Nat Dean-Lewis
1 month ago
192 changed files with 3294 additions and 1661 deletions
@ -0,0 +1,79 @@
|
||||
{ |
||||
"enabledPlugins": { |
||||
"dependency-track@skillwire": true |
||||
}, |
||||
"permissions": { |
||||
"allow": [ |
||||
"WebSearch", |
||||
"Bash(rg:*)", |
||||
"Bash(ls:*)", |
||||
"Bash(bundle exec rspec:*)", |
||||
"Bash(bundle exec rake lint)", |
||||
"Bash(bundle exec rake parallel:spec)", |
||||
"Bash(bundle exec rake parallel:setup)", |
||||
"Bash(bundle exec rubocop:*)", |
||||
"Bash(bundle exec erb_lint:*)", |
||||
"Bash(bundle exec rails:*)", |
||||
"Bash(bundle exec rake db:migrate)", |
||||
"Bash(bundle exec rake db:migrate:status)", |
||||
"Bash(bundle install)", |
||||
"Bash(yarn install)", |
||||
"Bash(yarn standard:*)", |
||||
"Bash(yarn prettier:*)", |
||||
"Bash(yarn stylelint:*)", |
||||
"Bash(yarn build:*)", |
||||
"Bash(git fetch)", |
||||
"Bash(git pull)", |
||||
"Bash(git status)", |
||||
"Bash(git diff:*)", |
||||
"Bash(git log:*)", |
||||
"Bash(git show:*)", |
||||
"Bash(git branch:*)", |
||||
"Bash(git checkout:*)", |
||||
"Bash(git add:*)", |
||||
"Bash(git commit:*)", |
||||
"Edit(app/**)", |
||||
"Edit(config/**)", |
||||
"Edit(db/migrate/**)", |
||||
"Edit(lib/**)", |
||||
"Edit(spec/**)", |
||||
"Edit(docs/**)" |
||||
], |
||||
"deny": [ |
||||
"Read(.env*)", |
||||
"Read(config/master.key)", |
||||
"Edit(.env*)", |
||||
"Edit(config/master.key)", |
||||
"Edit(config/credentials.yml.enc)", |
||||
"Edit(db/schema.rb)", |
||||
"Edit(db/structure.sql)", |
||||
"Edit(Gemfile.lock)", |
||||
"Edit(yarn.lock)", |
||||
"Edit(AGENTS.md)", |
||||
"Edit(AI_CONTEXT.md)", |
||||
"Edit(WORKFLOW_AI.md)", |
||||
"Bash(curl:*)", |
||||
"Bash(wget:*)", |
||||
"Bash(sudo:*)", |
||||
"Bash(rm -rf:*)", |
||||
"Bash(chmod:*)", |
||||
"Bash(chown:*)", |
||||
"Bash(echo:*)", |
||||
"Bash(cat:*)", |
||||
"Bash(tail:*)", |
||||
"Bash(head:*)", |
||||
"Bash(gh:*)", |
||||
"Bash(git add .)", |
||||
"Bash(git add --all)", |
||||
"Bash(git add -A)", |
||||
"Bash(git push --force)", |
||||
"Bash(git push --force-with-lease)", |
||||
"Bash(git reset --hard)", |
||||
"Bash(bundle exec rake db:drop)", |
||||
"Bash(bundle exec rake db:reset)" |
||||
] |
||||
}, |
||||
"env": { |
||||
"CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1" |
||||
} |
||||
} |
||||
@ -0,0 +1,55 @@
|
||||
name: Upload SBOM |
||||
|
||||
# Generates a CycloneDX SBOM with Syft (auto-detects both the Ruby gems in |
||||
# Gemfile.lock and the Node packages in yarn.lock) and uploads it to |
||||
# Dependency-Track. Called from the staging and production pipelines after a |
||||
# successful deploy. |
||||
|
||||
on: |
||||
workflow_call: |
||||
inputs: |
||||
projectversion: |
||||
required: true |
||||
type: string |
||||
secrets: |
||||
DTRACK_API_KEY: |
||||
required: true |
||||
|
||||
permissions: |
||||
contents: read |
||||
|
||||
jobs: |
||||
sbom: |
||||
name: Generate and upload SBOM |
||||
runs-on: ubuntu-latest |
||||
steps: |
||||
- uses: actions/checkout@v4 |
||||
|
||||
- run: | |
||||
echo "SYFT_VERSION=v1.45.0" >> "$GITHUB_ENV" |
||||
echo "SYFT_SCRIPT_SHA=9673f867e50398b5d25ec97ff051a451c46d262c" >> "$GITHUB_ENV" |
||||
|
||||
- uses: actions/cache@v4 |
||||
with: |
||||
path: /usr/local/bin/syft |
||||
key: syft-${{ env.SYFT_VERSION }} |
||||
|
||||
- name: Install Syft |
||||
run: | |
||||
[ -f /usr/local/bin/syft ] || \ |
||||
curl -sSfL "https://raw.githubusercontent.com/anchore/syft/${SYFT_SCRIPT_SHA}/install.sh" | sh -s -- -b /usr/local/bin "$SYFT_VERSION" |
||||
|
||||
- run: syft . -o cyclonedx-xml=bom.xml |
||||
|
||||
- name: Upload SBOM to Dependency-Track |
||||
env: |
||||
