# db/migrate/20260301000000_create_sessions.rb
class CreateSessions < ActiveRecord::Migration[7.1]
  def change
    create_table :sessions do |t|
      t.references :user, null: false, foreign_key: true
      t.string :session_id, null: false
      t.string :ip_address
      t.string :user_agent, limit: 1024
      t.string :browser_name
      t.string :os_name
      t.string :device_type
      t.datetime :last_active_at, null: false
      t.datetime :revoked_at

      t.timestamps
    end

    add_index :sessions, :session_id, unique: true
    add_index :sessions, [:user_id, :revoked_at]
  end
end

# Gemfile
gem "browser", "~> 6.0"

# app/models/session.rb
class Session < ApplicationRecord
  belongs_to :user

  scope :active, -> { where(revoked_at: nil) }

  before_create :parse_user_agent

  # Find-or-create a session record for a given session_id.
  # Handles race conditions from concurrent requests.
  def self.track!(user:, session_id:, request:)
    find_or_create_by!(session_id: session_id) do |session|
      session.user = user
      session.ip_address = request.remote_ip
      session.user_agent = request.user_agent&.first(1024)
      session.last_active_at = Time.current
    end
  rescue ActiveRecord::RecordNotUnique
    retries ||= 0
    retry if (retries += 1) < 3
    raise
  end

  # Soft-revoke the session. Does NOT delete the record.
  def revoke!
    update!(revoked_at: Time.current)
  end

  # Update last_active_at, but only if 5+ minutes have passed.
  # Avoids a DB write on every single request.
  def touch_last_active!
    return if last_active_at > 5.minutes.ago

    update_column(:last_active_at, Time.current)
  end

  private

  def parse_user_agent
    return if user_agent.blank?

    client = Browser.new(user_agent)
    self.browser_name = client.name
    self.os_name = client.platform.name
    self.device_type = if client.device.mobile?
      "Mobile"
    elsif client.device.tablet?
      "Tablet"
    else
      "Desktop"
    end
  end
end

# app/models/user.rb
class User < ApplicationRecord
  devise :database_authenticatable, :registerable, :recoverable, :rememberable, :validatable

  has_many :sessions, dependent: :destroy
end

# app/lib/session_manager.rb
module SessionManager
  # Called on sign-in (Warden :set_user or :authentication events).
  # Generates a session_id UUID and creates the Session record.
  def self.on_sign_in(user:, warden:, scope:)
    session_id = warden.session(scope)["session_id"] ||= SecureRandom.uuid
    Session.track!(
      user: user,
      session_id: session_id,
      request: ActionDispatch::Request.new(warden.env)
    )
  rescue ActiveRecord::ActiveRecordError => e
    Rails.logger.error("[SessionManager] on_sign_in failed: #{e.message}")
  end

  # Called on every authenticated request (Warden :fetch event).
  # Checks for revocation, updates last_active_at, or lazy-creates a missing record.
  def self.on_fetch(user:, warden:, scope:)
    session_id = warden.session(scope)["session_id"]
    return unless session_id

    session_record = Session.find_by(session_id: session_id)

    if session_record&.revoked_at?
      force_sign_out(warden: warden, scope: scope)
    elsif session_record
      session_record.touch_last_active!
    else
      # Lazy-create: session_id exists in cookie but DB record is missing
      Session.track!(
        user: user,
        session_id: session_id,
        request: ActionDispatch::Request.new(warden.env)
      )
    end
  rescue ActiveRecord::ActiveRecordError => e
    Rails.logger.error("[SessionManager] on_fetch failed: #{e.message}")
  end

  # Called on sign-out (Warden before_logout hook).
  # Soft-revokes the session record.
  def self.on_logout(warden:, scope:)
    # Skip if this logout was triggered by our own force_sign_out
    # (the session is already revoked in that case)
    return if warden.env["app.revoking_session"]

