe-sign-in.md)
 1. [Console access](/doc/console-access.md)
+1. [Logging](/doc/logging.md)
 
 ## Making changes
 
@@ -22,7 +23,13 @@ in doc/architecture/decisions and contributed to with the
 
 ## Access
 
-TODO: Where can people find the service and the different environments?
+| Environment    | URL                                                            |
+| :------------- | :------------------------------------------------------------: |
+|  Development   | http://localhost:3000                                          |
+|  Research      | https://buy-for-your-school-research.london.cloudapps.digital  |
+|  Preview       | https://buy-for-your-school-preview.london.cloudapps.digital   |
+|  Staging       | https://staging-get-help-buying-for-schools.education.gov.uk   |
+|  Production    | https://get-help-buying-for-schools.education.gov.uk           |
 
 ## Source
 

app/controllers/answers_controller.rb

@@ -18,7 +18,11 @@ def create
     @answer = result.object
 
     if result.success?
-      redirect_to journey_path(@journey, anchor: @step.id)
+      if parent_task.has_single_visible_step?
+        redirect_to journey_path(@journey, anchor: @step.id)
+      else
+        redirect_to journey_task_path(@journey, parent_task)
+      end
     else
       render "steps/#{@step.contentful_type}", locals: {layout: "steps/new_form_wrapper"}
     end
@@ -33,16 +37,20 @@ def update
     @answer = result.object
 
     if result.success?
-      redirect_to journey_path(@journey, anchor: @step.id)
+      if parent_task.has_single_visible_step?
+        redirect_to journey_path(@journey, anchor: @step.id)
+      else
+        redirect_to journey_task_path(@journey, parent_task)
+      end
     else
       render "steps/#{@step.contentful_type}", locals: {layout: "steps/edit_form_wrapper"}
     end
   end
 
   private
 
-  def journey_id
-    params[:journey_id]
+  def parent_task
+    @step.task
   end
 
   def step_id

app/controllers/api/contentful/entries_controller.rb

@@ -5,6 +5,8 @@ class Api::Contentful::EntriesController < ApplicationController
   skip_before_action :verify_authenticity_token
 
   def changed
+    Rollbar.info("Accepted request to cache bust key: #{cache_key}", params: params)
+
     Cache.delete(key: cache_key)
     render json: {status: "OK"}, status: :ok
   end

app/controllers/application_controller.rb

@@ -27,7 +27,7 @@ def authenticate_user!
     return if current_user
 
     session.delete(:dfe_sign_in_uid)
-    redirect_to root_path
+    redirect_to root_path, notice: "You've been signed out."
   end
 
   def current_journey

app/controllers/journeys_controller.rb

@@ -7,7 +7,7 @@ class JourneysController < ApplicationController
     render "errors/specification_template_invalid", status: 500, locals: {error: exception}
   end
 
-  rescue_from CreateJourneyStep::UnexpectedContentfulModel do |exception|
+  rescue_from CreateJourneyStep::UnexpectedContentfulModel, CreateTask::UnexpectedContentfulModel do |exception|
     render "errors/unexpected_contentful_model", status: 500
   end
 
@@ -30,21 +30,6 @@ def new
 
   def show
     @journey = current_journey
-    @visible_steps = @journey.visible_steps.includes([
-      :radio_answer,
-      :short_text_answer,
-      :long_text_answer,
-      :single_date_answer,
-      :checkbox_answers,
-      :number_answer,
-      :currency_answer
-    ])
-    @step_presenters = @visible_steps.map { |step| StepPresenter.new(step) }
-  end
-
-  private
-
-  def journey_id
-    params[:id]
+    @sections = @journey.sections.includes(:tasks)
   end
 end

app/controllers/preview/entries_controller.rb

@@ -7,10 +7,12 @@ def show
       user: current_user,
       liquid_template: "<p>N/A</p>"
     )
+    section = Section.create(title: "Preview Section", journey: @journey)
+    task = Task.create(title: "Preview Task", section: section)
 
     contentful_entry = GetEntry.new(entry_id: entry_id).call
     @step = CreateJourneyStep.new(
-      journey: @journey, contentful_entry: contentful_entry
+      task: task, contentful_entry: contentful_entry
     ).call
 
     redirect_to journey_step_path(@journey, @step)

app/controllers/sessions_controller.rb

@@ -5,8 +5,9 @@ class SessionsController < ApplicationController
   protect_from_forgery except: :bypass_callback
 