DTRACK_API_KEY: ${{ secrets.DTRACK_API_KEY }} |
||||
SBOM_VERSION: ${{ inputs.projectversion }} |
||||
run: | |
||||
curl -sSf -X POST "https://api-deps.softwire.com/api/v1/bom" \ |
||||
-H "X-Api-Key: $DTRACK_API_KEY" \ |
||||
-F "autoCreate=true" \ |
||||
-F "projectName=CORE" \ |
||||
-F "projectVersion=$SBOM_VERSION" \ |
||||
-F "parentName=Support" \ |
||||
-F "bom=@bom.xml" |
||||
@ -0,0 +1,105 @@
|
||||
# CLAUDE.md |
||||
|
||||
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. |
||||
|
||||
## Project |
||||
|
||||
CORE — a Ruby on Rails app (the "Submit social housing lettings and sales data" service) that collects lettings and sales of social housing data in England for MHCLG. Data providers (Local Authorities and Private Registered Providers) submit logs; the data is exported nightly to CDS (Consolidated Data Store) via XML to S3. |
||||
|
||||
Stack: Ruby 3.4.9, Rails 7.2, PostgreSQL, Sidekiq + Redis, Webpack/Propshaft, Stimulus, ViewComponent, GOV.UK Design System (govuk-frontend, govuk-components, govuk_design_system_formbuilder), Devise + 2FA, Pundit, PaperTrail. |
||||
|
||||
Full domain/architecture docs live in `docs/` (rendered at https://communitiesuk.github.io/submit-social-housing-lettings-and-sales-data) and are the authoritative reference — especially `docs/index.md` (domain overview), `docs/form/*` (form architecture), `docs/bulk_upload.md`, `docs/exports.md`, `docs/csv_downloads.md`, and the ADRs in `docs/adr/`. |
||||
|
||||
## Commands |
||||
|
||||
Run app (Rails + Sidekiq's redis + JS watch via Foreman): |
||||
|
||||
```bash |
||||
./bin/dev |
||||
``` |
||||
|
||||
Rails server alone: `bundle exec rails s` (port 3000). JS watch alone: `yarn build --mode=development --watch`. First-time asset build: `yarn build --mode=development`. |
||||
|
||||
Tests: |
||||
|
||||
```bash |
||||
bundle exec rspec # full suite |
||||
bundle exec rspec ./spec/path/to/file.rb # single file |
||||
bundle exec rspec ./spec/path/to/file.rb:42 # single example by line |
||||
bundle exec rake parallel:setup # one-time setup |
||||
RAILS_ENV=test bundle exec rake parallel:spec # parallel run |
||||
``` |
||||
|
||||
If you change the schema, run `bundle exec rake db:migrate RAILS_ENV=test` before running specs. |
||||
|
||||
Lint (everything): `bundle exec rake lint`. Individual linters: |
||||
|
||||
```bash |
||||
bundle exec rubocop # -a safe autocorrect, -A all |
||||
bundle exec erb_lint --lint-all |
||||
yarn standard # --fix to autocorrect |
||||
yarn stylelint app/frontend/styles |
||||
yarn prettier . --check # --write to autocorrect |
||||
``` |
||||
|
||||
Database: `bundle exec rake db:create db:migrate db:seed`. Seeded users use the password from `REVIEW_APP_USER_PASSWORD` in `.env` (default `password`). |
||||
|
||||
## Architecture |
||||
|
||||
### The form system (core abstraction) |
||||
|
||||
Form data collection runs on annual windows (1 April → 1 April + 3-month late-submission tail). Two forms may be active simultaneously during the April–June/July **crossover period**. |
||||
|
||||
`FormHandler` (singleton, `app/models/form_handler.rb`) holds every active form: `current/previous/next/archived` × `lettings/sales`. Each `Form` is built from Ruby classes (not JSON — historical JSON definitions in `config/forms/` are legacy; new forms are defined in code under `app/models/form/lettings/{sections,subsections,pages,questions}` and `app/models/form/sales/...`). |
||||
|
||||
Hierarchy: `Form` → `Section` → `Subsection` → `Page` → `Question`. Pages route via `depends_on` conditions (with chained method calls e.g. `{ "owning_organisation.provider_type": "local_authority" }`) or custom `routed_to?` methods. Questions can be `conditional_for` (inline conditional on the same page), `derived` (computed, not cleared when unrouted), or `inferred` (cleared when their source changes). See `docs/form/builder.md` for the full DSL. |
