Skip to content

Conversation

@rsmithlal
Copy link
Member

@rsmithlal rsmithlal commented Nov 21, 2025

This pull request introduces several improvements focused on invitation token management, authorization, and controller structure within the BetterTogether application. The main changes include refactoring invitation token handling for communities and events, enhancing authorization checks for geography-related resources, and removing the now-unneeded event invitations controller. Additionally, a new testing utility is added for generator specs.

Invitation Token Management and Authorization Improvements:

  • Refactored CommunitiesController to centralize and robustly handle community invitation tokens, including privacy checks, session management, and locale setting. Introduced the InvitationTokenAuthorization concern and added notification read marking. [1] [2] [3]
  • Improved EventsController invitation token handling by implementing template methods for the InvitationTokenAuthorization concern, simplifying privacy checks, and ensuring consistent session and locale management. [1] [2] [3]
  • Removed the obsolete Events::InvitationsController, consolidating invitation logic into the main events controller.

Authorization Enhancements for Geography Resources:

  • Added explicit authorization checks and policy verification for Geography::ContinentsController and Geography::RegionSettlementsController, ensuring that only authorized users can access or modify these resources. [1] [2] [3] [4]

General Improvements and Utilities:

  • Included the InvitationSessionManagement concern in ApplicationController and refactored platform invitation token validation to use the unified method. [1] [2]
  • Added the generator_spec gem to the test group in the Gemfile for improved generator testing utilities.
  • Added missing authorization in the ConversationsController update action.

These changes collectively improve the security, maintainability, and consistency of invitation and authorization logic throughout the codebase.

Summary

Describe the change and the motivation.

Checklist

  • Tests added/updated and passing (bin/ci).
  • Lint and security checks (rubocop, brakeman, bundler-audit).
  • Documentation updated under docs/ describing new/changed functionality.
  • Mermaid diagrams (docs/*.mmd) updated to reflect changes.
  • Rendered PNGs regenerated with bin/render_diagrams and committed.
  • For DB changes, included any needed backfills/dedupes and noted risks.

Screenshots / Diagrams

If applicable, include screenshots or link to updated diagrams.

Notes

Anything reviewers should be aware of (migration order, flags, feature toggles).

- Add CommunityInvitationNotifier for handling notifications via ActionCable and email.
- Create CommunityInvitationPolicy to manage permissions for creating, destroying, and resending invitations.
- Enhance CommunityPolicy to allow access based on invitation status and tokens.
- Develop views for invitation review, including actions to accept or decline invitations.
- Introduce invitations panel for inviting members via email or existing users.
- Create invitations table to display current invitations with status and actions.
- Update routes to include nested resources for community invitations.
- Add factories and specs for CommunityInvitation model and its functionalities.
- Implement tests for invitation review and token access scenarios.
- Add internationalization support for invitation-related strings in multiple languages.
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

- Introduced `InvitationTokenAuthorization` concern to manage invitation token extraction and validation.
- Added `InvitationTokenSession` concern for session management of invitation tokens.
- Created `InvitationUserSetup` concern for user setup from invitation data, including email pre-filling and person assignment.
- Established `InvitationMailerBase` for shared functionality in community and event invitation mailers.
- Updated `CommunityInvitationsMailer` and `EventInvitationsMailer` to inherit from `InvitationMailerBase`.
- Created `InvitationNotifierBase` for common notification functionality across invitation types.
- Refactored `CommunityInvitationPolicy` and `EventInvitationPolicy` to inherit from a new `InvitationPolicy` base class.
- Simplified community and event invitation models by removing unnecessary status handling and validation logic.
- Updated tests to reflect changes in invitation handling and authorization logic.
…t invitations

- Added shared partials for invitation review, invitation panel, and invitations table to reduce code duplication.
- Updated community and event show views to utilize new shared components.
- Enhanced role selection field in invitation forms.
- Removed outdated invitation-related views.
- Updated localization keys for consistency across languages.
…itations

- Implemented `CommunityInvitationPolicy` and `EventInvitationPolicy` with tests for resend, create, and destroy actions.
- Created request specs for basic invitation creation, duplicate invitation prevention, and invitation error handling.
- Added system tests for declined invitation resending and UI interactions for invitation resending.
- Developed view specs for rendering invitation rows with appropriate buttons based on invitation status.
- Enhanced user registration flow with invitation handling for community, event, and platform invitations.
…and views

- Implemented invitation model and associated mailer for sending invitations.
- Created invitation policy for authorization rules.
- Added notifier for sending notifications related to invitations.
- Generated factory for invitation testing.
- Developed views for managing invitations, including index and new invitation forms.
- Included localization files for English, Spanish, and French.
- Added migration for creating invitations table with necessary fields.
- Implemented RSpec tests for models, mailers, and policies.
- Created generator spec to ensure proper file generation and structure.
…ty in English, Spanish, French, and Ukrainian locales
Fixes LoadError in GitHub Actions by using the engine's root path
instead of relative path which fails in CI environment.

This resolves the error:
cannot load such file -- /home/runner/work/community-engine-rails/lib/generators/better_together/invitation/invitation_generator
- Added support for custom namespaces in the invitation generator, allowing users to specify a namespace when generating models, mailers, policies, and factories.
- Updated the generator to handle both engine and host app contexts, defaulting to the appropriate namespace based on the context.
- Introduced a `--with-migration` option to generate a separate migration for invitations, with appropriate warnings and instructions for users.
- Refactored file paths and class names to accommodate namespacing, ensuring generated files are correctly placed in the specified namespace.
- Updated templates for models, mailers, policies, and factories to reflect the new namespacing logic.
- Added comprehensive tests to verify the correct behavior of the generator with various namespace configurations, including custom namespaces and empty namespaces.
@rsmithlal rsmithlal merged commit 35a10c8 into main Dec 17, 2025
19 of 24 checks passed
@rsmithlal rsmithlal deleted the feat/community-invitations branch December 17, 2025 22:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Backend enhancement New feature or request ruby Pull requests that update ruby code User Interface (UI) Requires changes to the front end

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants