Update to Rails 7.0 (#1100)

Gemfile

@@ -1,6 +1,6 @@
 source "https://rubygems.org"
 
-gem "rails", "~> 6.1.6"
+gem "rails", "~> 7.0.3"
 
 gem "mysql2"
 
@@ -52,7 +52,7 @@ group :test, :development do
   gem 'capybara'
   gem 'database_cleaner'
   gem "listen"
-  gem "rspec-rails"
+  gem 'rspec-rails', '~> 6.0.0.rc1'
   gem "factory_bot_rails"
   gem "rubocop", "0.81", require: false
   gem "rubocop-rails", require: false

Gemfile.lock

@@ -2,69 +2,75 @@ GEM
   remote: https://rubygems.org/
   specs:
     Ascii85 (1.1.0)
-    actioncable (6.1.6)
+    actioncable (7.0.3)
-      actionpack (= 6.1.6)
+      actionpack (= 7.0.3)
-      activesupport (= 6.1.6)
+      activesupport (= 7.0.3)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.1.6)
+    actionmailbox (7.0.3)
-      actionpack (= 6.1.6)
+      actionpack (= 7.0.3)
-      activejob (= 6.1.6)
+      activejob (= 7.0.3)
-      activerecord (= 6.1.6)
+      activerecord (= 7.0.3)
-      activestorage (= 6.1.6)
+      activestorage (= 7.0.3)
-      activesupport (= 6.1.6)
+      activesupport (= 7.0.3)
       mail (>= 2.7.1)
-    actionmailer (6.1.6)
+      net-imap
-      actionpack (= 6.1.6)
+      net-pop
-      actionview (= 6.1.6)
+      net-smtp
-      activejob (= 6.1.6)
+    actionmailer (7.0.3)
-      activesupport (= 6.1.6)
+      actionpack (= 7.0.3)
+      actionview (= 7.0.3)
+      activejob (= 7.0.3)
+      activesupport (= 7.0.3)
       mail (~> 2.5, >= 2.5.4)
+      net-imap
+      net-pop
+      net-smtp
       rails-dom-testing (~> 2.0)
-    actionpack (6.1.6)
+    actionpack (7.0.3)
-      actionview (= 6.1.6)
+      actionview (= 7.0.3)
-      activesupport (= 6.1.6)
+      activesupport (= 7.0.3)
-      rack (~> 2.0, >= 2.0.9)
+      rack (~> 2.0, >= 2.2.0)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
     actionpack-page_caching (1.2.4)
       actionpack (>= 4.0.0)
-    actiontext (6.1.6)
+    actiontext (7.0.3)
-      actionpack (= 6.1.6)
+      actionpack (= 7.0.3)
-      activerecord (= 6.1.6)
+      activerecord (= 7.0.3)
-      activestorage (= 6.1.6)
+      activestorage (= 7.0.3)
-      activesupport (= 6.1.6)
+      activesupport (= 7.0.3)
+      globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (6.1.6)
+    actionview (7.0.3)
-      activesupport (= 6.1.6)
+      activesupport (= 7.0.3)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.1.6)
+    activejob (7.0.3)
-      activesupport (= 6.1.6)
+      activesupport (= 7.0.3)
       globalid (>= 0.3.6)
-    activemodel (6.1.6)
+    activemodel (7.0.3)
-      activesupport (= 6.1.6)
+      activesupport (= 7.0.3)
-    activerecord (6.1.6)
+    activerecord (7.0.3)
-      activemodel (= 6.1.6)
+      activemodel (= 7.0.3)
-      activesupport (= 6.1.6)
+      activesupport (= 7.0.3)
     activerecord-typedstore (1.4.0)
       activerecord (>= 5.2)
-    activestorage (6.1.6)
+    activestorage (7.0.3)
-      actionpack (= 6.1.6)
+      actionpack (= 7.0.3)
-      activejob (= 6.1.6)
+      activejob (= 7.0.3)
-      activerecord (= 6.1.6)
+      activerecord (= 7.0.3)
-      activesupport (= 6.1.6)
+      activesupport (= 7.0.3)
       marcel (~> 1.0)
       mini_mime (>= 1.1.0)
-    activesupport (6.1.6)
+    activesupport (7.0.3)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
-      zeitwerk (~> 2.3)
     addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
     afm (0.2.2)
@@ -94,6 +100,7 @@ GEM
       database_cleaner-core (~> 2.0.0)
     database_cleaner-core (2.0.1)
     diff-lcs (1.5.0)
+    digest (3.1.0)
     docile (1.4.0)
     erubi (1.10.0)
     exception_notification (4.5.0)
@@ -136,8 +143,22 @@ GEM
     method_source (1.0.0)
     mini_mime (1.1.2)
     mini_portile2 (2.8.0)
-    minitest (5.15.0)
+    minitest (5.16.1)
     mysql2 (0.5.4)
+    net-imap (0.2.3)
+      digest
+      net-protocol
+      strscan
+    net-pop (0.1.1)
+      digest
+      net-protocol
+      timeout
+    net-protocol (0.1.3)
+      timeout
+    net-smtp (0.3.1)
+      digest
+      net-protocol
+      timeout
     nio4r (2.5.8)
     nokogiri (1.13.6)
       mini_portile2 (~> 2.8.0)
@@ -163,34 +184,34 @@ GEM
       rack (>= 1.0, < 3)
     rack-mini-profiler (3.0.0)
       rack (>= 1.2.0)
-    rack-test (1.1.0)
+    rack-test (2.0.1)
-      rack (>= 1.0, < 3)
+      rack (>= 1.3)
-    rails (6.1.6)
+    rails (7.0.3)
-      actioncable (= 6.1.6)
+      actioncable (= 7.0.3)
-      actionmailbox (= 6.1.6)
+      actionmailbox (= 7.0.3)
-      actionmailer (= 6.1.6)
+      actionmailer (= 7.0.3)
-      actionpack (= 6.1.6)
+      actionpack (= 7.0.3)
-      actiontext (= 6.1.6)
+      actiontext (= 7.0.3)
-      actionview (= 6.1.6)
+      actionview (= 7.0.3)
-      activejob (= 6.1.6)
+      activejob (= 7.0.3)
-      activemodel (= 6.1.6)
+      activemodel (= 7.0.3)
-      activerecord (= 6.1.6)
+      activerecord (= 7.0.3)
-      activestorage (= 6.1.6)
+      activestorage (= 7.0.3)
-      activesupport (= 6.1.6)
+      activesupport (= 7.0.3)
       bundler (>= 1.15.0)
-      railties (= 6.1.6)
+      railties (= 7.0.3)
-      sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.4.2)
+    rails-html-sanitizer (1.4.3)
       loofah (~> 2.3)
-    railties (6.1.6)
+    railties (7.0.3)
-      actionpack (= 6.1.6)
+      actionpack (= 7.0.3)
-      activesupport (= 6.1.6)
+      activesupport (= 7.0.3)
       method_source
       rake (>= 12.2)
       thor (~> 1.0)
+      zeitwerk (~> 2.5)
     rainbow (3.1.1)
     rake (13.0.6)
     rb-fsevent (0.11.1)
@@ -212,14 +233,14 @@ GEM
     rspec-mocks (3.11.1)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.11.0)
-    rspec-rails (5.1.2)
+    rspec-rails (6.0.0.rc1)
-      actionpack (>= 5.2)
+      actionpack (>= 6.1)
-      activesupport (>= 5.2)
+      activesupport (>= 6.1)
-      railties (>= 5.2)
+      railties (>= 6.1)
-      rspec-core (~> 3.10)
+      rspec-core (~> 3.11)
-      rspec-expectations (~> 3.10)
+      rspec-expectations (~> 3.11)
-      rspec-mocks (~> 3.10)
+      rspec-mocks (~> 3.11)
-      rspec-support (~> 3.10)
+      rspec-support (~> 3.11)
     rspec-support (3.11.0)
     rubocop (0.81.0)
       jaro_winkler (~> 1.5.1)
@@ -261,8 +282,10 @@ GEM
       activesupport (>= 3.0)
       sprockets (>= 2.8, < 4.0)
     stackprof (0.2.19)
+    strscan (3.0.3)
     svg-graph (2.2.1)
     thor (1.2.1)
+    timeout (0.3.0)
     transaction_isolation (1.0.5)
       activerecord (>= 3.0.11)
     transaction_retry (1.0.3)
@@ -284,7 +307,7 @@ GEM
     websocket-extensions (0.1.5)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    zeitwerk (2.5.4)
+    zeitwerk (2.6.0)
 
