mirror of
https://github.com/we-promise/sure.git
synced 2026-04-13 00:57:22 +00:00
7ae9077935
* Add default family selection for invite-only onboarding mode When onboarding is set to invite-only, admins can now choose a default family that new users without an invitation are automatically placed into as members, instead of creating a new family for each signup. https://claude.ai/code/session_01U9KgikKjV6xbyBZ5wMYsYx * Restrict invite codes and onboarding settings to super_admin only The Invite Codes section on /settings/hosting was visible to any authenticated user via the show action, leaking all family names/IDs through the default-family dropdown. This tightens access: - Hide the entire Invite Codes section in the view behind super_admin? - Add before_action :ensure_super_admin to InviteCodesController for all actions (index, create, destroy), replacing the inline admin? check - Add ensure_super_admin_for_onboarding filter on hostings#update that blocks non-super_admin users from changing onboarding_state or invite_only_default_family_id https://claude.ai/code/session_01U9KgikKjV6xbyBZ5wMYsYx * Fix tests for super_admin-only invite codes and onboarding settings - Hostings controller test: sign in as sure_support_staff (super_admin) for the onboarding_state update test, since ensure_super_admin_for_onboarding now requires super_admin role - Invite codes tests: use super_admin fixture for the success case and verify that a regular admin gets redirected instead of raising StandardError https://claude.ai/code/session_01U9KgikKjV6xbyBZ5wMYsYx * Fix system test to use super_admin for self-hosting settings The invite codes section is now only visible to super_admin users, so the system test needs to sign in as sure_support_staff to find the onboarding_state select element. https://claude.ai/code/session_01U9KgikKjV6xbyBZ5wMYsYx * Skip invite code requirement when a default family is configured When onboarding is invite-only but a default family is set, the claim_invite_code before_action was blocking registration before the create action could assign the user to the default family. Now invite_code_required? returns false when invite_only_default_family_id is present, allowing codeless signups to land in the configured default family. https://claude.ai/code/session_01U9KgikKjV6xbyBZ5wMYsYx --------- Co-authored-by: Claude <noreply@anthropic.com>
85 lines
3.3 KiB
Plaintext
85 lines
3.3 KiB
Plaintext
<div class="space-y-4">
|
|
<div class="flex items-center justify-between">
|
|
<div class="space-y-1">
|
|
<p class="text-sm"><%= t(".title") %></p>
|
|
<p class="text-secondary text-sm"><%= t(".description", product: product_name) %></p>
|
|
</div>
|
|
|
|
<%= styled_form_with model: Setting.new,
|
|
url: settings_hosting_path,
|
|
method: :patch,
|
|
data: { controller: "auto-submit-form", auto_submit_form_trigger_event_value: "change" } do |form| %>
|
|
<div class="form-field w-fit">
|
|
<%= form.select :onboarding_state,
|
|
options_for_select(
|
|
[
|
|
[ t(".states.open"), "open" ],
|
|
[ t(".states.closed"), "closed" ],
|
|
[ t(".states.invite_only"), "invite_only" ]
|
|
],
|
|
Setting.onboarding_state
|
|
),
|
|
{ label: false },
|
|
{ data: { auto_submit_form_target: "auto" } } %>
|
|
</div>
|
|
<% end %>
|
|
</div>
|
|
|
|
<div class="flex items-center justify-between">
|
|
<div class="space-y-1">
|
|
<p class="text-sm"><%= t(".email_confirmation_title") %></p>
|
|
<p class="text-secondary text-sm"><%= t(".email_confirmation_description") %></p>
|
|
</div>
|
|
|
|
<%= styled_form_with model: Setting.new,
|
|
url: settings_hosting_path,
|
|
method: :patch,
|
|
data: { controller: "auto-submit-form", auto_submit_form_trigger_event_value: "change" } do |form| %>
|
|
<%= form.toggle :require_email_confirmation, { data: { auto_submit_form_target: "auto" } } %>
|
|
<% end %>
|
|
</div>
|
|
|
|
<% if Setting.onboarding_state == "invite_only" %>
|
|
<div class="flex items-center justify-between">
|
|
<div class="space-y-1">
|
|
<p class="text-sm"><%= t(".default_family_title") %></p>
|
|
<p class="text-secondary text-sm"><%= t(".default_family_description") %></p>
|
|
</div>
|
|
|
|
<%= styled_form_with model: Setting.new,
|
|
url: settings_hosting_path,
|
|
method: :patch,
|
|
data: { controller: "auto-submit-form", auto_submit_form_trigger_event_value: "change" } do |form| %>
|
|
<div class="form-field w-fit">
|
|
<%= form.select :invite_only_default_family_id,
|
|
options_for_select(
|
|
[ [ t(".default_family_none"), "" ] ] +
|
|
Family.all.map { |f| [ f.name, f.id ] },
|
|
Setting.invite_only_default_family_id
|
|
),
|
|
{ label: false },
|
|
{ data: { auto_submit_form_target: "auto" } } %>
|
|
</div>
|
|
<% end %>
|
|
</div>
|
|
|
|
<div class="flex items-center justify-between mb-4">
|
|
<div>
|
|
<span class="text-primary text-base font-medium"><%= t(".generated_tokens") %></span>
|
|
</div>
|
|
<div>
|
|
<%= render DS::Button.new(
|
|
text: t(".generate_tokens"),
|
|
variant: "primary",
|
|
href: invite_codes_path,
|
|
method: :post
|
|
) %>
|
|
</div>
|
|
</div>
|
|
|
|
<div>
|
|
<%= turbo_frame_tag :invite_codes, src: invite_codes_path %>
|
|
</div>
|
|
<% end %>
|
|
</div>
|