Upgrade to Rails 6.1 to prepare to replace secure_headers gem (LG-3832)

Gemfile

@@ -3,7 +3,7 @@ git_source(:github) { |repo_name| "https://github.com/#{repo_name}.git" }
 
 ruby '~> 2.6.5'
 
-gem 'rails', '~> 6.0.0'
+gem 'rails', '~> 6.1.0'
 
 gem 'ahoy_matey', '~> 3.0'
 gem 'american_date'

Gemfile.lock

@@ -86,61 +86,65 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (6.0.3.4)
-      actionpack (= 6.0.3.4)
+    actioncable (6.1.0)
+      actionpack (= 6.1.0)
+      activesupport (= 6.1.0)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.0.3.4)
-      actionpack (= 6.0.3.4)
-      activejob (= 6.0.3.4)
-      activerecord (= 6.0.3.4)
-      activestorage (= 6.0.3.4)
-      activesupport (= 6.0.3.4)
+    actionmailbox (6.1.0)
+      actionpack (= 6.1.0)
+      activejob (= 6.1.0)
+      activerecord (= 6.1.0)
+      activestorage (= 6.1.0)
+      activesupport (= 6.1.0)
       mail (>= 2.7.1)
-    actionmailer (6.0.3.4)
-      actionpack (= 6.0.3.4)
-      actionview (= 6.0.3.4)
-      activejob (= 6.0.3.4)
+    actionmailer (6.1.0)
+      actionpack (= 6.1.0)
+      actionview (= 6.1.0)
+      activejob (= 6.1.0)
+      activesupport (= 6.1.0)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.0.3.4)
-      actionview (= 6.0.3.4)
-      activesupport (= 6.0.3.4)
-      rack (~> 2.0, >= 2.0.8)
+    actionpack (6.1.0)
+      actionview (= 6.1.0)
+      activesupport (= 6.1.0)
+      rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.0.3.4)
-      actionpack (= 6.0.3.4)
-      activerecord (= 6.0.3.4)
-      activestorage (= 6.0.3.4)
-      activesupport (= 6.0.3.4)
+    actiontext (6.1.0)
+      actionpack (= 6.1.0)
+      activerecord (= 6.1.0)
+      activestorage (= 6.1.0)
+      activesupport (= 6.1.0)
       nokogiri (>= 1.8.5)
-    actionview (6.0.3.4)
-      activesupport (= 6.0.3.4)
+    actionview (6.1.0)
+      activesupport (= 6.1.0)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.0.3.4)
-      activesupport (= 6.0.3.4)
+    activejob (6.1.0)
+      activesupport (= 6.1.0)
       globalid (>= 0.3.6)
-    activemodel (6.0.3.4)
-      activesupport (= 6.0.3.4)
-    activerecord (6.0.3.4)
-      activemodel (= 6.0.3.4)
-      activesupport (= 6.0.3.4)
-    activestorage (6.0.3.4)
-      actionpack (= 6.0.3.4)
-      activejob (= 6.0.3.4)
-      activerecord (= 6.0.3.4)
+    activemodel (6.1.0)
+      activesupport (= 6.1.0)
+    activerecord (6.1.0)
+      activemodel (= 6.1.0)
+      activesupport (= 6.1.0)
+    activestorage (6.1.0)
+      actionpack (= 6.1.0)
+      activejob (= 6.1.0)
+      activerecord (= 6.1.0)
+      activesupport (= 6.1.0)
       marcel (~> 0.3.1)
-    activesupport (6.0.3.4)
+      mimemagic (~> 0.3.2)
+    activesupport (6.1.0)
       concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-      zeitwerk (~> 2.2, >= 2.2.2)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+      zeitwerk (~> 2.3)
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
     aes_key_wrap (1.1.0)
@@ -459,20 +463,20 @@ GEM
     rack_session_access (0.2.0)
       builder (>= 2.0.0)
       rack (>= 1.0.0)
-    rails (6.0.3.4)
-      actioncable (= 6.0.3.4)
-      actionmailbox (= 6.0.3.4)
-      actionmailer (= 6.0.3.4)
-      actionpack (= 6.0.3.4)
-      actiontext (= 6.0.3.4)
-      actionview (= 6.0.3.4)
-      activejob (= 6.0.3.4)
-      activemodel (= 6.0.3.4)
-      activerecord (= 6.0.3.4)
-      activestorage (= 6.0.3.4)
-      activesupport (= 6.0.3.4)
-      bundler (>= 1.3.0)
-      railties (= 6.0.3.4)
+    rails (6.1.0)
+      actioncable (= 6.1.0)
+      actionmailbox (= 6.1.0)
+      actionmailer (= 6.1.0)
+      actionpack (= 6.1.0)
+      actiontext (= 6.1.0)
+      actionview (= 6.1.0)
+      activejob (= 6.1.0)
+      activemodel (= 6.1.0)
+      activerecord (= 6.1.0)
+      activestorage (= 6.1.0)
+      activesupport (= 6.1.0)
+      bundler (>= 1.15.0)
+      railties (= 6.1.0)
       sprockets-rails (>= 2.0.0)
     rails-controller-testing (1.0.5)
       actionpack (>= 5.0.1.rc1)
@@ -491,12 +495,12 @@ GEM
     rails-i18n (6.0.0)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 7)
-    railties (6.0.3.4)
-      actionpack (= 6.0.3.4)
-      activesupport (= 6.0.3.4)
+    railties (6.1.0)
+      actionpack (= 6.1.0)
+      activesupport (= 6.1.0)
       method_source
       rake (>= 0.8.7)
-      thor (>= 0.20.3, < 2.0)
+      thor (~> 1.0)
     rainbow (3.0.0)
     raise-if-root (0.0.2)
     rake (13.0.3)
@@ -628,8 +632,8 @@ GEM
     tpm-key_attestation (0.10.0)
       bindata (~> 2.4)
       openssl-signature_algorithm (~> 1.0)
-    tzinfo (1.2.9)
-      thread_safe (~> 0.1)
+    tzinfo (2.0.4)
+      concurrent-ruby (~> 1.0)
     uglifier (4.2.0)
       execjs (>= 0.3.0, < 3)
     unicode-display_width (1.7.0)
@@ -760,7 +764,7 @@ DEPENDENCIES
   rack-test (>= 1.1.0)
   rack-timeout
   rack_session_access (>= 0.2.0)
-  rails (~> 6.0.0)
+  rails (~> 6.1.0)
   rails-controller-testing (>= 1.0.4)
   rails-erd (>= 1.6.0)
   raise-if-root