||||
|
||||
Key consequence: **every question id must match an ActiveRecord column on `LettingsLog` / `SalesLog`**. Checkbox questions need one column per answer option. Adding a question is a migration + form class change in lock-step. |
||||
|
||||
`Form::DEADLINES` in `app/models/form.rb` is the source of truth for collection year cutoffs (new_logs_end_date, submission_deadline, edit_end_date). Add a year here when introducing a new collection window. |
||||
|
||||
### Logs |
||||
|
||||
`LettingsLog` and `SalesLog` (both inherit shared behaviour from `Log`) are the primary records. Sales splits into discounted ownership, shared-ownership initial, and staircasing (post-2024); pre-2025 also included outright sales. Lettings splits into general needs and supported housing (which belongs to a `Scheme` with one or more `Location`s). |
||||
|
||||
Validations live in `app/models/validations/` (lettings) and `app/models/validations/sales/` and are mixed into the log models. Soft validations show interruption pages instead of hard errors. |
||||
|
||||
### Organisations & permissions |
||||
|
||||
Three user roles outside of MHCLG: **data providers**, **data coordinators** (org admins, can also complete logs), plus an optional **data protection officer (DPO)** flag on a user. Internal roles: **support** (full admin) and **statisticians**. Orgs form parent/child stock-owning/managing relationships (many-to-many), and a user's access to a log depends on whether their org owns or manages it. Pundit policies in `app/policies/` enforce this — always check the policy when adding controller actions. |
||||
|
||||
### Bulk upload |
||||
|
||||
Users upload a CSV per log-type per year; the file is saved to S3 and `ProcessBulkUploadJob` runs `BulkUpload::Processor`, which picks year- and type-specific `CsvParser`, `RowParser`, `Validator`, and `LogCreator` classes from `app/services/bulk_upload/`. Outcomes: clean upload, partial upload (requires user approval after error email), or rejected (template/critical errors). See `docs/bulk_upload.md`. |
||||
|
||||
### Exports to CDS |
||||
|
||||
`Exports::ExportService` orchestrates a nightly Sidekiq cron job that writes XML + manifests to S3 for ingestion by the Consolidated Data Store. Year-specific collections (lettings logs) can produce up to three concurrent collections during crossover. Field-level mapping lives in `lettings_log_export_service.rb`, `organisation_export_service.rb`, `user_export_service.rb`, gated by `EXPORT_FIELDS` constants in the matching `*_export_constants.rb` files (with `POST_<YEAR>_EXPORT_FIELDS` for year-gated additions). Partial vs full export semantics are documented in `docs/exports.md`. |
||||
|
||||
### CSV downloads |
||||
|
||||
User-facing CSV downloads are also async via Sidekiq, delivered as S3 presigned URLs by email. Logs CSVs come in **labels** (human-readable) and **codes** (numeric, aligned with bulk upload / CDS) variants. Column selection lives in `lettings_log_attributes` / `sales_log_attributes` / `scheme_attributes` / `location_attributes` and (for users) `User.download_attributes`. Header descriptions live in the `csv_variable_definitions` table and are edited via `/admin`. |
||||
|
||||
### Rake tasks |
||||
|
||||
`lib/tasks/` holds many one-off and operational rake tasks (data corrections, migrations, exports, form-definition dumps). For ad-hoc production runs, tasks are executed as ECS Fargate tasks against `core-$env-ad-hoc` — see `docs/rake.md`. |