    # IMPORTANT: Access the raw Rack session directly. Do NOT call
    # warden.session(scope) here — see "The on_logout footgun" below.
    scoped_session = warden.raw_session["warden.user.#{scope}.session"]
    session_id = scoped_session&.dig("session_id")
    return unless session_id

    session_record = Session.find_by(session_id: session_id)
    session_record&.revoke! unless session_record&.revoked_at?
  rescue ActiveRecord::ActiveRecordError => e
    Rails.logger.error("[SessionManager] on_logout failed: #{e.message}")
  end

  # Force sign-out for a revoked session. Sets a flag to prevent
  # the before_logout hook from double-revoking.
  def self.force_sign_out(warden:, scope:)
    warden.env["app.revoking_session"] = true
    proxy = Devise::Hooks::Proxy.new(warden)
    proxy.sign_out(scope)
    throw :warden, scope: scope, message: :revoked_session
  end
  private_class_method :force_sign_out
end

# CORRECT — ActionDispatch::Request has #remote_ip
request = ActionDispatch::Request.new(warden.env)
request.remote_ip # => "192.168.1.1"

# WRONG — Rack::Request does NOT have #remote_ip
warden.request.remote_ip # => NoMethodError

# CORRECT — reads raw Rack session, no Warden side effects
scoped_session = warden.raw_session["warden.user.#{scope}.session"]
session_id = scoped_session&.dig("session_id")

# WRONG — re-populates @users[scope], breaks subsequent sign_in
session_id = warden.session(scope)&.dig("session_id")

# config/initializers/warden_hooks.rb
Warden::Manager.after_set_user do |user, warden, opts|
  scope = opts[:scope]

  # Sign-in events: create a session record
  if scope == :user && [:set_user, :authentication].include?(opts[:event])
    SessionManager.on_sign_in(user: user, warden: warden, scope: scope)
  end

  # Fetch events (every authenticated request): check revocation, update activity
  if scope == :user && opts[:event] == :fetch
    SessionManager.on_fetch(user: user, warden: warden, scope: scope)
  end
end

Warden::Manager.before_logout do |_user, warden, opts|
  if opts[:scope] == :user
    SessionManager.on_logout(warden: warden, scope: opts[:scope])
  end
end

# app/controllers/sessions_controller.rb
class SessionsController < ApplicationController
  before_action :authenticate_user!

  def index
    @sessions = current_user.sessions.active.order(last_active_at: :desc)
    @current_session_id = request.env["warden"].session(:user)["session_id"]
  end

  def destroy
    session_record = current_user.sessions.find(params[:id])
    session_record.revoke!
    redirect_to sessions_path, notice: "Session revoked."
  end
end

# config/routes.rb
resources :sessions, only: [:index, :destroy]

# test/factories/sessions.rb
FactoryBot.define do
  factory :session do
    association :user
    session_id { SecureRandom.uuid }
    ip_address { "127.0.0.1" }
    user_agent { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" }
    browser_name { "Chrome" }
    os_name { "macOS" }
    device_type { "Desktop" }
    last_active_at { Time.current }

    trait :mobile do
      user_agent { "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" }
      browser_name { "Safari" }
      os_name { "iOS" }
      device_type { "Mobile" }
    end

    trait :revoked do
      revoked_at { Time.current }
    end
  end
end

# test/models/session_test.rb
require "test_helper"

class SessionTest < ActiveSupport::TestCase
  setup do
    @user = create(:user)
  end

  test ".track! creates a new session record" do
    request = OpenStruct.new(remote_ip: "192.168.1.1", user_agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36")
    session_id = SecureRandom.uuid

    assert_difference "Session.count", 1 do
      session = Session.track!(user: @user, session_id: session_id, request: request)
      assert_equal @user, session.user
      assert_equal session_id, session.session_id
      assert_equal "192.168.1.1", session.ip_address
      assert_not_nil session.last_active_at
    end
  end

  test ".track! does not duplicate sessions with the same session_id" do
    request = OpenStruct.new(remote_ip: "192.168.1.1", user_agent: "Mozilla/5.0")
    session_id = SecureRandom.uuid

    Session.track!(user: @user, session_id: session_id, request: request)

    assert_no_difference "Session.count" do
      Session.track!(user: @user, session_id: session_id, request: request)
    end
  end

  test ".track! parses user agent on create" do
    request = OpenStruct.new(
      remote_ip: "10.0.0.1",
      user_agent: "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"
    )

    session = Session.track!(user: @user, session_id: SecureRandom.uuid, request: request)

    assert_equal "Safari", session.browser_name
    assert_includes session.os_name, "iOS"
    assert_equal "Mobile", session.device_type
  end

  test "#revoke! sets revoked_at timestamp" do
    session = create(:session, user: @user)
    assert_nil session.revoked_at

    session.revoke!

    assert_not_nil session.reload.revoked_at
  end

  test "#touch_last_active! updates when stale (>5 minutes)" do
    session = create(:session, user: @user, last_active_at: 10.minutes.ago)
    original_time = session.last_active_at

    session.touch_last_active!

    assert session.reload.last_active_at > original_time
  end

  test "#touch_last_active! does NOT update when recent (<5 minutes)" do
    session = create(:session, user: @user, last_active_at: 2.minutes.ago)
    original_time = session.last_active_at

    session.touch_last_active!

    assert_equal original_time, session.reload.last_active_at
  end

  test ".active scope returns only non-revoked sessions" do
    active = create(:session, user: @user)
    _revoked = create(:session, :revoked, user: @user)

    results = @user.sessions.active
    assert_includes results, active
    assert_equal 1, results.count
  end
end

# test/integration/warden_hooks_test.rb
require "test_helper"

class WardenHooksTest < ActionDispatch::IntegrationTest
  include Devise::Test::IntegrationHelpers

  setup do
    @user = create(:user)
  end

  test "sign-in creates a Session record" do
    assert_difference "Session.count", 1 do
      sign_in @user
      get root_path
    end

    session_record = @user.sessions.last
    assert_not_nil session_record
    assert_nil session_record.revoked_at
  end

  test "multiple requests do not create duplicate sessions" do
    sign_in @user
    get root_path

    assert_no_difference "Session.count" do
      get root_path
    end
  end

  test "sign-out soft-revokes the session (sets revoked_at, does NOT delete)" do
    sign_in @user
    get root_path
    session_record = @user.sessions.last

    assert_nil session_record.revoked_at

    delete destroy_user_session_path

    assert_not_nil session_record.reload.revoked_at
    # Record still exists (soft delete)
    assert_equal 1, Session.count
  end

  test "revoked session forces sign-out on next request" do
    sign_in @user
    get root_path

    # Simulate revoking from another device
    @user.sessions.last.revoke!

    # Next request detects revocation and force-signs-out
    get root_path

    # Subsequent request redirects to sign-in
    get root_path
    assert_redirected_to new_user_session_path
  end

  test "touch_last_active! updates on fetch when stale" do
    sign_in @user
    get root_path

    session_record = @user.sessions.last
    session_record.update_column(:last_active_at, 10.minutes.ago)
    old_time = session_record.last_active_at

    get root_path

    assert session_record.reload.last_active_at > old_time
  end

  test "lazy-creates a Session when session_id exists but DB record is missing" do
    sign_in @user
    get root_path

    # Delete the record but keep the session_id in the cookie
    @user.sessions.delete_all

    assert_difference "Session.count", 1 do
      get root_path
    end
  end
end

def sign_in_programmatically(user)
  bypass_sign_in(user, scope: :user)
  warden.set_user(user, scope: :user, run_callbacks: false)

  # Hooks are skipped, so manually track the session:
  session_id = warden.session(:user)["session_id"] ||= SecureRandom.uuid
  Session.track!(user: user, session_id: session_id, request: request)
end

# app/models/user.rb
class User < ApplicationRecord
  generates_token_for :native_oauth, expires_in: 2.minutes
end

# app/controllers/hotwire_native/oauth_controller.rb
class HotwireNative::OauthController < ApplicationController
  skip_before_action :authenticate_user!
  layout false

  def start
    session[:native_oauth] = true
    cookies[:native_oauth] = {
      value: "1", expires: 5.minutes.from_now,
      same_site: :none, secure: true
    }
    @provider = params[:provider]
    @user_token = params[:user_token]
    return if @user_token.blank?