app/controllers/test/saml_test_controller.rb

@@ -43,7 +43,7 @@ def test_saml_settings
 
     def render_template_for(validity, response)
       render(
-        template: 'test/saml_test/decode_response.html.erb',
+        template: 'test/saml_test/decode_response',
         locals: { is_valid: validity, response: response },
       )
     end

app/models/phone_configuration.rb

@@ -8,10 +8,6 @@ class PhoneConfiguration < ApplicationRecord
 
   enum delivery_preference: { sms: 0, voice: 1 }
 
-  def decorate
-    PhoneConfigurationDecorator.new(self)
-  end
-
   def formatted_phone
     Phonelib.parse(phone).international
   end

app/views/accounts/_auth_apps.html.erb

@@ -21,9 +21,6 @@
           <div class="grid-col-12 mobile-lg:grid-col-6">
             <%= auth_app_configuration.name %>
           </div>
-          <div class="grid-col-12 mobile-lg:grid-col-6 truncate">
-            <%= PhoneConfigurationDecorator.new(auth_app_configuration).default_number_message %>
-          </div>
         </div>
         <div class="grid-col-4 right-align">
           <%= render @view_model.totp_partial, id: auth_app_configuration.id %>

app/views/accounts/_phone.html.erb

@@ -21,7 +21,9 @@
           <%= phone_configuration.phone %>
         </div>
         <div class="grid-col-4 text-center">
-          <%= PhoneConfigurationDecorator.new(phone_configuration).default_number_message %>
+          <% if current_user.default_phone_configuration == phone_configuration %>
+            <%= I18n.t('account.index.default') %>
+          <% end %>
         </div>
         <div class="grid-col-3 right-align">
           <%= render @view_model.manage_action_partial,

app/views/accounts/_piv_cac.html.erb

@@ -21,9 +21,6 @@
           <div class="grid-col-12 mobile-lg:grid-col-6">
             <%= piv_cac_configuration.name %>
           </div>
-          <div class="grid-col-12 mobile-lg:grid-col-6 truncate">
-            <%= PhoneConfigurationDecorator.new(piv_cac_configuration).default_number_message %>
-          </div>
         </div>
         <div class="grid-col-4 right-align">
           <%= render @view_model.piv_cac_partial, id: piv_cac_configuration.id %>

bin/webpack

@@ -7,9 +7,12 @@ require "pathname"
 ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../../Gemfile",
   Pathname.new(__FILE__).realpath)
 
-require "rubygems"
 require "bundler/setup"
 
 require "webpacker"
 require "webpacker/webpack_runner"
-Webpacker::WebpackRunner.run(ARGV)
+
+APP_ROOT = File.expand_path("..", __dir__)
+Dir.chdir(APP_ROOT) do
+  Webpacker::WebpackRunner.run(ARGV)
+end

bin/webpack-dev-server

@@ -7,9 +7,12 @@ require "pathname"
 ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../../Gemfile",
   Pathname.new(__FILE__).realpath)
 