||||
|
||||
### Feature toggles |
||||
|
||||
`app/services/feature_toggle.rb` — simple class methods, no external flag service. |
||||
|
||||
### Frontend conventions |
||||
|
||||
- Service-specific components live in `app/components/` (ViewComponent), with `app-*` BEM class names to avoid clashing with the `govuk-*` Design System. |
||||
- Stimulus controllers: register in `app/frontend/controllers/index.js` (kebab-case) and define in `app/frontend/controllers/` (underscore_case). |
||||
- Webpack bundles JS/CSS via `jsbundling-rails` + `cssbundling-rails`; Propshaft serves the bundled assets. Babel transpiles to ES5 for IE compatibility (polyfills in `app/frontend/application.js`). |
||||
|
||||
## Testing notes |
||||
|
||||
- Prefer request specs over feature specs (faster, still cover route + controller + model + view). Use feature specs only when JavaScript or interaction-specific assertions are needed. |
||||
- FactoryBot factories have deep callback chains: creating a `lettings_log`/`sales_log` also creates a `User`, `Organisation`, often a `DataProtectionConfirmation`, and an `OrganisationRentPeriod` (lettings only, if `period` is set). See `docs/testing.md` for the full breakdown — be aware that tests appearing to "just create a log" may be persisting several other records. |
||||
- Capybara runs headless by default and uses Gecko driver for `js: true` specs (toggle in `spec/rails_helper.rb`). |
||||
|
||||
## Commit & PR conventions |
||||
|
||||
Commits and PRs are prefixed with the Jira ticket id (e.g. `CLDC-4300: ...`) — see `git log` for examples. Pre-commit hooks (Overcommit) run RuboCop and schema-up-to-date checks; do not skip them. |
||||
@ -0,0 +1,25 @@
|
||||
# Used to allow for easier auditing of what users downloaded what info |
||||
# Caches some info about the user at the time of download |
||||
class DownloadRecord < ApplicationRecord |
||||
belongs_to :user |
||||
belongs_to :user_organisation, class_name: "Organisation" |
||||
|
||||
DOWNLOAD_TYPE = { |
||||
user: 0, |
||||
lettings_log: 1, |
||||
sales_log: 2, |
||||
scheme_location: 3, |
||||
}.freeze |
||||
|
||||
enum :download_type, DOWNLOAD_TYPE |
||||
enum :user_role, User::ROLES |
||||
|
||||
def self.build_from_user(user:, **attrs) |
||||
new( |
||||
user:, |
||||
user_organisation: user.organisation, |
||||
user_role: user.role, |
||||
**attrs, |
||||
) |
||||
end |
||||
end |
||||
@ -0,0 +1,5 @@
|
||||
<div class="govuk-body"> |
||||
<%= govuk_details(summary_text: I18n.t("forms.#{@log.form.start_date.year}.sales.guidance.building_height_class.title")) do %> |
||||
<%= I18n.t("forms.#{@log.form.start_date.year}.sales.guidance.building_height_class.content").html_safe %> |
||||
<% end %> |
||||
</div> |
||||
@ -1,42 +1,44 @@
|
||||
<%= govuk_footer do |footer| %> |
||||
<%= footer.with_meta do %> |
||||
<div class="govuk-footer__meta-item govuk-footer__meta-item--grow"> |
||||
<h2 class="govuk-heading-m">Get help with this service</h2> |
||||
<div class="govuk-grid-row"> |
||||
<div class="govuk-grid-column-one-third-from-desktop"> |
||||
<h3 class="govuk-heading-s govuk-!-margin-bottom-1">Online helpdesk</h3> |
||||
<p class="govuk-body govuk-!-font-size-16"> |
||||
<%= govuk_link_to("CORE helpdesk (opens in a new tab)", GlobalConstants::HELPDESK_URL, class: "govuk-footer__link", rel: "noreferrer noopener", target: "_blank") %> |
||||
</p> |
||||
</div> |
||||
<footer class="govuk-footer" role="contentinfo"> |
||||
<div class="govuk-width-container"> |
||||
<div class="govuk-footer__meta"> |
||||
<div class="govuk-footer__meta-item govuk-footer__meta-item--grow"> |
||||
