From 574d281cf6b3935693ef742c8bce84d18a4d15b0 Mon Sep 17 00:00:00 2001
From: Aga Dufrat <aga.dufrat@digital.cabinet-office.gov.uk>
Date: Tue, 19 Jul 2022 09:04:36 +0100
Subject: [PATCH 01/10] Update rails_translation_manager dependencies

---
 Gemfile.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index e652e005f..0eb16239e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -148,7 +148,7 @@ GEM
     http-accept (1.7.0)
     http-cookie (1.0.5)
       domain_name (~> 0.5)
-    i18n (1.11.0)
+    i18n (1.12.0)
       concurrent-ruby (~> 1.0)
     i18n-coverage (0.2.0)
     i18n-tasks (1.0.11)
@@ -238,9 +238,9 @@ GEM
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.4.3)
       loofah (~> 2.3)
-    rails-i18n (6.0.0)
+    rails-i18n (7.0.5)
       i18n (>= 0.7, < 2)
-      railties (>= 6.0.0, < 7)
+      railties (>= 6.0.0, < 8)
     rails_translation_manager (1.5.2)
       activesupport
       csv (~> 3.2)

From 694134eb0e0b876e8cfb266ed2d40e573248ab46 Mon Sep 17 00:00:00 2001
From: Aga Dufrat <aga.dufrat@digital.cabinet-office.gov.uk>
Date: Mon, 18 Jul 2022 14:14:47 +0100
Subject: [PATCH 02/10] Remove :many translations for hr and sr

The validate_locales test failed with
    Expected: [:few, :one, :other], actual: [:few, :many, :one, :other]
---
 config/locales/hr.yml | 76 -------------------------------------------
 config/locales/sr.yml | 76 -------------------------------------------
 2 files changed, 152 deletions(-)