   def create
-    UserSession.new(session: session)
-      .persist_successful_dfe_sign_in_claim!(omniauth_hash: auth_hash)
+    user_session = UserSession.new(session: session)
+    user_session.persist_successful_dfe_sign_in_claim!(omniauth_hash: auth_hash)
+    user_session.invalidate_other_user_sessions(omniauth_hash: auth_hash)
 
     redirect_to dashboard_path
   end

app/controllers/specifications_controller.rb

@@ -5,15 +5,7 @@ class SpecificationsController < ApplicationController
 
   def show
     @journey = current_journey
-    @visible_steps = @journey.visible_steps.includes([
-      :radio_answer,
-      :short_text_answer,
-      :long_text_answer,
-      :single_date_answer,
-      :checkbox_answers,
-      :number_answer,
-      :currency_answer
-    ])
+    @visible_steps = @journey.visible_steps
     @step_presenters = @visible_steps.map { |step| StepPresenter.new(step) }
 
     specification_renderer = SpecificationRenderer.new(
@@ -33,10 +25,4 @@ def show
       end
     end
   end
-
-  private
-
-  def journey_id
-    params[:journey_id]
-  end
 end

app/controllers/steps_controller.rb

@@ -10,6 +10,11 @@ def show
     @step_presenter = StepPresenter.new(@step)
 
     @answer = AnswerFactory.new(step: @step).call
+    @back_url = if !parent_task || parent_task.has_single_visible_step?
+      journey_path(@journey, anchor: @step.id)
+    else
+      journey_task_path(@journey, parent_task)
+    end
 
     render @step.contentful_type, locals: {layout: "steps/new_form_wrapper"}
   end
@@ -21,13 +26,18 @@ def edit
     @step_presenter = StepPresenter.new(@step)
 
     @answer = @step.answer
+    @back_url = if !parent_task || parent_task.has_single_visible_step?
+      journey_path(@journey, anchor: @step.id)
+    else
+      journey_task_path(@journey, parent_task)
+    end
 
     render "steps/#{@step.contentful_type}", locals: {layout: "steps/edit_form_wrapper"}
   end
 
   private
 
-  def journey_id
-    params[:journey_id]
+  def parent_task
+    @step.task
   end
 end

app/controllers/tasks_controller.rb

@@ -0,0 +1,22 @@
+class TasksController < ApplicationController
+  def show
+    @journey = current_journey
+    @task = Task.find(task_id)
+    steps = @task.visible_steps.includes([
+      :short_text_answer,
+      :long_text_answer,
+      :radio_answer,
+      :checkbox_answers,
+      :currency_answer,
+      :number_answer,
+      :single_date_answer
+    ])
+    @steps = steps.map { |step| StepPresenter.new(step) }
+  end
+
+  private
+
+  def task_id
+    params[:id]
+  end
+end

app/helpers/application_helper.rb

@@ -12,6 +12,10 @@ def banner_tag
 
   def banner_message
     return I18n.t("banner.preview.message") if ENV["CONTENTFUL_PREVIEW_APP"].eql?("true")
-    I18n.t("banner.beta.message")
+    I18n.t("banner.beta.message", support_email: ENV.fetch("SUPPORT_EMAIL"))
+  end
+
+  def footer_message
+    I18n.t("banner.footer.message", support_email: ENV.fetch("SUPPORT_EMAIL"))
   end
 end

app/models/journey.rb

@@ -1,12 +1,16 @@
 class Journey < ApplicationRecord
   self.implicit_order_column = "created_at"
-  has_many :steps
-  has_many :sections
-  has_many :visible_steps, -> { where(steps: {hidden: false}) }, class_name: "Step"
+  has_many :sections, dependent: :destroy
+  has_many :tasks, through: :sections, class_name: "Task"
+  has_many :steps, through: :tasks, class_name: "Step"
   belongs_to :user
 
   validates :category, :liquid_template, presence: true
 
+  def visible_steps
+    steps.where(hidden: false)
+  end
+
   def all_steps_completed?
     visible_steps.all? { |step| step.answer.present? }
   end

app/models/section.rb

@@ -1,7 +1,8 @@
 class Section < ApplicationRecord
   self.implicit_order_column = "created_at"
   belongs_to :journey
-  has_many :tasks
+  has_many :tasks, dependent: :destroy
+  has_many :steps, through: :tasks, class_name: "Step"
 
   validates :title, :contentful_id, presence: true
 end