    # Signed cookie backup for social linking — survives cross-origin POST
    cookies.signed[:native_oauth_user_token] = {
      value: @user_token, expires: 5.minutes.from_now,
      same_site: :none, secure: true
    }
  end
end

# app/controllers/hotwire_native/sign_in_controller.rb
class HotwireNative::SignInController < ApplicationController
  skip_before_action :authenticate_user!
  skip_before_action :require_onboarding

  def show
    user = User.find_by_token_for(:native_oauth, params[:token])

    unless user
      redirect_to new_user_session_path, alert: I18n.t("devise.omniauth_callbacks.failure")
      return
    end

    sign_in(user)
    redirect_to "/reset_app"
  end
end

# config/routes/hotwire_native.rb
namespace :hotwire_native do
  get "sign_in", to: "sign_in#show"
end

# Outside the namespace — the URL must start with /auth/ for the path config rule
get "auth/native/:provider", to: "hotwire_native/oauth#start", as: :native_oauth_start

NATIVE_URL_SCHEME = "yourapp" # or read from config

def handle_auth_provider(kind, auth_payload)
  if native_oauth_request?
    user = User.from_omniauth(auth_payload) # Your existing find-or-create logic
    if user.persisted?
      token = user.generate_token_for(:native_oauth)
      redirect_to "#{NATIVE_URL_SCHEME}://callback?token=#{token}",
                  allow_other_host: true
    else
      redirect_to new_user_registration_url, alert: user.errors.full_messages.join("\n")
    end
    return
  end

  # ... existing web sign-in flow
end

private

# Three detection paths are needed because OAuth callbacks arrive differently:
# 1. omniauth.params "native" — GET-based providers that preserve query params (e.g. Google)
# 2. session[:native_oauth]    — set on the trampoline page before the POST to OmniAuth
# 3. SameSite=None cookie      — survives Apple's cross-origin POST callback where
#                                  the session cookie (SameSite=Lax) is dropped
def native_oauth_request?
  request.env.dig("omniauth.params", "native") == "ios" ||
    session.delete(:native_oauth) ||
    cookies.delete(:native_oauth) == "1"
end

# app/helpers/application_helper.rb
def oauth_button(provider, **options, &)
  if hotwire_native_app?
    token = user_signed_in? ? current_user.generate_token_for(:native_oauth) : nil
    path_params = token ? { user_token: token } : {}
    link_to(native_oauth_start_path(provider, **path_params),
            class: options[:class],
            data: { turbo_frame: "_top" },
            &)
  else
    button_to("/auth/#{provider}",
              class: options[:class],
              data: { turbo: false },
              &)
  end
end

def handle_social_provider(kind, auth_payload)
  if native_oauth_request?
    # Try omniauth params first, fall back to signed cookie backup
    user_token = request.env.dig("omniauth.params", "user_token") || cookies.signed[:native_oauth_user_token]
    cookies.delete(:native_oauth_user_token)
    user = User.find_by_token_for(:native_oauth, user_token) if user_token.present?
    unless user
      redirect_to "#{NATIVE_URL_SCHEME}://callback?error=unauthenticated", allow_other_host: true
      return
    end

    social_account = SocialAccount.create_or_update_from_omniauth(auth_payload, user)
    if social_account.persisted?
      redirect_to "#{NATIVE_URL_SCHEME}://callback?social=linked", allow_other_host: true
    else
      redirect_to "#{NATIVE_URL_SCHEME}://callback?error=link_failed", allow_other_host: true
    end
    return
  end

  # ... existing web flow
end

# config/routes.rb
authenticate :user, ->(user) { user.admin? || Rails.env.development? } do
  mount Flipper::UI.app(Flipper) => "/feature_flags"
end

# config/initializers/flipper.rb

# Add User and Organization "actors"
Flipper.register(:users) { |actor| actor.value.start_with?("User:") }
Flipper.register(:organizations) { |actor| actor.value.start_with?("Organization:") }

# Clean up flipper UI
Flipper::UI.configure do |config|
  config.fun = false
  config.cloud_recommendation = false
  config.show_feature_description_in_list = true
end

Flipper[:search].enable
Flipper[:search].enabled?
Flipper[:search].disable

Flipper.enable(:search, User.first)
Flipper.enabled?(:search, current_user)
Flipper[:search].enabled?(current_user)

Flipper.enabled?(:search, Current.organization)

# Gemfile
gem "devise"
gem "devise_masquerade"

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
    before_action :authenticate_user!
    before_action :masquerade_user!
end

# config/routes.rb
devise_for :users, controllers: {
  masquerades: "users/masquerades"
}

# app/controllers/users/masquerades_controller.rb
class Users::MasqueradesController < Devise::MasqueradesController
  before_action :authorize_admin, except: :back

  protected

  def authorize_admin
    redirect_to root_path unless current_user.admin?
  end

  def after_back_masquerade_path_for(_resource)
    # your admin path
    Avo.configuration.root_path
  end
end

User.all.each do |user|
  link_to "Login as", masquerade_path(user)
end

# app/views/application.html.erb
<% if user_masquerade? %>
  <%= link_to t("devise.masquerade.back"), back_masquerade_path(current_user) %>
<% end %>

# app/helpers/application_helper.rb
module ApplicationHelper

  def avo_masquerade_path(resource, *args)
    scope = Devise::Mapping.find_scope!(resource)

    opts = args.shift || {}
    opts[:masqueraded_resource_class] = resource.class.name

    opts[Devise.masquerade_param] = resource.masquerade_key

    Rails.application.routes.url_helpers.send(:"#{scope}_masquerade_index_path", opts, *args)
  end
end

# app/avo/resources/user.rb
class Avo::Resources::User < Avo::BaseResource
  def fields
    field :login_as, as: :text, as_html: true do
      unless record.id == current_user.id
        link_to "Login as", helpers.avo_masquerade_path(record)
      end
    end
  end
end

# config/initializers/devise_masquerade_engine_patch.rb

# Patch for DeviseMasquerade::Controllers::UrlHelpers
#
# Problem:
# - Devise Masquerade defines `_masquerade_index_path` helpers dynamically based on scope.
# - These helpers are only registered in the main application's routes.
# - When called from within an engine (e.g. Avo), these helpers may not be found, raising errors.
#
# Solution:
# - This patch intercepts missing `_masquerade_index_path` method calls.
# - If missing, it forwards them to the main application's route helpers.
# - This ensures compatibility with engines that rely on these routes indirectly.

module DeviseMasquerade
  module Controllers
    module UrlHelpers
      def method_missing(method_name, *args, &block)
        if method_name.to_s.end_with?("_masquerade_index_path")
          ::Rails.application.routes.url_helpers.send(method_name, *args, &block)
        else
          super
        end
      end

      def respond_to_missing?(method_name, include_private = false)
        if method_name.to_s.end_with?("_masquerade_index_path")
          ::Rails.application.routes.url_helpers.respond_to?(method_name)
        else
          super
        end
      end
    end
  end
end

# Gemfile
# pg extension to enable vectors
# https://github.com/pgvector/pgvector-ruby
gem "pgvector"
# vector search
# https://github.com/ankane/neighbor
gem "neighbor"
# create vectors
# https://github.com/crmne/ruby_llm
gem "ruby_llm"

# config/initializers/neighbor.rb
Neighbor::PostgreSQL.initialize!

rails g migration InstallNeighborVector
rails g migration AddEmbeddingToDocuments
rails g model Document title content

class InstallNeighborVector < ActiveRecord::Migration[7.1]
  def change
    enable_extension "vector"
  end
end

class AddEmbeddingToDocuments < ActiveRecord::Migration[7.1]
  def change
    add_column :documents, :embedding, :vector, limit: 1536, if_not_exists: true
  end
end

# app/models/document.rb
  self.filter_attributes += [:embedding]

  validates :title, presence: true
  validates :content, presence: true

  has_neighbors :embedding, dimensions: 1536
  before_save :generate_embedding, if: -> { saved_change_to_title? || saved_change_to_content? }

  scope :search_by_similarity, -> (query_text) {
    query_embedding = RubyLLM.embed(query_text).vectors

    # distance: :inner_product
    nearest_neighbors(:embedding, query_embedding, distance: :cosine).first(5)
  }

  # def text_for_embedding
  #   <<~EOS
  #     Title: #{title}
  #     Content: #{content}
  #   EOS
  # end

  def generate_embedding
    text_for_embedding = [
      "Title: #{title}",
      "Content: #{content}",
    ].compact.join("\n---\n")

    begin
      self.embedding = RubyLLM.embed(text_for_embedding).vectors
    rescue RubyLLM::Error => e
    end
  end

Document.create(content: "Company HR policy: Employees must...")
Document.create(content: "Company internal documentation: ...")

documents = Document.search_by_similarity("What is the company's remote work policy?")
documents.each { |document| puts "- #{document.content}" }

# app/controllers/documents_controller.rb
def index
  @documents = if params[:q].present?
    Document.all.search_by_similarity(params[:q])
  else
    Document.all
  end
end

# config/initializers/omniauth.rb
require "omniauth"
require "omniauth-google-oauth2"

module OmniAuth
  module Strategies
    class Youtube < OmniAuth::Strategies::GoogleOauth2
      option :name, "youtube"

      def initialize(app, *args, &block)
        super
        options.scope = "email,profile,https://www.googleapis.com/auth/youtube.readonly"
        # For write access, use:
        # options.scope = "email,profile,https://www.googleapis.com/auth/youtube.force-ssl,https://www.googleapis.com/auth/youtube.readonly"

        # Use the same redirect URI as Google OAuth2
        # options.redirect_uri = "http://localhost:3000/users/auth/youtube/callback"
        # options.redirect_uri = "http://localhost:3000/users/auth/google_oauth2/callback"
        # options.redirect_uri = "https://contentprize.com/users/auth/youtube/callback"
      end
    end
  end
end

# config/initializers/devise.rb
  config.omniauth :google_oauth2,
                  Rails.application.credentials.dig(:google_oauth2, :key),
                  Rails.application.credentials.dig(:google_oauth2, :secret),
                  scope: "email,profile"

  # Add YouTube as a separate provider using the same Google credentials
  config.omniauth :youtube,
                  Rails.application.credentials.dig(:google_oauth2, :key),
                  Rails.application.credentials.dig(:google_oauth2, :secret)

# app/models/user.rb
class User < ApplicationRecord
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :validatable,
         :omniauthable, omniauth_providers: Devise.omniauth_configs.keys
end

# app/controllers/users/omniauth_callbacks_controller.rb
class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
  Devise.omniauth_configs.keys.each do |provider|
    define_method provider do
      handle_auth provider
    end
  end

  def failure
    redirect_to new_user_registration_url, alert: "Something went wrong. Try again."
  end

  private

  def handle_auth(kind)
    auth_payload = request.env["omniauth.auth"]

    # TODO: Handle logic for User oAuth
    user = User.from_omniauth(auth_payload)

    if user.persisted?
      flash[:notice] = "Successfully authenticated with #{kind.titleize}!"
      sign_in_and_redirect user, event: :authentication
    else
      redirect_to new_user_registration_url, alert: user.errors.full_messages.join("\n")
    end
  end
end

# Gemfile
gem "omniauth-google-oauth2"
gem "omniauth-rails_csrf_protection" # for omniauth 2.0

# config/initializers/devise.rb
  config.omniauth :google_oauth2, Rails.application.credentials.dig(:google_oauth2, :key),
                  Rails.application.credentials.dig(:google_oauth2, :secret)

# app/models/user.rb
class User < ApplicationRecord
  devise :invitable, :database_authenticatable,
    :rememberable, :validatable,
    :omniauthable, omniauth_providers: [ :google_oauth2 ]
end