 PLATFORMS
   ruby
@@ -315,11 +338,11 @@ DEPENDENCIES
   puma (>= 5.6.2)
   rack-attack
   rack-mini-profiler
-  rails (~> 6.1.6)
+  rails (~> 7.0.3)
   rb-readline
   rotp
   rqrcode
-  rspec-rails
+  rspec-rails (~> 6.0.0.rc1)
   rubocop (= 0.81)
   rubocop-rails
   rubocop-rspec
@@ -337,4 +360,4 @@ DEPENDENCIES
   webmock
 
 BUNDLED WITH
-   2.2.0
+   2.3.16

config/environments/development.rb

@@ -1,8 +1,10 @@
+require "active_support/core_ext/integer/time"
+
 Rails.application.configure do
   # Settings specified here will take precedence over those in config/application.rb.
 
-  # In the development environment your application's code is reloaded on
+  # In the development environment your application's code is reloaded any time
-  # every request. This slows down response time but is perfect for development
+  # it changes. This slows down response time but is perfect for development
   # since you don't have to restart the web server when you make code changes.
   config.cache_classes = false
 
@@ -12,15 +14,18 @@ Rails.application.configure do
   # Show full error reports.
   config.consider_all_requests_local = true
 
+  # Enable server timing
+  config.server_timing = true
+
   # Enable/disable caching. By default caching is disabled.
   # Run rails dev:cache to toggle caching.
-  if Rails.root.join('tmp', 'caching-dev.txt').exist?
+  if Rails.root.join("tmp/caching-dev.txt").exist?
     config.action_controller.perform_caching = true
     config.action_controller.enable_fragment_cache_logging = true
 
     config.cache_store = :memory_store
     config.public_file_server.headers = {
-      'Cache-Control' => "public, max-age=#{2.days.to_i}",
+      "Cache-Control" => "public, max-age=#{2.days.to_i}",
     }
   else
     config.action_controller.perform_caching = false
@@ -40,6 +45,12 @@ Rails.application.configure do
   # Print deprecation notices to the Rails logger.
   config.active_support.deprecation = :log
 
+  # Raise exceptions for disallowed deprecations.
+  config.active_support.disallowed_deprecation = :raise
+
+  # Tell Active Support which deprecation messages to disallow.
+  config.active_support.disallowed_deprecation_warnings = []
+
   # Raise an error on page load if there are pending migrations.
   config.active_record.migration_error = :page_load
 
@@ -55,7 +66,13 @@ Rails.application.configure do
   config.assets.quiet = true
 
   # Raises error for missing translations.
-  # config.action_view.raise_on_missing_translations = true
+  # config.i18n.raise_on_missing_translations = true
+
+  # Annotate rendered view with file names.
+  # config.action_view.annotate_rendered_view_with_filenames = true
+
+  # Uncomment if you wish to allow Action Cable access from any origin.
+  # config.action_cable.disable_request_forgery_protection = true
 
   # Use an evented file watcher to asynchronously detect changes in source code,
   # routes, locales, etc. This feature depends on the listen gem.

config/environments/production.rb

@@ -1,3 +1,5 @@
+require "active_support/core_ext/integer/time"
+
 Rails.application.configure do
   # Settings specified here will take precedence over those in config/application.rb.
 
@@ -35,7 +37,7 @@ Rails.application.configure do
   config.assets.digest = true
 
   # Enable serving of images, stylesheets, and JavaScripts from an asset server.
-  # config.action_controller.asset_host = 'http://assets.example.com'
+  # config.asset_host = "http://assets.example.com"
 
   # Specifies the header that your server uses for sending files.
   # config.action_dispatch.x_sendfile_header = 'X-Sendfile' # for Apache
@@ -44,8 +46,8 @@ Rails.application.configure do
   # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
   config.force_ssl = true
 
-  # Use the lowest log level to ensure availability of diagnostic information
+  # Include generic and useful information about system operation, but avoid logging too much
-  # when problems arise.
+  # information to avoid inadvertent exposure of personally identifiable information (PII).
   config.log_level = :info
 
   # Prepend all log lines with the following tags.
@@ -71,8 +73,8 @@ Rails.application.configure do
   # the I18n.default_locale when a translation cannot be found).
   config.i18n.fallbacks = true
 
-  # Send deprecation notices to registered listeners.
+  # Don't log any deprecations.
-  config.active_support.deprecation = :notify
+  config.active_support.report_deprecations = false
 
   # Use default logging formatter so that PID and timestamp are not suppressed.
   config.log_formatter = ::Logger::Formatter.new

config/environments/test.rb

@@ -1,3 +1,5 @@
+require "active_support/core_ext/integer/time"
+
 # The test environment is used exclusively to run your application's
 # test suite. You never need to work with it otherwise. Remember that
 # your test database is "scratch space" for the test suite and is wiped
@@ -6,15 +8,13 @@
 Rails.application.configure do
   # Settings specified here will take precedence over those in config/application.rb.
 
+  # Turn false under Spring and add config.action_view.cache_template_loading = true.
   config.cache_classes = true
 
-  # Disable caching when running tests
+  # Eager loading loads your whole application. When running a single test locally,
-  config.cache_store = :null_store
+  # this probably isn't necessary. It's a good idea to do in a continuous integration
-
+  # system, or in some way before deploying your code.
-  # Do not eager load code on boot. This avoids loading your whole application
+  config.eager_load = ENV["CI"].present?
-  # just for the purpose of running a single test. If you are using a tool that
-  # preloads Rails for running tests, you may have to set it to true.
-  config.eager_load = false
 
   # Configure public file server for tests with Cache-Control for performance.
   config.public_file_server.enabled = true
@@ -46,4 +46,16 @@ Rails.application.configure do
 
   # Print deprecation notices to the stderr.
   config.active_support.deprecation = :stderr
+
+  # Raise exceptions for disallowed deprecations.
+  config.active_support.disallowed_deprecation = :raise
+
+  # Tell Active Support which deprecation messages to disallow.
+  config.active_support.disallowed_deprecation_warnings = []
+
+  # Raises error for missing translations.
+  # config.i18n.raise_on_missing_translations = true
+
+  # Annotate rendered view with file names.
+  # config.action_view.annotate_rendered_view_with_filenames = true
 end

config/initializers/content_security_policy.rb

@@ -1,8 +1,8 @@
 # Be sure to restart your server when you modify this file.
 
-# Define an application-wide content security policy
+# Define an application-wide content security policy.
-# For further information see the following documentation
+# See the Securing Rails Applications Guide for more information:
-# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+# https://guides.rubyonrails.org/security.html#content-security-policy-header
 
 Rails.application.config.content_security_policy do |policy|
   policy.default_src :none

config/initializers/filter_parameter_logging.rb

@@ -1,4 +1,8 @@
 # Be sure to restart your server when you modify this file.
 
-# Configure sensitive parameters which will be filtered from the log file.
+# Configure parameters to be filtered from the log file. Use this to limit dissemination of
-Rails.application.config.filter_parameters += [:password]
+# sensitive information. See the ActiveSupport::ParameterFilter documentation for supported
+# notations and behaviors.
+Rails.application.config.filter_parameters += [
+  :password, :passw, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn,
+]

config/initializers/new_framework_defaults_6_0.rb

@@ -1,52 +0,0 @@
-# Be sure to restart your server when you modify this file.
-#
-# This file contains migration options to ease your Rails 6.0 upgrade.
-#
-# Once upgraded flip defaults one by one to migrate to the new default.
-#
-# Read the Guide for Upgrading Ruby on Rails for more info on each option.
-
-# Don't force requests from old versions of IE to be UTF-8 encoded.
-Rails.application.config.action_view.default_enforce_utf8 = false
-
-# Embed purpose and expiry metadata inside signed and encrypted
-# cookies for increased security.
-#
-# This option is not backwards compatible with earlier Rails versions.
-# It's best enabled when your entire app is migrated and stable on 6.0.
-# Rails.application.config.action_dispatch.use_cookies_with_metadata = true
-
-# Change the return value of `ActionDispatch::Response#content_type` to
-# Content-Type header without modification.
-# Rails.application.config.action_dispatch.return_only_media_type_on_content_type = false
-
-if Rails.application.config.respond_to?(:active_job)
-  # Return false instead of self when enqueuing is aborted from a callback.
-  Rails.application.config.active_job.return_false_on_aborted_enqueue = true
-end
-
-if Rails.application.config.respond_to?(:active_storage)
-  # Send Active Storage analysis and purge jobs to dedicated queues.
-  Rails.application.config.active_storage.queues.analysis = :active_storage_analysis
-  Rails.application.config.active_storage.queues.purge    = :active_storage_purge
-
-  # When assigning to a collection of attachments declared via `has_many_attached`, replace existing
-  # attachments instead of appending. Use #attach to add new attachments
-  # without replacing existing ones.
-  Rails.application.config.active_storage.replace_on_assign_to_many = true
-end
-
-# Use ActionMailer::MailDeliveryJob for sending parameterized and normal mail.
-#
-# The default delivery jobs (ActionMailer::Parameterized::DeliveryJob, ActionMailer::DeliveryJob),
-# will be removed in Rails 6.1. This setting is not backwards compatible
-# with earlier Rails versions.
-# If you send mail in the background, job workers need to have a copy of
-# MailDeliveryJob to ensure all delivery jobs are processed properly.
-# Make sure your entire app is migrated and stable on 6.0 before using this setting.
-# Rails.application.config.action_mailer.delivery_job = "ActionMailer::MailDeliveryJob"
-
-# Enable the same cache key to be reused when the object being cached of type
-# `ActiveRecord::Relation` changes by moving the volatile information (max updated at and count)
-# of the relation's cache key into the cache version to support recycling cache key.
-# Rails.application.config.active_record.collection_cache_versioning = true

config/initializers/new_framework_defaults_7_0.rb

@@ -0,0 +1,119 @@
+# rubocop:disable Layout/LineLength
+# Be sure to restart your server when you modify this file.
+#
+# This file eases your Rails 7.0 framework defaults upgrade.
+#
+# Uncomment each configuration one by one to switch to the new default.
+# Once your application is ready to run with all new defaults, you can remove
+# this file and set the `config.load_defaults` to `7.0`.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+# https://guides.rubyonrails.org/upgrading_ruby_on_rails.html
+
+# `button_to` view helper will render `<button>` element, regardless of whether
+# or not the content is passed as the first argument or as a block.
+# Rails.application.config.action_view.button_to_generates_button_tag = true
+
+# `stylesheet_link_tag` view helper will not render the media attribute by default.
+# Rails.application.config.action_view.apply_stylesheet_media_default = false
+
+# Change the digest class for the key generators to `OpenSSL::Digest::SHA256`.
+# Changing this default means invalidate all encrypted messages generated by
+# your application and, all the encrypted cookies. Only change this after you
+# rotated all the messages using the key rotator.
+#
+# See upgrading guide for more information on how to build a rotator.
+# https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html
+# Rails.application.config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256
+
+# Change the digest class for ActiveSupport::Digest.
+# Changing this default means that for example Etags change and
+# various cache keys leading to cache invalidation.
+# Rails.application.config.active_support.hash_digest_class = OpenSSL::Digest::SHA256
+
+# Don't override ActiveSupport::TimeWithZone.name and use the default Ruby
+# implementation.
+# Rails.application.config.active_support.remove_deprecated_time_with_zone_name = true
+
+# Change the format of the cache entry.
+# Changing this default means that all new cache entries added to the cache
+# will have a different format that is not supported by Rails 6.1 applications.
+# Only change this value after your application is fully deployed to Rails 7.0
+# and you have no plans to rollback.
+# Rails.application.config.active_support.cache_format_version = 7.0
+
+# Calls `Rails.application.executor.wrap` around test cases.
+# This makes test cases behave closer to an actual request or job.
+# Several features that are normally disabled in test, such as Active Record query cache
+# and asynchronous queries will then be enabled.
+# Rails.application.config.active_support.executor_around_test_case = true
+
+# Define the isolation level of most of Rails internal state.
+# If you use a fiber based server or job processor, you should set it to `:fiber`.
+# Otherwise the default of `:thread` if preferable.
+# Rails.application.config.active_support.isolation_level = :thread
+
+# Set both the `:open_timeout` and `:read_timeout` values for `:smtp` delivery method.
+# Rails.application.config.action_mailer.smtp_timeout = 5
+
+# The ActiveStorage video previewer will now use scene change detection to generate
+# better preview images (rather than the previous default of using the first frame
+# of the video).
+# Rails.application.config.active_storage.video_preview_arguments =
+#   "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1' -frames:v 1 -f image2"
+
+# Automatically infer `inverse_of` for associations with a scope.
+# Rails.application.config.active_record.automatic_scope_inversing = true
+
+# Raise when running tests if fixtures contained foreign key violations
+# Rails.application.config.active_record.verify_foreign_keys_for_fixtures = true
+
+# Disable partial inserts.
+# This default means that all columns will be referenced in INSERT queries
+# regardless of whether they have a default or not.
+# Rails.application.config.active_record.partial_inserts = false
+#
+# Protect from open redirect attacks in `redirect_back_or_to` and `redirect_to`.
+# Rails.application.config.action_controller.raise_on_open_redirects = true
+
+# Change the variant processor for Active Storage.
+# Changing this default means updating all places in your code that
+# generate variants to use image processing macros and ruby-vips
+# operations. See the upgrading guide for detail on the changes required.
+# The `:mini_magick` option is not deprecated; it's fine to keep using it.
+# Rails.application.config.active_storage.variant_processor = :vips
+
+# If you're upgrading and haven't set `cookies_serializer` previously, your cookie serializer
+# was `:marshal`. Convert all cookies to JSON, using the `:hybrid` formatter.
+#
+# If you're confident all your cookies are JSON formatted, you can switch to the `:json` formatter.
+#
+# Continue to use `:marshal` for backward-compatibility with old cookies.
+#
+# If you have configured the serializer elsewhere, you can remove this.
+#
+# See https://guides.rubyonrails.org/action_controller_overview.html#cookies for more information.
+# Rails.application.config.action_dispatch.cookies_serializer = :hybrid
+
+# Enable parameter wrapping for JSON.
+# Previously this was set in an initializer. It's fine to keep using that initializer if you've customized it.
+# To disable parameter wrapping entirely, set this config to `false`.
+# Rails.application.config.action_controller.wrap_parameters_by_default = true
+
+# Specifies whether generated namespaced UUIDs follow the RFC 4122 standard for namespace IDs provided as a
+# `String` to `Digest::UUID.uuid_v3` or `Digest::UUID.uuid_v5` method calls.
+#
+# See https://guides.rubyonrails.org/configuring.html#config-active-support-use-rfc4122-namespaced-uuids for
+# more information.
+# Rails.application.config.active_support.use_rfc4122_namespaced_uuids = true
+
+# Change the default headers to disable browsers' flawed legacy XSS protection.
+# Rails.application.config.action_dispatch.default_headers = {
+#   "X-Frame-Options" => "SAMEORIGIN",
+#   "X-XSS-Protection" => "0",
+#   "X-Content-Type-Options" => "nosniff",
+#   "X-Download-Options" => "noopen",
+#   "X-Permitted-Cross-Domain-Policies" => "none",
+#   "Referrer-Policy" => "strict-origin-when-cross-origin"
+# }
+# rubocop:enable Layout/LineLength