diff --git a/config/locales/hr.yml b/config/locales/hr.yml
index 6ca101edd..4fcfe99aa 100644
--- a/config/locales/hr.yml
+++ b/config/locales/hr.yml
@@ -67,377 +67,302 @@ hr:
     schema_name:
       aaib_report:
         few:
-        many:
         one: Izvješće podružnice za istraživanje zračnih nesreća
         other: Izvješća Podružnice za istraživanje zračnih nesreća
       announcement:
         few:
-        many:
         one: Obavijest
         other: Obavijesti
       asylum_support_decision:
         few:
-        many:
         one: Odluka tribunala o azilu
         other: Odluke tribunala o azilu
       authored_article:
         few:
-        many:
         one: Autorski članak
         other: Autorski članci
       business_finance_support_scheme:
         few:
-        many:
         one: Shema potpore poslovnom financiranju
         other: Sheme potpore poslovnom financiranju
       case_study:
         few:
-        many:
         one: Studija slučaja
         other: Studije slučaja
       closed_consultation:
         few:
-        many:
         one: Zatvorena konzultacija
         other: Zatvorene konzultacije
       cma_case:
         few:
-        many:
         one: Slučaj tijela za tržišno natjecanje i tržišta
         other: Slučajevi tijela za tržišno natjecanje i tržišta
       coming_soon:
         few:
-        many:
         one: Dolazi uskoro
         other: Dolazi uskoro
       consultation:
         few:
-        many:
         one: Konzultacija
         other: Konzultacije
       consultation_outcome:
         few:
-        many:
         one: Ishod konzultacija
         other: Ishodi konzultacija
       corporate_information_page:
         few:
-        many:
         one: Stranica s informacijama
         other: Stranice s informacijama
       corporate_report:
         few:
-        many:
         one: Korporativno izvješće
         other: Korporativna izvješća
       correspondence:
         few:
-        many:
         one: Prepiska
         other: Prepiske
       countryside_stewardship_grant:
         few:
-        many:
         one: Potpora za upravu na selu
         other: Potpore za upravu na selu
       decision:
         few:
-        many:
         one: Odluka
         other: Odluke
       detailed_guide:
         few:
-        many:
         one: Upute
         other: Upute
       dfid_research_output:
         few:
-        many:
         one: Istraživanje za razvojni rezultat
         other: Istraživanje za razvojne rezultate
       document_collection:
         few:
-        many:
         one: Kolekcija
         other: Kolekcije
       draft_text:
         few:
-        many:
         one: Nacrt teksta
         other: Nacrt tekstova
       drug_safety_update:
         few:
-        many:
         one: Novost o sigurnosti lijekova
         other: Novosti o sigurnosti lijekova
       employment_appeal_tribunal_decision:
         few:
-        many:
         one: Odluka žalbenog suda pri zapošljavanju
         other: Odluke žalbenog suda pri zapošljavanju
       employment_tribunal_decision:
         few:
-        many:
         one: Odluka suda za zapošljavanje
         other: Odluke suda za zapošljavanje
       esi_fund:
         few:
-        many:
         one: Europski strukturni i investicijski fond (ESIF)
         other: Europski strukturni i investicijski fondovi (ESIF)
       fatality_notice:
         few:
-        many:
         one: Obavijest o smrtnom slučaju
         other: Obavijest o smrtnim slučajevima
       foi_release:
         few:
-        many:
         one: Izdanje slobode informacija
         other: Izdanje slobode informacija
       form:
         few:
-        many:
         one: Obrazac
         other: Obrasci
       government_response:
         few:
-        many:
         one: Odgovor vlade
         other: Odgovori vlade
       guidance:
         few:
-        many:
         one: Upute
         other: Upute
       impact_assessment:
         few:
-        many:
         one: Procjena utjecaja
         other: Procjene utjecaja
       imported:
         few:
-        many:
         one: uvezeno - čekajući tip
         other: uvezeno - čekajući tip
       independent_report:
         few:
-        many:
         one: Nezavisno izvješće
         other: Nezavisna izvješća
       international_development_fund:
         few:
-        many:
         one: Financiranje međunarodnog razvoja
         other: Financiranje međunarodnog razvoja
       international_treaty:
         few:
-        many:
         one: Međunarodni ugovor
         other: Međunarodni ugovori
       maib_report:
         few:
-        many:
         one: Izvješće Podružnice za istraživanje pomorskih nesreća
         other: Izvješća Podružnice za istraživanje pomorskih nesreća
       map:
         few:
-        many:
         one: Karta
         other: Karte
       medical_safety_alert:
         few:
-        many:
         one: Upozorenja i opozivi za lijekove i medicinska sredstva
         other: Upozorenja i opozivi za lijekove i medicinska sredstva
       national:
         few:
-        many:
         one: Najava nacionalne statistike
         other: Najave nacionalne statistike
       national_statistics:
         few:
-        many:
         one: Nacionalna statistika
         other: Nacionalna statistika
       national_statistics_announcement:
         few:
-        many:
         one: Najava nacionalne statistike
         other: Najave nacionalne statistike
       news_article:
         few:
-        many:
         one: Novinski članak
         other: Novinski članci
       news_story:
         few:
-        many:
         one: Novosti
         other: Novosti
       notice:
         few:
-        many:
         one: Obavijest
         other: Obavijesti
       official:
         few:
-        many:
         one: Objava službene statistike
         other: Objave službene statistike
       official_statistics:
         few:
-        many:
         one: Službena statistika
         other: Službena statistika
       official_statistics_announcement:
         few:
-        many:
         one: Objava službene statistike
         other: Objave službene statistike
       open_consultation:
         few:
-        many:
         one: Otvorena konzultacija
         other: Otvorene konzultacije
       oral_statement:
         few:
-        many:
         one: Usmena izjava Parlamentu
         other: Usmene izjave Parlamentu
       policy:
         few:
-        many:
         one: Pravilo
         other: Pravila
       policy_paper:
         few:
-        many:
         one: Dokument o pravilima
         other: Dokumenti o pravilima
       press_release:
         few:
-        many:
         one: Saopćenje za javnost
         other: Saopćenja za javnost
       product-safety-alert-report-recall:
         few:
-        many:
         one:
         other:
       promotional:
         few:
-        many:
         one: Promidžbeni materijal
         other: Promidžbeni materijal
       publication:
         few:
-        many:
         one: Izdanja
         other: Izdanje
       raib_report:
         few:
-        many:
         one: Izvješće podružnice za istraživanje željezničkih nesreća
         other: Izvješća podružnice za istraživanje željezničkih nesreća
       regulation:
         few:
-        many:
         one: Regulacija
         other: Regulacije
       research:
         few:
-        many:
         one: Istraživanje i analiza
         other: Istraživanje i analiza
       residential_property_tribunal_decision:
         few:
-        many:
         one: Odluka suda stambene imovine
         other: Odluke suda stambene imovine
       service_sign_in:
         few:
-        many:
         one: Prijava na uslugu
         other: Prijava na uslugu
       service_standard_report:
         few:
-        many:
         one: Standardno izvješće usluge
         other: Standardna izvješća usluge
       speaking_notes:
         few:
-        many:
         one: Govorne bilješke
         other: Govorne bilješke
       speech:
         few:
-        many:
         one: Govor
         other: Govori
       standard:
         few:
-        many:
         one: Standard
         other: Standardi
       statement_to_parliament:
         few:
-        many:
         one: Izjava Parlamentu
         other: Izjave Parlamentu
       statistical_data_set:
         few:
-        many:
         one: Skup statističkih podataka
         other: Skupovi statističkih podataka
       statistics_announcement:
         few:
-        many:
         one: Najava objavljivanja statistike
         other: Najave objavljivanja statistike
       statutory_guidance:
         few:
-        many:
         one: Zakonske smjernice
         other: Zakonske smjernice
       take_part:
         few:
-        many:
         one: Sudjelovati
         other: Sudjelovati
       tax_tribunal_decision:
         few:
-        many:
         one: Odluka tribunala i poreznog suda
         other: Odluke tribunala i poreznog suda
       transcript:
         few:
-        many:
         one: Prijepis
         other: Prijepisi
       transparency:
         few:
-        many:
         one: Podaci o transparentnosti
         other: Podaci o transparentnosti
       utaac_decision:
         few:
-        many:
         one: Odluka upravnog žalbenog suda
         other: Odluke upravnog žalbenog suda
       world_location_news_article:
         few:
-        many:
         one: Novinski članak
         other: Novinski članci
       world_news_story:
         few:
-        many:
         one: Vijest iz svijeta
         other: Vijesti iz svijeta
       written_statement:
         few:
-        many:
         one: Pismena izjava Parlamentu
         other: Pismene izjave Parlamentu
   corporate_information_page:
@@ -603,7 +528,6 @@ hr:
     details: Detalji
     documents:
       few:
-      many:
       one: Dokument
       other: Dokumenti
   service_sign_in:
diff --git a/config/locales/sr.yml b/config/locales/sr.yml
index 37b261b5c..546d4f9a1 100644
--- a/config/locales/sr.yml
+++ b/config/locales/sr.yml
@@ -67,377 +67,302 @@ sr:
     schema_name:
       aaib_report:
         few:
-        many:
         one: Izveštaj Agencije istragu vazduhoplovnih nesreća
         other: Izveštaji Agencije istragu vazduhoplovnih nesreća
       announcement:
         few:
-        many:
         one: Najava
         other: Najave
       asylum_support_decision:
         few:
-        many:
         one: Odluka tribunala za podršku azilu
         other: Odluke tribunala za podršku azilu
       authored_article:
         few:
-        many:
         one: Autorski članak
         other: Autorski članci
       business_finance_support_scheme:
         few:
-        many:
         one: Šema podrške za poslovno finansiranje
         other: Šeme podrške za poslovno finansiranje
       case_study:
         few:
-        many:
         one: Studija slučaja
         other: Studije slučaja
       closed_consultation:
         few:
-        many:
         one: Zatvorena konsultacija
         other: Zatvorene konsultacije
       cma_case:
         few:
-        many:
         one: Predmet Nacionalnog tela za zaštitu konkurencije i tržišta
         other: Predmeti Nacionalnog tela za zaštitu konkurencije i tržišta
       coming_soon:
         few:
-        many:
         one: Uskoro
         other: Uskoro
       consultation:
         few:
-        many:
         one: Konsultacija
         other: Konsultacije
       consultation_outcome:
         few:
-        many:
         one: Ishod konsultacija
         other: Ishodi konsultacija
       corporate_information_page:
         few:
-        many:
         one: Stranica sa informacijama
         other: Stranice sa informacijama
       corporate_report:
         few:
-        many:
         one: Organizacioni izveštaj
         other: Organizacioni izveštaji
       correspondence:
         few:
-        many:
         one: Prepiska
         other: Prepiske
       countryside_stewardship_grant:
         few:
-        many:
         one: Grant za upravljanje poljoprivrednim gazdinstvom
         other: Grantovi za upravljanje poljoprivrednim gazdinstvom
       decision:
         few:
-        many:
         one: Odluka
         other: Odluke
       detailed_guide:
         few:
-        many:
         one: Detaljno uputstvo
         other: Detaljno uputstvo
       dfid_research_output:
         few:
-        many:
         one: Istraživanje za krajnji cilj razvoja
         other: Istraživanje za krajnji ciljeve razvoja
       document_collection:
         few:
-        many:
         one: Kolekcija
         other: Kolekcije
       draft_text:
         few:
-        many:
         one: Radna verzija teksta
         other: Radne verzije teksta
       drug_safety_update:
         few:
-        many:
         one: Obaveštenje o bezbednosti lekova
         other: Obaveštenja o bezbednosti lekova
       employment_appeal_tribunal_decision:
         few:
-        many:
         one: Odluka tribunala za žalbe u vezi sa zaposlenjem
         other: Odluke tribunala za žalbe u vezi sa zaposlenjem
       employment_tribunal_decision:
         few:
-        many:
         one: Odluka tribunala za zaposlenje
         other: Odluke tribunala za zaposlenje
       esi_fund:
         few:
-        many:
         one: Evropski strukturni i investicioni fond (ESIF)
         other: Evropski strukturni i investicioni fondovi (ESIF)
       fatality_notice:
         few:
-        many:
         one: Obaveštenje o smrtnim slučajevima
         other: Obaveštenja o smrtnim slučajevima
       foi_release:
         few:
-        many:
         one: Odgovor na zahtev za pristup informacijama od javnog značaja
         other: Odgovori na zahteve za pristup informacijama od javnog značaja
       form:
         few:
-        many:
         one: Formular
         other: Obrasci
       government_response:
         few:
-        many:
         one: Odgovor vlade
         other: Odgovori vlade
       guidance:
         few:
-        many:
         one: Detaljno uputstvo
         other: Detaljno uputstvo
       impact_assessment:
         few:
-        many:
         one: Procena efekta
         other: Procene efekata
       imported:
         few:
-        many:
         one: uvezeno – utvrđivanje tipa
         other: uvezeno – utvrđivanje tipa
       independent_report:
         few:
-        many:
         one: Nezavisni izveštaj
         other: Nezavisni izveštaji
       international_development_fund:
         few:
-        many:
         one: Međunarodni fond za razvoj
         other: Međunarodni fond za razvoj
       international_treaty:
         few:
-        many:
         one: Međunarodni sporazum
         other: Međunarodni sporazumi
       maib_report:
         few:
-        many:
         one: Izveštaj Agencije istragu pomorskih nesreća
         other: Izveštaji Agencije istragu pomorskih nesreća
       map:
         few:
-        many:
         one: Mapa
         other: Mape
       medical_safety_alert:
         few:
-        many:
         one: Upozorenja i zahtevi za opoziv za lekove i medicinska sredstva
         other: Upozorenja i zahtevi za opoziv za lekove i medicinska sredstva
       national:
         few:
-        many:
         one: Najava državne statistike
         other: Najave državne statistike
       national_statistics:
         few:
-        many:
         one: Državna statistika
         other: Državna statistika
       national_statistics_announcement:
         few:
-        many:
         one: Najava državne statistike
         other: Najave državne statistike
       news_article:
         few:
-        many:
         one: Članak vesti
         other: Članci vesti
       news_story:
         few:
-        many:
         one: Vest
         other: Vesti
       notice:
         few:
-        many:
         one: Obaveštenje
         other: Obaveštenja
       official:
         few:
-        many:
         one: Izjava zvanične statistike
         other: Izjave zvanične statistike
       official_statistics:
         few:
-        many:
         one: Zvanična statistika
         other: Zvanična statistika
       official_statistics_announcement:
         few:
-        many:
         one: Izjava zvanične statistike
         other: Izjave zvanične statistike
       open_consultation:
         few:
-        many:
         one: Otvorena konsultacija
         other: Otvorene konsultacije
       oral_statement:
         few:
-        many:
         one: Usmeno obraćanje Parlamentu
         other: Usmena obraćanja Parlamentu
       policy:
         few:
-        many:
         one: Politika
         other: Politike
       policy_paper:
         few:
-        many:
         one: Predlog politike
         other: Predlozi politike
       press_release:
         few:
-        many:
         one: Saopštenje za medije
         other: Saopštenja za štampu
       product-safety-alert-report-recall:
         few:
-        many:
         one:
         other:
       promotional:
         few:
-        many:
         one: Promotivni materijal
         other: Promotivni materijal
       publication:
         few:
-        many:
         one: Publikacija
         other: Publikacije
       raib_report:
         few:
-        many:
         one: Izveštaj Agencije istragu železničkih nesreća
         other: Izveštaji Agencije istragu železničkih nesreća
       regulation:
         few:
-        many:
         one: Propis
         other: Propisi
       research:
         few:
-        many:
         one: Istraživanje i analiza
         other: Istraživanje i analiza
       residential_property_tribunal_decision:
         few:
-        many:
         one: Odluka tribunala o imovini rezidenta
         other: Odluke tribunala o imovini rezidenata
       service_sign_in:
         few:
-        many:
         one: Prijava u uslugu
         other: Prijava u uslugu
       service_standard_report:
         few:
-        many:
         one: Izveštaj o standardu usluge
         other: Izveštaji o standardu usluge
       speaking_notes:
         few:
-        many:
         one: Teze za govor
         other: Teze za govor
       speech:
         few:
-        many:
         one: Govor
         other: Govori
       standard:
         few:
-        many:
         one: Standard
         other: Standardi
       statement_to_parliament:
         few:
-        many:
         one: Obraćanje Parlamentu
         other: Obraćanja Parlamentu
       statistical_data_set:
         few:
-        many:
         one: Set statističkih podataka
         other: Setovi statističkih podataka
       statistics_announcement:
         few:
-        many:
         one: Saopštenje o objavljenim statističkim podacima
         other: Saopštenja o objavljenim statističkim podacima
       statutory_guidance:
         few:
-        many:
         one: Zakonska uputstva
         other: Zakonska uputstva
       take_part:
         few:
-        many:
         one: Učešće
         other: Učešće
       tax_tribunal_decision:
         few:
-        many:
         one: Odluka tribunala o porezima i državnoj upravi
         other: Odluke tribunala o porezima i državnoj upravi
       transcript:
         few:
-        many:
         one: Transkript
         other: Transkripti
       transparency:
         few:
-        many:
         one: Podaci o transparentnosti
         other: Podaci o transparentnosti
       utaac_decision:
         few:
-        many:
         one: Odluka tribunala za administrativne žalbe
         other: Odluke tribunala za administrativne žalbe
       world_location_news_article:
         few:
-        many:
         one: Članak vesti
         other: Članci vesti
       world_news_story:
         few:
-        many:
         one: Vest iz sveta
         other: Vesti iz sveta
       written_statement:
         few:
-        many:
         one: Pismena predstavka Parlamentu
         other: Pismene predstavke Parlamentu
   corporate_information_page:
@@ -603,7 +528,6 @@ sr:
     details: Detalji
     documents:
       few:
-      many:
       one: Dokument
       other: Dokumenti
   service_sign_in:

From eab3d44d3e8fde376027a42a16365297c2db28f1 Mon Sep 17 00:00:00 2001
From: Aga Dufrat <aga.dufrat@digital.cabinet-office.gov.uk>
Date: Mon, 18 Jul 2022 12:46:20 +0100
Subject: [PATCH 03/10] Autoload HttpFeatureFlags in `to_prepare` block

Autoloading during initialization will error in Rails 7.
Applications that autoloaded reloadable constants during initialization outside of to_prepare blocks got those constants unloaded.

https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html#autoloading-during-initialization
---
 config/initializers/feature_flags.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/config/initializers/feature_flags.rb b/config/initializers/feature_flags.rb
index 8c4e30726..5e9b0353b 100644
--- a/config/initializers/feature_flags.rb
+++ b/config/initializers/feature_flags.rb
@@ -4,4 +4,6 @@ def self.recommended_related_links
   end
 end
 
-HttpFeatureFlags.instance.add_http_feature_flag(FeatureFlagNames.recommended_related_links, "true")
+Rails.application.reloader.to_prepare do
+  HttpFeatureFlags.instance.add_http_feature_flag(FeatureFlagNames.recommended_related_links, "true")
+end

From e2acb5273795aafaa553c3c9fef556265cb85260 Mon Sep 17 00:00:00 2001
From: Aga Dufrat <aga.dufrat@digital.cabinet-office.gov.uk>
Date: Mon, 18 Jul 2022 12:51:27 +0100
Subject: [PATCH 04/10] Update to rails 7 with `rails app:update`

---
 Gemfile                                       |   2 +-
 Gemfile.lock                                  | 137 ++++++++++--------
 bin/rails                                     |   6 +-
 bin/rake                                      |   4 +-
 bin/setup                                     |  18 +--
 config/application.rb                         |   1 -
 config/environments/development.rb            |  24 +--
 config/environments/production.rb             |  42 ++----
 config/environments/test.rb                   |  18 ++-
 config/initializers/assets.rb                 |   8 +
 .../initializers/filter_parameter_logging.rb  |   8 +-
 config/initializers/inflections.rb            |   8 +-
 .../new_framework_defaults_7_0.rb             | 117 +++++++++++++++
 config/initializers/permissions_policy.rb     |  11 ++
 14 files changed, 280 insertions(+), 124 deletions(-)
 create mode 100644 config/initializers/new_framework_defaults_7_0.rb
 create mode 100644 config/initializers/permissions_policy.rb

diff --git a/Gemfile b/Gemfile
index 2bc498472..138fc04a4 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,6 +1,6 @@
 source "https://rubygems.org"
 
-gem "rails", "6.1.6.1"
+gem "rails", "7.0.3.1"
 
 gem "dalli"
 gem "gds-api-adapters"
diff --git a/Gemfile.lock b/Gemfile.lock
index 0eb16239e..97c86294c 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,65 +1,71 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (6.1.6.1)
-      actionpack (= 6.1.6.1)
-      activesupport (= 6.1.6.1)
+    actioncable (7.0.3.1)
+      actionpack (= 7.0.3.1)
+      activesupport (= 7.0.3.1)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.1.6.1)
-      actionpack (= 6.1.6.1)
-      activejob (= 6.1.6.1)
-      activerecord (= 6.1.6.1)
-      activestorage (= 6.1.6.1)
-      activesupport (= 6.1.6.1)
+    actionmailbox (7.0.3.1)
+      actionpack (= 7.0.3.1)
+      activejob (= 7.0.3.1)
+      activerecord (= 7.0.3.1)
+      activestorage (= 7.0.3.1)
+      activesupport (= 7.0.3.1)
       mail (>= 2.7.1)
-    actionmailer (6.1.6.1)
-      actionpack (= 6.1.6.1)
-      actionview (= 6.1.6.1)
-      activejob (= 6.1.6.1)
-      activesupport (= 6.1.6.1)
+      net-imap
+      net-pop
+      net-smtp
+    actionmailer (7.0.3.1)
+      actionpack (= 7.0.3.1)
+      actionview (= 7.0.3.1)
+      activejob (= 7.0.3.1)
+      activesupport (= 7.0.3.1)
       mail (~> 2.5, >= 2.5.4)
+      net-imap
+      net-pop
+      net-smtp
       rails-dom-testing (~> 2.0)
-    actionpack (6.1.6.1)
-      actionview (= 6.1.6.1)
-      activesupport (= 6.1.6.1)
-      rack (~> 2.0, >= 2.0.9)
+    actionpack (7.0.3.1)
+      actionview (= 7.0.3.1)
+      activesupport (= 7.0.3.1)
+      rack (~> 2.0, >= 2.2.0)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.1.6.1)
-      actionpack (= 6.1.6.1)
-      activerecord (= 6.1.6.1)
-      activestorage (= 6.1.6.1)
-      activesupport (= 6.1.6.1)
+    actiontext (7.0.3.1)
+      actionpack (= 7.0.3.1)
+      activerecord (= 7.0.3.1)
+      activestorage (= 7.0.3.1)
+      activesupport (= 7.0.3.1)
+      globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (6.1.6.1)
-      activesupport (= 6.1.6.1)
+    actionview (7.0.3.1)
+      activesupport (= 7.0.3.1)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.1.6.1)
-      activesupport (= 6.1.6.1)
+    activejob (7.0.3.1)
+      activesupport (= 7.0.3.1)
       globalid (>= 0.3.6)
-    activemodel (6.1.6.1)
-      activesupport (= 6.1.6.1)
-    activerecord (6.1.6.1)
-      activemodel (= 6.1.6.1)
-      activesupport (= 6.1.6.1)
-    activestorage (6.1.6.1)
-      actionpack (= 6.1.6.1)
-      activejob (= 6.1.6.1)
-      activerecord (= 6.1.6.1)
-      activesupport (= 6.1.6.1)
+    activemodel (7.0.3.1)
+      activesupport (= 7.0.3.1)
+    activerecord (7.0.3.1)
+      activemodel (= 7.0.3.1)
+      activesupport (= 7.0.3.1)
+    activestorage (7.0.3.1)
+      actionpack (= 7.0.3.1)
+      activejob (= 7.0.3.1)
+      activerecord (= 7.0.3.1)
+      activesupport (= 7.0.3.1)
       marcel (~> 1.0)
       mini_mime (>= 1.1.0)
-    activesupport (6.1.6.1)
+    activesupport (7.0.3.1)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
-      zeitwerk (~> 2.3)
     addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
     ansi (1.5.0)
@@ -98,6 +104,7 @@ GEM
     csv (3.2.3)
     dalli (2.7.10)
     debug_inspector (0.0.3)
+    digest (3.1.0)
     docile (1.3.2)
     domain_name (0.5.20190701)
       unf (>= 0.0.5, < 1.0.0)
@@ -191,6 +198,20 @@ GEM
       minitest (>= 5.0)
       ruby-progressbar
     mocha (1.11.2)
+    net-imap (0.2.3)
+      digest
+      net-protocol
+      strscan
+    net-pop (0.1.1)
+      digest
+      net-protocol
+      timeout
+    net-protocol (0.1.3)
+      timeout
+    net-smtp (0.3.1)
+      digest
+      net-protocol
+      timeout
     netrc (0.11.0)
     nio4r (2.5.8)
     nokogiri (1.13.7)
@@ -214,21 +235,20 @@ GEM
     rack-test (2.0.2)
       rack (>= 1.3)
     rack_strip_client_ip (0.0.2)
-    rails (6.1.6.1)
-      actioncable (= 6.1.6.1)
-      actionmailbox (= 6.1.6.1)
-      actionmailer (= 6.1.6.1)
-      actionpack (= 6.1.6.1)
-      actiontext (= 6.1.6.1)
-      actionview (= 6.1.6.1)
-      activejob (= 6.1.6.1)
-      activemodel (= 6.1.6.1)
-      activerecord (= 6.1.6.1)
-      activestorage (= 6.1.6.1)
-      activesupport (= 6.1.6.1)
+    rails (7.0.3.1)
+      actioncable (= 7.0.3.1)
+      actionmailbox (= 7.0.3.1)
+      actionmailer (= 7.0.3.1)
+      actionpack (= 7.0.3.1)
+      actiontext (= 7.0.3.1)
+      actionview (= 7.0.3.1)
+      activejob (= 7.0.3.1)
+      activemodel (= 7.0.3.1)
+      activerecord (= 7.0.3.1)
+      activestorage (= 7.0.3.1)
+      activesupport (= 7.0.3.1)
       bundler (>= 1.15.0)
-      railties (= 6.1.6.1)
-      sprockets-rails (>= 2.0.0)
+      railties (= 7.0.3.1)
     rails-controller-testing (1.0.5)
       actionpack (>= 5.0.1.rc1)
       actionview (>= 5.0.1.rc1)
@@ -246,12 +266,13 @@ GEM
       csv (~> 3.2)
       i18n-tasks
       rails-i18n
-    railties (6.1.6.1)
-      actionpack (= 6.1.6.1)
-      activesupport (= 6.1.6.1)
+    railties (7.0.3.1)
+      actionpack (= 7.0.3.1)
+      activesupport (= 7.0.3.1)
       method_source
       rake (>= 12.2)
       thor (~> 1.0)
+      zeitwerk (~> 2.5)
     rainbow (3.1.1)
     raindrops (0.20.0)
     rake (13.0.6)
@@ -333,11 +354,13 @@ GEM
       activesupport (>= 5.2)
       sprockets (>= 3.0.0)
     statsd-ruby (1.5.0)
+    strscan (3.0.3)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
     thor (1.2.1)
     tilt (2.0.10)
     timecop (0.9.4)
+    timeout (0.3.0)
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
     uglifier (4.2.0)
@@ -385,7 +408,7 @@ DEPENDENCIES
   plek
   pry
   rack_strip_client_ip
-  rails (= 6.1.6.1)
+  rails (= 7.0.3.1)
   rails-controller-testing
   rails-i18n
   rails_translation_manager
diff --git a/bin/rails b/bin/rails
index 073966023..efc037749 100755
--- a/bin/rails
+++ b/bin/rails
@@ -1,4 +1,4 @@
 #!/usr/bin/env ruby
-APP_PATH = File.expand_path('../config/application', __dir__)
-require_relative '../config/boot'
-require 'rails/commands'
+APP_PATH = File.expand_path("../config/application", __dir__)
+require_relative "../config/boot"
+require "rails/commands"
diff --git a/bin/rake b/bin/rake
index 17240489f..4fbf10b96 100755
--- a/bin/rake
+++ b/bin/rake
@@ -1,4 +1,4 @@
 #!/usr/bin/env ruby
-require_relative '../config/boot'
-require 'rake'
+require_relative "../config/boot"
+require "rake"
 Rake.application.run
diff --git a/bin/setup b/bin/setup
index 2e29ac1c3..57b65c85d 100755
--- a/bin/setup
+++ b/bin/setup
@@ -1,25 +1,25 @@
 #!/usr/bin/env ruby
-require 'fileutils'
+require "fileutils"
 
 # path to your application root.
-APP_ROOT = File.expand_path('..', __dir__)
+APP_ROOT = File.expand_path("..", __dir__)
 
 def system!(*args)
   system(*args) || abort("\n== Command #{args} failed ==")
 end
 
 FileUtils.chdir APP_ROOT do
-  # This script is a way to setup or update your development environment automatically.
-  # This script is idempotent, so that you can run it at anytime and get an expectable outcome.
+  # This script is a way to set up or update your development environment automatically.
+  # This script is idempotent, so that you can run it at any time and get an expectable outcome.
   # Add necessary setup steps to this file.
 
-  puts '== Installing dependencies =='
-  system! 'gem install bundler --conservative'
-  system('bundle check') || system!('bundle install')
+  puts "== Installing dependencies =="
+  system! "gem install bundler --conservative"
+  system("bundle check") || system!("bundle install")
 
   puts "\n== Removing old logs and tempfiles =="
-  system! 'bin/rails log:clear tmp:clear'
+  system! "bin/rails log:clear tmp:clear"
 
   puts "\n== Restarting application server =="
-  system! 'bin/rails restart'
+  system! "bin/rails restart"
 end
diff --git a/config/application.rb b/config/application.rb
index 136fc62b5..93df3e2ea 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -12,7 +12,6 @@
 # require "action_text/engine"
 require "action_view/railtie"
 # require "action_cable/engine"
-require "sprockets/railtie"
 require "rails/test_unit/railtie"
 
 # Require the gems listed in Gemfile, including any gems
diff --git a/config/environments/development.rb b/config/environments/development.rb
index c914d23d2..fbf8292a4 100644
--- a/config/environments/development.rb
+++ b/config/environments/development.rb
@@ -3,8 +3,8 @@
 Rails.application.configure do
   # Settings specified here will take precedence over those in config/application.rb.
 
-  # In the development environment your application's code is reloaded on
-  # every request. This slows down response time but is perfect for development
+  # In the development environment your application's code is reloaded any time
+  # it changes. This slows down response time but is perfect for development
   # since you don't have to restart the web server when you make code changes.
   config.cache_classes = false
 
@@ -14,6 +14,9 @@
   # Show full error reports.
   config.consider_all_requests_local = true
 
+  # Enable server timing
+  config.server_timing = true
+
   # Enable/disable caching. By default caching is disabled.
   # Run rails dev:cache to toggle caching.
   if Rails.root.join("tmp/caching-dev.txt").exist?
@@ -33,10 +36,11 @@
   # Print deprecation notices to the Rails logger.
   config.active_support.deprecation = :log
 
-  # Debug mode disables concatenation and preprocessing of assets.
-  # This option may cause significant delays in view rendering with a large
-  # number of complex assets.
-  config.assets.debug = true
+  # Raise exceptions for disallowed deprecations.
+  config.active_support.disallowed_deprecation = :raise
+
+  # Tell Active Support which deprecation messages to disallow.
+  config.active_support.disallowed_deprecation_warnings = []
 
   # Suppress logger output for asset requests.
   config.assets.quiet = true
@@ -44,9 +48,11 @@
   # Raises error for missing translations.
   config.i18n.raise_on_missing_translations = true
 
-  # Use an evented file watcher to asynchronously detect changes in source code,
-  # routes, locales, etc. This feature depends on the listen gem.
-  # config.file_watcher = ActiveSupport::EventedFileUpdateChecker
+  # Annotate rendered view with file names.
+  # config.action_view.annotate_rendered_view_with_filenames = true
 
   config.hosts.clear
+
+  # Uncomment if you wish to allow Action Cable access from any origin.
+  # config.action_cable.disable_request_forgery_protection = true
 end
diff --git a/config/environments/production.rb b/config/environments/production.rb
index 50eea2c7a..a6d556b67 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -38,24 +38,23 @@
   config.sass.line_comments = false
 
   # Enable serving of images, stylesheets, and JavaScripts from an asset server.
-  # config.action_controller.asset_host = 'http://assets.example.com'
+  # config.asset_host = "http://assets.example.com"
 
   # Specifies the header that your server uses for sending files.
-  # config.action_dispatch.x_sendfile_header = 'X-Sendfile' # for Apache
-  # config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for NGINX
+  # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for Apache
+  # config.action_dispatch.x_sendfile_header = "X-Accel-Redirect" # for NGINX
 
   # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
   # config.force_ssl = true
 
-  # Use the lowest log level to ensure availability of diagnostic information
-  # when problems arise.
+  # Include generic and useful information about system operation, but avoid logging too much
+  # information to avoid inadvertent exposure of personally identifiable information (PII).
   config.log_level = :info
 
   # Prepend all log lines with the following tags.
-  # config.log_tags = [ :request_id ]
+  config.log_tags = [:request_id]
 
   # Use a different cache store in production.
-  # config.cache_store = :mem_cache_store
   config.cache_store = :mem_cache_store, nil, { namespace: :government_frontend, compress: true }
 
   # Use a real queuing backend for Active Job (and separate queues per environment).
@@ -66,40 +65,19 @@
   # the I18n.default_locale when a translation cannot be found).
   config.i18n.fallbacks = true
 
-  # Send deprecation notices to registered listeners.
-  config.active_support.deprecation = :notify
+  # Don't log any deprecations.
+  config.active_support.report_deprecations = false
 
   # Use default logging formatter so that PID and timestamp are not suppressed.
   config.log_formatter = ::Logger::Formatter.new
 
   # Use a different logger for distributed setups.
-  # require 'syslog/logger'
-  # config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new 'app-name')
+  # require "syslog/logger"
+  # config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new "app-name")
 
   if ENV["RAILS_LOG_TO_STDOUT"].present?
     logger           = ActiveSupport::Logger.new($stdout)
     logger.formatter = config.log_formatter
     config.logger    = ActiveSupport::TaggedLogging.new(logger)
   end
-
-  # Inserts middleware to perform automatic connection switching.
-  # The `database_selector` hash is used to pass options to the DatabaseSelector
-  # middleware. The `delay` is used to determine how long to wait after a write
-  # to send a subsequent read to the primary.
-  #
-  # The `database_resolver` class is used by the middleware to determine which
-  # database is appropriate to use based on the time delay.
-  #
-  # The `database_resolver_context` class is used by the middleware to set
-  # timestamps for the last write to the primary. The resolver uses the context
-  # class timestamps to determine how long to wait before reading from the
-  # replica.
-  #
-  # By default Rails will store a last write timestamp in the session. The
-  # DatabaseSelector middleware is designed as such you can define your own
-  # strategy for connection switching and pass that into the middleware through
-  # these configuration options.
-  # config.active_record.database_selector = { delay: 2.seconds }
-  # config.active_record.database_resolver = ActiveRecord::Middleware::DatabaseSelector::Resolver
-  # config.active_record.database_resolver_context = ActiveRecord::Middleware::DatabaseSelector::Resolver::Session
 end
diff --git a/config/environments/test.rb b/config/environments/test.rb
index 13eb04da9..69f182cd2 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -8,12 +8,13 @@
 Rails.application.configure do
   # Settings specified here will take precedence over those in config/application.rb.
 
+  # Turn false under Spring and add config.action_view.cache_template_loading = true.
   config.cache_classes = true
 
-  # Do not eager load code on boot. This avoids loading your whole application
-  # just for the purpose of running a single test. If you are using a tool that
-  # preloads Rails for running tests, you may have to set it to true.
-  config.eager_load = false
+  # Eager loading loads your whole application. When running a single test locally,
+  # this probably isn't necessary. It's a good idea to do in a continuous integration
+  # system, or in some way before deploying your code.
+  config.eager_load = ENV["CI"].present?
 