-require "rubygems"
 require "bundler/setup"
 
 require "webpacker"
 require "webpacker/dev_server_runner"
-Webpacker::DevServerRunner.run(ARGV)
+
+APP_ROOT = File.expand_path("..", __dir__)
+Dir.chdir(APP_ROOT) do
+  Webpacker::DevServerRunner.run(ARGV)
+end

bin/yarn

@@ -0,0 +1,19 @@
+#!/usr/bin/env ruby
+require 'pathname'
+
+APP_ROOT = File.expand_path('..', __dir__)
+Dir.chdir(APP_ROOT) do
+  executable_path = ENV["PATH"].split(File::PATH_SEPARATOR).find do |path|
+    normalized_path = File.expand_path(path)
+
+    normalized_path != __dir__ && File.executable?(Pathname.new(normalized_path).join('yarn'))
+  end
+
+  if executable_path
+    exec File.expand_path(Pathname.new(executable_path).join('yarn')), *ARGV
+  else
+    $stderr.puts "Yarn executable was not detected in the system."
+    $stderr.puts "Download Yarn at https://yarnpkg.com/en/docs/install"
+    exit 1
+  end
+end

config/application.rb

@@ -1,5 +1,12 @@
 require_relative 'boot'
-require 'rails/all'
+
+require 'active_record/railtie'
+require 'action_controller/railtie'
+require 'action_view/railtie'
+require 'action_mailer/railtie'
+require 'rails/test_unit/railtie'
+require 'sprockets/railtie'
+
 require_relative '../lib/upaya_log_formatter'
 require_relative '../lib/app_config'
 require_relative '../lib/fingerprinter'
@@ -12,17 +19,19 @@ module Upaya
   class Application < Rails::Application
     AppConfig.setup(YAML.safe_load(File.read(Rails.root.join('config', 'application.yml'))))
 
-    config.load_defaults '6.0'
+    config.load_defaults '6.1'
     config.active_record.belongs_to_required_by_default = false
     config.assets.unknown_asset_fallback = true
 
-    # We can enable this once we know we're not rolling back from Rails 6
-    # https://guides.rubyonrails.org/upgrading_ruby_on_rails.html#purpose-in-signed-or-encrypted-cookie-is-now-embedded-within-cookies
-    config.action_dispatch.use_cookies_with_metadata = false
-
     config.active_job.queue_adapter = 'inline'
     config.time_zone = 'UTC'
 
+    # Generate CSRF tokens that are encoded in URL-safe Base64.
+    #
+    # This change is not backwards compatible with earlier Rails versions.
+    # It's best enabled when your entire app is migrated and stable on 6.1.
+    Rails.application.config.action_controller.urlsafe_csrf_tokens = false
+
     config.i18n.load_path += Dir[Rails.root.join('config', 'locales', '**', '*.{yml}')]
     config.i18n.available_locales = AppConfig.env.available_locales.try(:split, ' ') || %w[en]
     config.i18n.default_locale = :en

config/environments/development.rb

@@ -10,7 +10,16 @@
   config.assets.debug = true
   config.assets.digest = true
   config.assets.raise_runtime_errors = true
-  config.action_view.raise_on_missing_translations = true
+  config.i18n.raise_on_missing_translations = true
+
+  # Raise exceptions for disallowed deprecations.
+  config.active_support.disallowed_deprecation = :raise
+
+  # Tell Active Support which deprecation messages to disallow.
+  config.active_support.disallowed_deprecation_warnings = []
+
+  # Annotate rendered view with file names.
+  config.action_view.annotate_rendered_view_with_filenames = true
 
   config.action_mailer.default_url_options = {
     host: AppConfig.env.domain_name,

config/environments/production.rb

@@ -7,7 +7,7 @@
   config.consider_all_requests_local = false
   config.action_controller.perform_caching = true
 
-  config.action_controller.asset_host = proc do |_source, request|
+  config.asset_host = proc do |_source, request|
     # we want precompiled assets to have domain-agnostic URLs
     # and request is nil during asset precompilation
     (AppConfig.env.asset_host || AppConfig.env.domain_name) if request

config/environments/test.rb

@@ -12,14 +12,23 @@
   config.action_controller.allow_forgery_protection = false
   config.active_support.test_order = :random
   config.active_support.deprecation = :stderr
-  config.action_view.raise_on_missing_translations = true
+  config.i18n.raise_on_missing_translations = true
 
   config.action_mailer.delivery_method = :test
   config.action_mailer.default_url_options = { host: AppConfig.env.domain_name }
   config.action_mailer.asset_host = AppConfig.env.mailer_domain_name
 
   config.assets.debug = false
 
+  # Raise exceptions for disallowed deprecations.
+  config.active_support.disallowed_deprecation = :raise
+
+  # Tell Active Support which deprecation messages to disallow.
+  config.active_support.disallowed_deprecation_warnings = []
+  #
+  # Annotate rendered view with file names.
+  # config.action_view.annotate_rendered_view_with_filenames = true
+
   config.action_controller.asset_host = if ENV.key?('RAILS_ASSET_HOST')
                                           ENV['RAILS_ASSET_HOST']
                                         else