config/initializers/permissions_policy.rb

@@ -0,0 +1,11 @@
+# Define an application-wide HTTP permissions policy. For further
+# information see https://developers.google.com/web/updates/2018/06/feature-policy
+#
+# Rails.application.config.permissions_policy do |f|
+#   f.camera      :none
+#   f.gyroscope   :none
+#   f.microphone  :none
+#   f.usb         :none
+#   f.fullscreen  :self
+#   f.payment     :self, "https://secure.example.com"
+# end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2022_03_31_165136) do
+ActiveRecord::Schema[6.1].define(version: 2022_03_31_165136) do
 
   create_table "categories", charset: "utf8mb4", force: :cascade do |t|
     t.string "category"

spec/requests/stories_spec.rb

@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-describe 'stores', type: :request do
+describe 'stories', type: :request do
   let(:user) { create(:user) }
   let(:story) { create(:story, user: user) }
   let(:mod) { create(:user, :moderator) }
@@ -9,12 +9,9 @@ describe 'stores', type: :request do
     before { sign_in user }
 
     context "json" do
-      let(:headers) { { 'Content-Type' => 'application/json', 'Accept' => 'application/json' } }
-
       it "returns similar story matching URL" do
-        post "/stories/check_url_dupe",
+        post "/stories/check_url_dupe.json",
-             params: { story: { title: "some other title", url: story.url } }.to_json,
+             params: { story: { title: "some other title", url: story.url } }
-             headers: headers
 
         expect(response).to be_successful
 
@@ -32,9 +29,8 @@ describe 'stores', type: :request do
       end
 
       it "returns no matches if previously submitted URL is only partial match" do
-        post "/stories/check_url_dupe",
+        post "/stories/check_url_dupe.json",
-             params: { story: { title: "some other title", url: story.url[0...-1] } }.to_json,
+             params: { story: { title: "some other title", url: story.url[0...-1] } }
-             headers: headers
 
         expect(response).to be_successful
 
@@ -45,9 +41,8 @@ describe 'stores', type: :request do
       end
 
       it "returns no matches if no matching URL" do
-        post "/stories/check_url_dupe",
+        post "/stories/check_url_dupe.json",
-             params: { story: { title: "some other title", url: "invalid_url" } }.to_json,
+             params: { story: { title: "some other title", url: "invalid_url" } }
-             headers: headers
 
         expect(response).to be_successful
 
@@ -59,15 +54,13 @@ describe 'stores', type: :request do
 
       it "throws a 400 if there's no URL present" do
         expect {
-          post "/stories/check_url_dupe",
+          post "/stories/check_url_dupe.json",
-               params: { story: { url: "" } }.to_json,
+               params: { story: { url: "" } }
-               headers: headers
         }.to raise_error(ActionController::ParameterMissing)
 
         expect {
-          post "/stories/check_url_dupe",
+          post "/stories/check_url_dupe.json",
-               params: { story: {} }.to_json,
+               params: { story: {} }
-               headers: headers
         }.to raise_error(ActionController::ParameterMissing)
       end
     end