   # Configure public file server for tests with Cache-Control for performance.
   config.public_file_server.enabled = true
@@ -35,6 +36,12 @@
   # Print deprecation notices to the stderr.
   config.active_support.deprecation = :stderr
 
+  # Raise exceptions for disallowed deprecations.
+  config.active_support.disallowed_deprecation = :raise
+
+  # Tell Active Support which deprecation messages to disallow.
+  config.active_support.disallowed_deprecation_warnings = []
+
   # Raises error for missing translations.
   config.i18n.raise_on_missing_translations = true
 
@@ -44,4 +51,7 @@
   # javascript before tests run. Meaning failing JS will not be detected
   # in integration tests.
   config.assets.digest = false
+
+  # Annotate rendered view with file names.
+  # config.action_view.annotate_rendered_view_with_filenames = true
 end
diff --git a/config/initializers/assets.rb b/config/initializers/assets.rb
index 25edcd213..454d31412 100644
--- a/config/initializers/assets.rb
+++ b/config/initializers/assets.rb
@@ -2,3 +2,11 @@
 
 # Version of your assets, change this if you want to expire all your assets.
 Rails.application.config.assets.version = "1.0"
+
+# Add additional assets to the asset load path.
+# Rails.application.config.assets.paths << Emoji.images_path
+
+# Precompile additional assets.
+# application.js, application.css, and all non-JS/CSS in the app/assets
+# folder are already added.
+# Rails.application.config.assets.precompile += %w[webchat/library.js webchat.js]
diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb
index 4a994e1e7..166997c5a 100644
--- a/config/initializers/filter_parameter_logging.rb
+++ b/config/initializers/filter_parameter_logging.rb
@@ -1,4 +1,8 @@
 # Be sure to restart your server when you modify this file.
 
-# Configure sensitive parameters which will be filtered from the log file.
-Rails.application.config.filter_parameters += [:password]
+# Configure parameters to be filtered from the log file. Use this to limit dissemination of
+# sensitive information. See the ActiveSupport::ParameterFilter documentation for supported
+# notations and behaviors.
+Rails.application.config.filter_parameters += %i[
+  passw secret token _key crypt salt certificate otp ssn
+]
diff --git a/config/initializers/inflections.rb b/config/initializers/inflections.rb
index ac033bf9d..3860f659e 100644
--- a/config/initializers/inflections.rb
+++ b/config/initializers/inflections.rb
@@ -4,13 +4,13 @@
 # are locale specific, and you may define rules for as many different
 # locales as you wish. All of these examples are active by default:
 # ActiveSupport::Inflector.inflections(:en) do |inflect|
-#   inflect.plural /^(ox)$/i, '\1en'
-#   inflect.singular /^(ox)en/i, '\1'
-#   inflect.irregular 'person', 'people'
+#   inflect.plural /^(ox)$/i, "\\1en"
+#   inflect.singular /^(ox)en/i, "\\1"
+#   inflect.irregular "person", "people"
 #   inflect.uncountable %w( fish sheep )
 # end
 
 # These inflection rules are supported but not enabled by default:
 # ActiveSupport::Inflector.inflections(:en) do |inflect|
-#   inflect.acronym 'RESTful'
+#   inflect.acronym "RESTful"
 # end
diff --git a/config/initializers/new_framework_defaults_7_0.rb b/config/initializers/new_framework_defaults_7_0.rb
new file mode 100644
index 000000000..a579326e2
--- /dev/null
+++ b/config/initializers/new_framework_defaults_7_0.rb
@@ -0,0 +1,117 @@
+# Be sure to restart your server when you modify this file.
+#
+# This file eases your Rails 7.0 framework defaults upgrade.
+#
+# Uncomment each configuration one by one to switch to the new default.
+# Once your application is ready to run with all new defaults, you can remove
+# this file and set the `config.load_defaults` to `7.0`.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+# https://guides.rubyonrails.org/upgrading_ruby_on_rails.html
+
+# `button_to` view helper will render `<button>` element, regardless of whether
+# or not the content is passed as the first argument or as a block.
+# Rails.application.config.action_view.button_to_generates_button_tag = true
+
+# `stylesheet_link_tag` view helper will not render the media attribute by default.
+# Rails.application.config.action_view.apply_stylesheet_media_default = false
+
+# Change the digest class for the key generators to `OpenSSL::Digest::SHA256`.
+# Changing this default means invalidate all encrypted messages generated by
+# your application and, all the encrypted cookies. Only change this after you
+# rotated all the messages using the key rotator.
+#
+# See upgrading guide for more information on how to build a rotator.
+# https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html
+# Rails.application.config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256
+
+# Change the digest class for ActiveSupport::Digest.
+# Changing this default means that for example Etags change and
+# various cache keys leading to cache invalidation.
+# Rails.application.config.active_support.hash_digest_class = OpenSSL::Digest::SHA256
+
+# Don't override ActiveSupport::TimeWithZone.name and use the default Ruby
+# implementation.
+# Rails.application.config.active_support.remove_deprecated_time_with_zone_name = true
+
+# Change the format of the cache entry.
+# Changing this default means that all new cache entries added to the cache
+# will have a different format that is not supported by Rails 6.1 applications.
+# Only change this value after your application is fully deployed to Rails 7.0
+# and you have no plans to rollback.
+# Rails.application.config.active_support.cache_format_version = 7.0
+
+# Calls `Rails.application.executor.wrap` around test cases.
+# This makes test cases behave closer to an actual request or job.
+# Several features that are normally disabled in test, such as Active Record query cache
+# and asynchronous queries will then be enabled.
+# Rails.application.config.active_support.executor_around_test_case = true
+
+# Define the isolation level of most of Rails internal state.
+# If you use a fiber based server or job processor, you should set it to `:fiber`.
+# Otherwise the default of `:thread` if preferable.
+# Rails.application.config.active_support.isolation_level = :thread
+
+# Set both the `:open_timeout` and `:read_timeout` values for `:smtp` delivery method.
+# Rails.application.config.action_mailer.smtp_timeout = 5
+
+# The ActiveStorage video previewer will now use scene change detection to generate
+# better preview images (rather than the previous default of using the first frame
+# of the video).
+# Rails.application.config.active_storage.video_preview_arguments =
+#   "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1' -frames:v 1 -f image2"
+
+# Automatically infer `inverse_of` for associations with a scope.
+# Rails.application.config.active_record.automatic_scope_inversing = true
+
+# Raise when running tests if fixtures contained foreign key violations
+# Rails.application.config.active_record.verify_foreign_keys_for_fixtures = true
+
+# Disable partial inserts.
+# This default means that all columns will be referenced in INSERT queries
+# regardless of whether they have a default or not.
+# Rails.application.config.active_record.partial_inserts = false
+#
+# Protect from open redirect attacks in `redirect_back_or_to` and `redirect_to`.
+# Rails.application.config.action_controller.raise_on_open_redirects = true
+
+# Change the variant processor for Active Storage.
+# Changing this default means updating all places in your code that
+# generate variants to use image processing macros and ruby-vips
+# operations. See the upgrading guide for detail on the changes required.
+# The `:mini_magick` option is not deprecated; it's fine to keep using it.
+# Rails.application.config.active_storage.variant_processor = :vips
+
+# If you're upgrading and haven't set `cookies_serializer` previously, your cookie serializer
+# was `:marshal`. Convert all cookies to JSON, using the `:hybrid` formatter.
+#
+# If you're confident all your cookies are JSON formatted, you can switch to the `:json` formatter.
+#
+# Continue to use `:marshal` for backward-compatibility with old cookies.
+#
+# If you have configured the serializer elsewhere, you can remove this.
+#
+# See https://guides.rubyonrails.org/action_controller_overview.html#cookies for more information.
+# Rails.application.config.action_dispatch.cookies_serializer = :hybrid
+
+# Enable parameter wrapping for JSON.
+# Previously this was set in an initializer. It's fine to keep using that initializer if you've customized it.
+# To disable parameter wrapping entirely, set this config to `false`.
+# Rails.application.config.action_controller.wrap_parameters_by_default = true
+
+# Specifies whether generated namespaced UUIDs follow the RFC 4122 standard for namespace IDs provided as a
+# `String` to `Digest::UUID.uuid_v3` or `Digest::UUID.uuid_v5` method calls.
+#
+# See https://guides.rubyonrails.org/configuring.html#config-active-support-use-rfc4122-namespaced-uuids for
+# more information.
+# Rails.application.config.active_support.use_rfc4122_namespaced_uuids = true
+
+# Change the default headers to disable browsers' flawed legacy XSS protection.
+# Rails.application.config.action_dispatch.default_headers = {
+#   "X-Frame-Options" => "SAMEORIGIN",
+#   "X-XSS-Protection" => "0",
+#   "X-Content-Type-Options" => "nosniff",
+#   "X-Download-Options" => "noopen",
+#   "X-Permitted-Cross-Domain-Policies" => "none",
+#   "Referrer-Policy" => "strict-origin-when-cross-origin"
+# }
diff --git a/config/initializers/permissions_policy.rb b/config/initializers/permissions_policy.rb
new file mode 100644
index 000000000..00f64d71b
--- /dev/null
+++ b/config/initializers/permissions_policy.rb
@@ -0,0 +1,11 @@
+# Define an application-wide HTTP permissions policy. For further
+# information see https://developers.google.com/web/updates/2018/06/feature-policy
+#
+# Rails.application.config.permissions_policy do |f|
+#   f.camera      :none
+#   f.gyroscope   :none
+#   f.microphone  :none
+#   f.usb         :none
+#   f.fullscreen  :self
+#   f.payment     :self, "https://secure.example.com"
+# end

From 4385c317517ddfa5df10d5464f4e17709b4381f7 Mon Sep 17 00:00:00 2001
From: Aga Dufrat <aga.dufrat@digital.cabinet-office.gov.uk>
Date: Mon, 18 Jul 2022 12:52:49 +0100
Subject: [PATCH 05/10] Add Sprockets dependency