<h2 class="govuk-heading-m">Get help with this service</h2> |
||||
<div class="govuk-grid-row"> |
||||
<div class="govuk-grid-column-one-third-from-desktop"> |
||||
<h3 class="govuk-heading-s govuk-!-margin-bottom-1">Online helpdesk</h3> |
||||
<p class="govuk-body govuk-!-font-size-16"> |
||||
<%= govuk_link_to("CORE helpdesk (opens in a new tab)", GlobalConstants::HELPDESK_URL, class: "govuk-footer__link", rel: "noreferrer noopener", target: "_blank") %> |
||||
</p> |
||||
</div> |
||||
|
||||
<div class="govuk-grid-column-one-third-from-desktop"> |
||||
<h3 class="govuk-heading-s govuk-!-margin-bottom-1">Telephone</h3> |
||||
<ul class="govuk-list govuk-!-font-size-16"> |
||||
<li>0333 202 5084</li> |
||||
<li>Monday to Friday, 9am to 5:30pm<br>(except public holidays)</li> |
||||
</ul> |
||||
<div class="govuk-grid-column-one-third-from-desktop"> |
||||
<h3 class="govuk-heading-s govuk-!-margin-bottom-1">Telephone</h3> |
||||
<ul class="govuk-list govuk-!-font-size-16"> |
||||
<li>0333 202 5084</li> |
||||
<li>Monday to Friday, 9am to 5:30pm<br>(except public holidays)</li> |
||||
</ul> |
||||
</div> |
||||
</div> |
||||
</div> |
||||
|
||||
<h2 class="govuk-visually-hidden">Helpful links</h2> |
||||
<ul class="govuk-footer__inline-list govuk-!-margin-top-6 govuk-!-margin-bottom-0"> |
||||
<li class="govuk-footer__inline-list-item"> |
||||
<%= govuk_link_to("Accessibility statement", accessibility_statement_path, class: "govuk-footer__link") %> |
||||
</li> |
||||
<li class="govuk-footer__inline-list-item"> |
||||
<%= govuk_link_to("Privacy notice", privacy_notice_path, class: "govuk-footer__link") %> |
||||
</li> |
||||
<li class="govuk-footer__inline-list-item"> |
||||
<%= govuk_link_to("View source code", "https://github.com/communitiesuk/submit-social-housing-lettings-and-sales-data", class: "govuk-footer__link") %> |
||||
</li> |
||||
<li class="govuk-footer__inline-list-item"> |
||||
<%= govuk_link_to("Cookies", cookies_path, class: "govuk-footer__link") %> |
||||
</li> |
||||
</ul> |
||||
</div> |
||||
<div class="govuk-footer__meta-item"> |
||||
<a class="govuk-footer__link govuk-footer__copyright-logo govuk-!-margin-bottom-1" href="https://www.nationalarchives.gov.uk/information-management/re-using-public-sector-information/uk-government-licensing-framework/crown-copyright/">© Crown copyright</a> |
||||
<h2 class="govuk-visually-hidden">Helpful links</h2> |
||||
<ul class="govuk-footer__inline-list govuk-!-margin-top-6 govuk-!-margin-bottom-0"> |
||||
<li class="govuk-footer__inline-list-item"> |
||||
<%= govuk_link_to("Accessibility statement", accessibility_statement_path, class: "govuk-footer__link") %> |
||||
</li> |
||||
<li class="govuk-footer__inline-list-item"> |
||||
<%= govuk_link_to("Privacy notice", privacy_notice_path, class: "govuk-footer__link") %> |
||||
</li> |
||||
<li class="govuk-footer__inline-list-item"> |
||||
<%= govuk_link_to("View source code", "https://github.com/communitiesuk/submit-social-housing-lettings-and-sales-data", class: "govuk-footer__link") %> |
||||
</li> |
||||
<li class="govuk-footer__inline-list-item"> |
||||
<%= govuk_link_to("Cookies", cookies_path, class: "govuk-footer__link") %> |
||||
</li> |
||||
</ul> |
||||
</div> |
||||
<div class="govuk-footer__meta-item"> |
||||
<a class="govuk-footer__link govuk-footer__copyright-logo govuk-!-margin-bottom-1" href="https://www.nationalarchives.gov.uk/information-management/re-using-public-sector-information/uk-government-licensing-framework/crown-copyright/">© Crown copyright</a> |
||||
</div> |
||||
</div> |
||||
<% end %> |
||||
<% end %> |
||||
</div> |
||||
</footer> |
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in new issue