Sprockets is now an optional dependency
https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html#sprockets-is-now-an-optional-dependency
---
 Gemfile      | 1 +
 Gemfile.lock | 1 +
 2 files changed, 2 insertions(+)

diff --git a/Gemfile b/Gemfile
index 138fc04a4..02dfbfdd4 100644
--- a/Gemfile
+++ b/Gemfile
@@ -15,6 +15,7 @@ gem "rails-controller-testing"
 gem "rails-i18n"
 gem "sassc-rails"
 gem "slimmer"
+gem "sprockets-rails"
 gem "uglifier"
 
 group :development, :test do
diff --git a/Gemfile.lock b/Gemfile.lock
index 97c86294c..27c7597b1 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -416,6 +416,7 @@ DEPENDENCIES
   sassc-rails
   simplecov
   slimmer
+  sprockets-rails
   timecop
   uglifier
   webmock

From 4e52aeeb4c400fe0e2fb8824965893b310668d13 Mon Sep 17 00:00:00 2001
From: Aga Dufrat <aga.dufrat@digital.cabinet-office.gov.uk>
Date: Mon, 18 Jul 2022 16:06:37 +0100
Subject: [PATCH 06/10] Fix deprecation: Passing the keyword arg as the last
 hash param

---
 test/integration/consultation_test.rb         |  8 +++++---
 test/integration/detailed_guide_test.rb       | 11 +++--------
 test/integration/document_collection_test.rb  |  5 +++--
 test/integration/fatality_notice_test.rb      | 14 ++++++--------
 test/integration/news_article_test.rb         |  5 ++---
 test/integration/publication_test.rb          |  4 ++--
 test/integration/specialist_document_test.rb  |  4 ++--
 test/integration/speech_test.rb               |  6 +++---
 test/integration/statistical_data_set_test.rb |  5 +++--
 9 files changed, 29 insertions(+), 33 deletions(-)

diff --git a/test/integration/consultation_test.rb b/test/integration/consultation_test.rb
index badaced18..cb2cbea9f 100644
--- a/test/integration/consultation_test.rb
+++ b/test/integration/consultation_test.rb
@@ -7,11 +7,13 @@ class ConsultationTest < ActionDispatch::IntegrationTest
     assert_has_component_title(@content_item["title"])
     assert page.has_text?(@content_item["description"])
 
-    assert_has_metadata(
+    assert_has_metadata({
       published: "4 November 2016",
       last_updated: "7 November 2016",
-      from: { "Department for Education": "/government/organisations/department-for-education" },
-    )
+      from: {
+        "Department for Education": "/government/organisations/department-for-education",
+      },
+    })
 
     assert_footer_has_published_dates("Published 4 November 2016", "Last updated 7 November 2016")
 
diff --git a/test/integration/detailed_guide_test.rb b/test/integration/detailed_guide_test.rb
index 7b7adec9e..d1050319b 100644
--- a/test/integration/detailed_guide_test.rb
+++ b/test/integration/detailed_guide_test.rb
@@ -10,14 +10,9 @@ class DetailedGuideTest < ActionDispatch::IntegrationTest
 
     assert_has_component_title(@content_item["title"])
     assert page.has_text?(@content_item["description"])
-
-    assert_has_metadata(
-      published: "12 June 2014",
-      last_updated: "18 February 2016",
-      from: {
-        "HM Revenue & Customs": "/government/organisations/hm-revenue-customs",
-      },
-    )
+    assert_has_metadata({ published: "12 June 2014",
+                          last_updated: "18 February 2016",
+                          from: { "HM Revenue & Customs": "/government/organisations/hm-revenue-customs" } })
   end
 
   test "renders back to contents elements" do
diff --git a/test/integration/document_collection_test.rb b/test/integration/document_collection_test.rb
index 11bdf403c..c781e7944 100644
--- a/test/integration/document_collection_test.rb
+++ b/test/integration/document_collection_test.rb
@@ -19,12 +19,13 @@ class DocumentCollectionTest < ActionDispatch::IntegrationTest
 
   test "renders metadata and document footer" do
     setup_and_visit_content_item("document_collection")
-    assert_has_metadata(
+
+    assert_has_metadata({
       published: "29 February 2016",
       from: {
         "Driver and Vehicle Standards Agency": "/government/organisations/driver-and-vehicle-standards-agency",
       },
-    )
+    })
     assert_footer_has_published_dates("Published 29 February 2016")
   end
 
diff --git a/test/integration/fatality_notice_test.rb b/test/integration/fatality_notice_test.rb
index ba4219732..0a8e113e7 100644
--- a/test/integration/fatality_notice_test.rb
+++ b/test/integration/fatality_notice_test.rb
@@ -18,13 +18,13 @@ class FatalityNoticeTest < ActionDispatch::IntegrationTest
 
     assert_not page.has_css?(".gem-c-notice")
 
-    assert_has_metadata(
+    assert_has_metadata({
       published: "27 February 1881",
       last_updated: "14 September 2016",
       from: {
         "Ministry of Defence": "/government/organisations/ministry-of-defence",
       },
-    )
+    })
 
     assert_has_important_metadata(
       "Field of operation": { "Zululand": "/government/fields-of-operation/zululand" },
@@ -57,12 +57,10 @@ class FatalityNoticeTest < ActionDispatch::IntegrationTest
 
   test "fatality notice with minister" do
     setup_and_visit_content_item("fatality_notice_with_minister")
-    assert_has_metadata(
-      from: {
-        "Ministry of Defence": "/government/organisations/ministry-of-defence",
-        "The Rt Hon Sir Eric Pickles MP": "/government/people/eric-pickles",
-      },
-    )
+    assert_has_metadata({ from: {
+      "Ministry of Defence": "/government/organisations/ministry-of-defence",
+      "The Rt Hon Sir Eric Pickles MP": "/government/people/eric-pickles",
+    } })
   end
 
   test "fatality notice with withdrawn notice" do
diff --git a/test/integration/news_article_test.rb b/test/integration/news_article_test.rb
index 7b192f3ac..d04e5583b 100644
--- a/test/integration/news_article_test.rb
+++ b/test/integration/news_article_test.rb
@@ -11,14 +11,13 @@ class NewsArticleTest < ActionDispatch::IntegrationTest
   test "renders first published and from in metadata and document footer" do
     setup_and_visit_content_item("news_article")
 
-    assert_has_metadata(
+    assert_has_metadata({
       published: "25 December 2016",
       from: {
         "Prime Minister's Office, 10 Downing Street":
         "/government/organisations/prime-ministers-office-10-downing-street",
       },
-    )
-
+    })
     assert_footer_has_published_dates("Published 25 December 2016")
   end
 
diff --git a/test/integration/publication_test.rb b/test/integration/publication_test.rb
index 07b4b4d06..7ccb4d44d 100644
--- a/test/integration/publication_test.rb
+++ b/test/integration/publication_test.rb
@@ -19,13 +19,13 @@ class PublicationTest < ActionDispatch::IntegrationTest
   test "renders metadata and document footer" do
     setup_and_visit_content_item("publication")
 
-    assert_has_metadata(
+    assert_has_metadata({
       published: "3 May 2016",
       from: {
         "Environment Agency": "/government/organisations/environment-agency",
         "The Rt Hon Sir Eric Pickles MP": "/government/people/eric-pickles",
       },
-    )
+    })
 
     assert_has_structured_data(page, "Article")
 
diff --git a/test/integration/specialist_document_test.rb b/test/integration/specialist_document_test.rb
index 2c7d4f383..cab3b6938 100644
--- a/test/integration/specialist_document_test.rb
+++ b/test/integration/specialist_document_test.rb
@@ -47,12 +47,12 @@ class SpecialistDocumentTest < ActionDispatch::IntegrationTest
   test "renders from in publisher metadata" do
     setup_and_visit_content_item("aaib-reports")
 
-    assert_has_metadata(
+    assert_has_metadata({
       from: {
         "Air Accidents Investigation Branch":
         "/government/organisations/air-accidents-investigation-branch",
       },
-    )
+    })
   end
 
   test "renders published and updated in metadata" do
diff --git a/test/integration/speech_test.rb b/test/integration/speech_test.rb
index 4c4f3517e..1fd446959 100644
--- a/test/integration/speech_test.rb
+++ b/test/integration/speech_test.rb
@@ -20,14 +20,14 @@ class SpeechTest < ActionDispatch::IntegrationTest
   test "renders metadata and document footer, including speaker" do
     setup_and_visit_content_item("speech")
 
-    assert_has_metadata(
-      published: "8 March 2016",
+    assert_has_metadata({
       from: {
         "Department of Energy & Climate Change and The Rt Hon Andrea Leadsom MP": nil,
         "Department of Energy": "/government/organisations/department-of-energy-climate-change",
         "The Rt Hon Andrea Leadsom MP": "/government/people/andrea-leadsom",
       },
-    )
+      published: "8 March 2016",
+    })
 
     assert_has_important_metadata(
       "Delivered on":
diff --git a/test/integration/statistical_data_set_test.rb b/test/integration/statistical_data_set_test.rb
index 7bf27ceb8..34c870914 100644
--- a/test/integration/statistical_data_set_test.rb
+++ b/test/integration/statistical_data_set_test.rb
@@ -11,10 +11,11 @@ class StatisticalDataSetTest < ActionDispatch::IntegrationTest
 
   test "renders metadata and document footer" do
     setup_and_visit_content_item("statistical_data_set")
-    assert_has_metadata(
+
+    assert_has_metadata({
       published: "13 December 2012",
       from: { "Department for Transport": "/government/organisations/department-for-transport" },
-    )
+    })
     assert_footer_has_published_dates("Published 13 December 2012")
   end
 

From d4a18d89250a1550a81738baae0b6090ec2c36f2 Mon Sep 17 00:00:00 2001
From: Aga Dufrat <aga.dufrat@digital.cabinet-office.gov.uk>
Date: Mon, 18 Jul 2022 16:39:19 +0100
Subject: [PATCH 07/10] Explicitly allow redirects to other hosts within gov.uk
 domain

In rails 7 redirects to other hosts are no longer permitted by default and ActionController::Redirecting::UnsafeRedirectError was raised.

However in all those cases we are redirect to other GOV.UK domains such as
assets.gov.uk or service.gov.uk.
---
 app/controllers/asset_manager_redirect_controller.rb | 5 ++++-
 app/controllers/content_items_controller.rb          | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/app/controllers/asset_manager_redirect_controller.rb b/app/controllers/asset_manager_redirect_controller.rb
index 88f0aa445..2e1e38e9d 100644
--- a/app/controllers/asset_manager_redirect_controller.rb
+++ b/app/controllers/asset_manager_redirect_controller.rb
@@ -2,6 +2,9 @@ class AssetManagerRedirectController < ApplicationController
   def show
     asset_url = Plek.new.external_url_for("assets")
     expires_in 1.day, public: true
-    redirect_to host: URI.parse(asset_url).host, status: :moved_permanently
+    redirect_to(
+      { host: URI.parse(asset_url).host, status: :moved_permanently },
+      allow_other_host: true,
+    )
   end
 end
diff --git a/app/controllers/content_items_controller.rb b/app/controllers/content_items_controller.rb
index 83ffde703..42c6963e5 100644
--- a/app/controllers/content_items_controller.rb
+++ b/app/controllers/content_items_controller.rb
@@ -42,7 +42,7 @@ def service_sign_in_options
         return
       end
 
-      redirect_to service_url(selected[:url])
+      redirect_to service_url(selected[:url]), allow_other_host: true
     end
   end
 
@@ -205,7 +205,7 @@ def error_redirect(exception)
     destination, status_code = GdsApi::ContentStore.redirect_for_path(
       exception.content_item, request.path, request.query_string
     )
-    redirect_to destination, status: status_code
+    redirect_to destination, status: status_code, allow_other_host: true
   end
 
   def set_account_vary_header

From 6e4ccced6dd1acebe442ab61011d42580ce0cfb3 Mon Sep 17 00:00:00 2001
From: Aga Dufrat <aga.dufrat@digital.cabinet-office.gov.uk>
Date: Tue, 19 Jul 2022 10:36:29 +0100
Subject: [PATCH 08/10] Update dependencies

---
 Gemfile.lock | 68 ++++++++++++++++++++++++++++------------------------
 1 file changed, 37 insertions(+), 31 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 27c7597b1..426e01c09 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -70,7 +70,7 @@ GEM
       public_suffix (>= 2.0.2, < 5.0)
     ansi (1.5.0)
     ast (2.4.2)
-    better_errors (2.8.0)
+    better_errors (2.9.1)
       coderay (>= 1.0.0)
       erubi (>= 1.0.0)
       rack (>= 0.9.0)
@@ -82,36 +82,37 @@ GEM
       html_tokenizer (~> 0.0.6)
       parser (>= 2.4)
       smart_properties
-    binding_of_caller (0.8.0)
+    binding_of_caller (1.0.0)
       debug_inspector (>= 0.0.1)
-    brakeman (5.2.1)
+    brakeman (5.2.3)
     builder (3.2.4)
-    capybara (3.33.0)
+    capybara (3.37.1)
       addressable
+      matrix
       mini_mime (>= 0.1.3)
       nokogiri (~> 1.8)
       rack (>= 1.6.0)
       rack-test (>= 0.6.3)
-      regexp_parser (~> 1.5)
+      regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
-    childprocess (3.0.0)
-    climate_control (1.1.1)
+    childprocess (4.1.0)
+    climate_control (1.2.0)
     coderay (1.1.3)
     concurrent-ruby (1.1.10)
-    crack (0.4.3)
-      safe_yaml (~> 1.0.0)
+    crack (0.4.5)
+      rexml
     crass (1.0.6)
     csv (3.2.3)
-    dalli (2.7.10)
-    debug_inspector (0.0.3)
+    dalli (3.2.2)
+    debug_inspector (1.1.0)
     digest (3.1.0)
-    docile (1.3.2)
+    docile (1.4.0)
     domain_name (0.5.20190701)
       unf (>= 0.0.5, < 1.0.0)
     erubi (1.10.0)
-    execjs (2.7.0)
-    faker (2.13.0)
-      i18n (>= 1.6, < 2)
+    execjs (2.8.1)
+    faker (2.21.0)
+      i18n (>= 1.8.11, < 2)
     ffi (1.15.5)
     gds-api-adapters (81.0.0)
       addressable
@@ -143,11 +144,11 @@ GEM
       sprockets (>= 3)
     govuk_schemas (4.3.0)
       json-schema (~> 2.8.0)
-    govuk_test (3.0.0)
+    govuk_test (3.0.1)
       brakeman (>= 5.0.2)
-      capybara
+      capybara (>= 3.36)
       puma
-      selenium-webdriver (>= 3.142)
+      selenium-webdriver (>= 4.0)
     hashdiff (1.0.1)
     highline (2.0.3)
     html_tokenizer (0.0.7)
@@ -169,7 +170,7 @@ GEM
       rails-i18n
       rainbow (>= 2.2.2, < 4.0)
       terminal-table (>= 1.5.1)
-    json (2.6.1)
+    json (2.6.2)
     json-schema (2.8.1)
       addressable (>= 2.4)
     kgio (2.11.4)
@@ -185,6 +186,7 @@ GEM
     mail (2.7.1)
       mini_mime (>= 0.1.1)
     marcel (1.0.2)
+    matrix (0.4.2)
     method_source (1.0.0)
     mime-types (3.4.1)
       mime-types-data (~> 3.2015)
@@ -192,12 +194,12 @@ GEM
     mini_mime (1.1.2)
     mini_portile2 (2.8.0)
     minitest (5.16.2)
-    minitest-reporters (1.4.2)
+    minitest-reporters (1.5.0)
       ansi
       builder
       minitest (>= 5.0)
       ruby-progressbar
-    mocha (1.11.2)
+    mocha (1.14.0)
     net-imap (0.2.3)
       digest
       net-protocol
@@ -224,7 +226,7 @@ GEM
     plek (4.0.0)
     prometheus_exporter (2.0.3)
       webrick
-    pry (0.13.1)
+    pry (0.14.1)
       coderay (~> 1.1)
       method_source (~> 1.0)
     public_suffix (4.0.7)
@@ -276,7 +278,7 @@ GEM
     rainbow (3.1.1)
     raindrops (0.20.0)
     rake (13.0.6)
-    regexp_parser (1.8.2)
+    regexp_parser (2.5.0)
     request_store (1.5.1)
       rack (>= 1.4)
     rest-client (2.1.0)
@@ -313,7 +315,6 @@ GEM
       rubocop (~> 1.19)
     ruby-progressbar (1.11.0)
     rubyzip (2.3.2)
-    safe_yaml (1.0.5)
     sassc (2.4.0)
       ffi (~> 1.9)
     sassc-rails (2.1.2)
@@ -322,9 +323,11 @@ GEM
       sprockets (> 3.0)
       sprockets-rails
       tilt
-    selenium-webdriver (3.142.7)
-      childprocess (>= 0.5, < 4.0)
-      rubyzip (>= 1.2.2)
+    selenium-webdriver (4.3.0)
+      childprocess (>= 0.5, < 5.0)
+      rexml (~> 3.2, >= 3.2.5)
+      rubyzip (>= 1.2.2, < 3.0)
+      websocket (~> 1.0)
     sentry-rails (5.3.1)
       railties (>= 5.0)
       sentry-ruby-core (~> 5.3.1)
@@ -333,10 +336,12 @@ GEM
       sentry-ruby-core (= 5.3.1)
     sentry-ruby-core (5.3.1)
       concurrent-ruby
-    simplecov (0.19.0)
+    simplecov (0.21.2)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
+      simplecov_json_formatter (~> 0.1)
     simplecov-html (0.12.3)
+    simplecov_json_formatter (0.1.4)
     slimmer (17.0.0)
       activesupport
       json
@@ -359,7 +364,7 @@ GEM
       unicode-display_width (>= 1.1.1, < 3)
     thor (1.2.1)
     tilt (2.0.10)
-    timecop (0.9.4)
+    timecop (0.9.5)
     timeout (0.3.0)
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
@@ -372,11 +377,12 @@ GEM
     unicorn (6.1.0)
       kgio (~> 2.6)
       raindrops (~> 0.7)
-    webmock (3.8.3)
-      addressable (>= 2.3.6)
+    webmock (3.14.0)
+      addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     webrick (1.7.0)
+    websocket (1.2.9)
     websocket-driver (0.7.5)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)

From 758e7fb4553e5a55626e5df06290d0291c1d0eb2 Mon Sep 17 00:00:00 2001
From: Aga Dufrat <aga.dufrat@digital.cabinet-office.gov.uk>
Date: Mon, 18 Jul 2022 16:54:33 +0100
Subject: [PATCH 09/10] Enable new Rails 7 configuration

---
 config/application.rb                         |   2 +-
 .../new_framework_defaults_6_0.rb             |  45 -------
 .../new_framework_defaults_7_0.rb             | 117 ------------------
 3 files changed, 1 insertion(+), 163 deletions(-)
 delete mode 100644 config/initializers/new_framework_defaults_6_0.rb
 delete mode 100644 config/initializers/new_framework_defaults_7_0.rb

diff --git a/config/application.rb b/config/application.rb
index 93df3e2ea..45c2dcaf4 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -21,7 +21,7 @@
 module GovernmentFrontend
   class Application < Rails::Application
     # Initialize configuration defaults for originally generated Rails version.
-    config.load_defaults 6.1
+    config.load_defaults 7.0
 
     # Settings in config/environments/* take precedence over those specified here.
     # Application configuration can go into files in config/initializers
diff --git a/config/initializers/new_framework_defaults_6_0.rb b/config/initializers/new_framework_defaults_6_0.rb
deleted file mode 100644
index 92240ef5f..000000000
--- a/config/initializers/new_framework_defaults_6_0.rb
+++ /dev/null
@@ -1,45 +0,0 @@
-# Be sure to restart your server when you modify this file.
-#
-# This file contains migration options to ease your Rails 6.0 upgrade.
-#
-# Once upgraded flip defaults one by one to migrate to the new default.
-#
-# Read the Guide for Upgrading Ruby on Rails for more info on each option.
-
-# Don't force requests from old versions of IE to be UTF-8 encoded.
-# Rails.application.config.action_view.default_enforce_utf8 = false
-
-# Embed purpose and expiry metadata inside signed and encrypted
-# cookies for increased security.
-#
-# This option is not backwards compatible with earlier Rails versions.
-# It's best enabled when your entire app is migrated and stable on 6.0.
-# Rails.application.config.action_dispatch.use_cookies_with_metadata = true
-
-# Change the return value of `ActionDispatch::Response#content_type` to Content-Type header without modification.
-# Rails.application.config.action_dispatch.return_only_media_type_on_content_type = false
-
-# Return false instead of self when enqueuing is aborted from a callback.
-# Rails.application.config.active_job.return_false_on_aborted_enqueue = true
-
-# Send Active Storage analysis and purge jobs to dedicated queues.
-# Rails.application.config.active_storage.queues.analysis = :active_storage_analysis
-# Rails.application.config.active_storage.queues.purge    = :active_storage_purge
-
-# When assigning to a collection of attachments declared via `has_many_attached`, replace existing
-# attachments instead of appending. Use #attach to add new attachments without replacing existing ones.
-# Rails.application.config.active_storage.replace_on_assign_to_many = true
-
-# Use ActionMailer::MailDeliveryJob for sending parameterized and normal mail.
-#
-# The default delivery jobs (ActionMailer::Parameterized::DeliveryJob, ActionMailer::DeliveryJob),
-# will be removed in Rails 6.1. This setting is not backwards compatible with earlier Rails versions.
-# If you send mail in the background, job workers need to have a copy of
-# MailDeliveryJob to ensure all delivery jobs are processed properly.
-# Make sure your entire app is migrated and stable on 6.0 before using this setting.
-# Rails.application.config.action_mailer.delivery_job = "ActionMailer::MailDeliveryJob"
-
-# Enable the same cache key to be reused when the object being cached of type
-# `ActiveRecord::Relation` changes by moving the volatile information (max updated at and count)
-# of the relation's cache key into the cache version to support recycling cache key.
-# Rails.application.config.active_record.collection_cache_versioning = true
diff --git a/config/initializers/new_framework_defaults_7_0.rb b/config/initializers/new_framework_defaults_7_0.rb
deleted file mode 100644
index a579326e2..000000000
--- a/config/initializers/new_framework_defaults_7_0.rb
+++ /dev/null
@@ -1,117 +0,0 @@
-# Be sure to restart your server when you modify this file.
-#
-# This file eases your Rails 7.0 framework defaults upgrade.
-#
-# Uncomment each configuration one by one to switch to the new default.
-# Once your application is ready to run with all new defaults, you can remove
-# this file and set the `config.load_defaults` to `7.0`.
-#
-# Read the Guide for Upgrading Ruby on Rails for more info on each option.
-# https://guides.rubyonrails.org/upgrading_ruby_on_rails.html
-
-# `button_to` view helper will render `<button>` element, regardless of whether
-# or not the content is passed as the first argument or as a block.
-# Rails.application.config.action_view.button_to_generates_button_tag = true
-
-# `stylesheet_link_tag` view helper will not render the media attribute by default.
-# Rails.application.config.action_view.apply_stylesheet_media_default = false
-
-# Change the digest class for the key generators to `OpenSSL::Digest::SHA256`.
-# Changing this default means invalidate all encrypted messages generated by
-# your application and, all the encrypted cookies. Only change this after you
-# rotated all the messages using the key rotator.
-#
-# See upgrading guide for more information on how to build a rotator.
-# https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html
-# Rails.application.config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256
-
-# Change the digest class for ActiveSupport::Digest.
-# Changing this default means that for example Etags change and
-# various cache keys leading to cache invalidation.
-# Rails.application.config.active_support.hash_digest_class = OpenSSL::Digest::SHA256
-
-# Don't override ActiveSupport::TimeWithZone.name and use the default Ruby
-# implementation.
-# Rails.application.config.active_support.remove_deprecated_time_with_zone_name = true
-
-# Change the format of the cache entry.
-# Changing this default means that all new cache entries added to the cache
-# will have a different format that is not supported by Rails 6.1 applications.
-# Only change this value after your application is fully deployed to Rails 7.0
-# and you have no plans to rollback.
-# Rails.application.config.active_support.cache_format_version = 7.0
-
-# Calls `Rails.application.executor.wrap` around test cases.
-# This makes test cases behave closer to an actual request or job.
-# Several features that are normally disabled in test, such as Active Record query cache
-# and asynchronous queries will then be enabled.
-# Rails.application.config.active_support.executor_around_test_case = true
-
-# Define the isolation level of most of Rails internal state.
-# If you use a fiber based server or job processor, you should set it to `:fiber`.
-# Otherwise the default of `:thread` if preferable.
-# Rails.application.config.active_support.isolation_level = :thread
-
-# Set both the `:open_timeout` and `:read_timeout` values for `:smtp` delivery method.
-# Rails.application.config.action_mailer.smtp_timeout = 5
-
-# The ActiveStorage video previewer will now use scene change detection to generate
-# better preview images (rather than the previous default of using the first frame
-# of the video).
-# Rails.application.config.active_storage.video_preview_arguments =
-#   "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1' -frames:v 1 -f image2"
-
-# Automatically infer `inverse_of` for associations with a scope.
-# Rails.application.config.active_record.automatic_scope_inversing = true
-
-# Raise when running tests if fixtures contained foreign key violations
-# Rails.application.config.active_record.verify_foreign_keys_for_fixtures = true
-
-# Disable partial inserts.
-# This default means that all columns will be referenced in INSERT queries
-# regardless of whether they have a default or not.
-# Rails.application.config.active_record.partial_inserts = false
-#
-# Protect from open redirect attacks in `redirect_back_or_to` and `redirect_to`.
-# Rails.application.config.action_controller.raise_on_open_redirects = true
-
-# Change the variant processor for Active Storage.
-# Changing this default means updating all places in your code that
-# generate variants to use image processing macros and ruby-vips
-# operations. See the upgrading guide for detail on the changes required.
-# The `:mini_magick` option is not deprecated; it's fine to keep using it.
-# Rails.application.config.active_storage.variant_processor = :vips
-
-# If you're upgrading and haven't set `cookies_serializer` previously, your cookie serializer
-# was `:marshal`. Convert all cookies to JSON, using the `:hybrid` formatter.
-#
-# If you're confident all your cookies are JSON formatted, you can switch to the `:json` formatter.
-#
-# Continue to use `:marshal` for backward-compatibility with old cookies.
-#
-# If you have configured the serializer elsewhere, you can remove this.
-#
-# See https://guides.rubyonrails.org/action_controller_overview.html#cookies for more information.
-# Rails.application.config.action_dispatch.cookies_serializer = :hybrid
-
-# Enable parameter wrapping for JSON.
-# Previously this was set in an initializer. It's fine to keep using that initializer if you've customized it.
-# To disable parameter wrapping entirely, set this config to `false`.
-# Rails.application.config.action_controller.wrap_parameters_by_default = true
-
-# Specifies whether generated namespaced UUIDs follow the RFC 4122 standard for namespace IDs provided as a
-# `String` to `Digest::UUID.uuid_v3` or `Digest::UUID.uuid_v5` method calls.
-#
-# See https://guides.rubyonrails.org/configuring.html#config-active-support-use-rfc4122-namespaced-uuids for
-# more information.
-# Rails.application.config.active_support.use_rfc4122_namespaced_uuids = true
-
-# Change the default headers to disable browsers' flawed legacy XSS protection.
-# Rails.application.config.action_dispatch.default_headers = {
-#   "X-Frame-Options" => "SAMEORIGIN",
-#   "X-XSS-Protection" => "0",
-#   "X-Content-Type-Options" => "nosniff",
-#   "X-Download-Options" => "noopen",
-#   "X-Permitted-Cross-Domain-Policies" => "none",
-#   "Referrer-Policy" => "strict-origin-when-cross-origin"
-# }

From f52a24ecc2e97908b7d8e8c73835fc273de83c36 Mon Sep 17 00:00:00 2001
From: Aga Dufrat <aga.dufrat@digital.cabinet-office.gov.uk>
Date: Mon, 18 Jul 2022 16:59:39 +0100
Subject: [PATCH 10/10] Rotate SHA1 encrypted cookies to SHA256

---
 config/application.rb | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/config/application.rb b/config/application.rb
index 45c2dcaf4..53832619e 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -131,5 +131,22 @@ class Application < Rails::Application
 
     # Do not swallow errors in after_commit/after_rollback callbacks.
     # config.active_record.raise_in_transactional_callbacks = true
+
+    # Rotate SHA1 cookies to SHA256 (the new Rails 7 default)
+    # TODO: Remove this after existing user sessions have been rotated
+    # https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html#key-generator-digest-class-changing-to-use-sha256
+    Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
+      salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
+      secret_key_base = Rails.application.secrets.secret_key_base
+      next if secret_key_base.blank?
+
+      key_generator = ActiveSupport::KeyGenerator.new(
+        secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1
+      )
+      key_len = ActiveSupport::MessageEncryptor.key_len
+      secret = key_generator.generate_key(salt, key_len)
+
+      cookies.rotate :encrypted, secret
+    end
   end
 end