# app/models/user.rb
  def from_omniauth(auth_payload)
    data = auth_payload.info
    user = User.where(email: data["email"]).first_or_initialize do |user|
      user.email = data["email"]
      user.password = Devise.friendly_token[0, 20] if user.password.blank?
    end

    user.name = auth_payload.info.name
    user.image = auth_payload.info.image
    user.provider = auth_payload.provider
    user.uid = auth_payload.uid
    user.save
    user
  end

# app/controllers/users/omniauth_callbacks_controller.rb
class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
  def google_oauth2
    handle_auth "Google"
  end

  def handle_auth(kind)
    user = User.from_omniauth(request.env["omniauth.auth"])
    if user.persisted?
      flash[:notice] = I18n.t "devise.omniauth_callbacks.success", kind: kind
      sign_in_and_redirect user, event: :authentication
    else
      session["devise.auth_data"] = request.env["omniauth.auth"].except(:extra)
      redirect_to root_path, alert: user.errors.full_messages.join("\n")
    end
  end

  def failure
    redirect_to root_path, alert: "Failure. Please try again"
  end
end

<%= button_to "Sign in with Google", "/users/auth/google_oauth2", method: :post, data: { turbo: "false" } %>

# Gemfile
gem "jwt"

# app/controllers/users/omniauth_callbacks_controller.rb
class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
  skip_before_action :verify_authenticity_token, only: :google_onetap

  def google_onetap
    unless g_csrf_token_valid?
      redirect_to root_path, alert: "Failure. Please try again"
      return
    end

    payload = verify_google_id_token(params[:credential])
    user = User.from_google_onetap(payload)

    if user.persisted?
      flash[:notice] = I18n.t "devise.omniauth_callbacks.success", kind: "Google"
      sign_in_and_redirect user, event: :authentication
    else
      redirect_to root_path, alert: user.errors.full_messages.join("\n")
    end
  rescue JWT::DecodeError
    redirect_to root_path, alert: "Failure. Please try again"
  end

  private

  GOOGLE_CERTS_URL = "https://www.googleapis.com/oauth2/v3/certs"
  GOOGLE_ISSUERS = %w[accounts.google.com https://accounts.google.com].freeze

  def g_csrf_token_valid?
    token = cookies["g_csrf_token"]
    token.present? && token == params["g_csrf_token"]
  end

  def verify_google_id_token(token)
    jwks = fetch_google_jwks
    client_id = Rails.application.credentials.dig(:google_oauth2, :key)

    payload, = JWT.decode(token, nil, true, {
      algorithms: ["RS256"],
      jwks: jwks,
      iss: GOOGLE_ISSUERS,
      verify_iss: true,
      aud: client_id,
      verify_aud: true
    })

    payload
  end

  def fetch_google_jwks
    Rails.cache.fetch("google_jwks", expires_in: 1.hour) do
      uri = URI(GOOGLE_CERTS_URL)
      http = Net::HTTP.new(uri.host, uri.port)
      http.use_ssl = true
      http.open_timeout = 5
      http.read_timeout = 5
      response = http.get(uri.path)
      JSON.parse(response.body)
    end
  end
end

# app/models/user.rb
def from_google_onetap(payload)
  user = User.where(email: payload["email"]).first_or_initialize do |user|
    user.email = payload["email"]
    user.password = Devise.friendly_token[0, 20] if user.password.blank?
  end

  user.name = payload["name"]
  user.image = payload["picture"]
  user.provider = "google_oauth2"
  user.uid = payload["sub"]
  user.save
  user
end

# app/models/platform.rb
class Platform < ActiveHash::Base
  include ActiveHash::Associations

  self.data = YAML.load_file("#{Rails.root}/config/models/platforms.yml")

  has_many :campaign_platforms, dependent: :restrict_with_error
  # has_many :campaign_platforms, dependent: :restrict_with_error, class_name: "Platform", foreign_key: :platform_id
  has_many :campaigns, through: :campaign_platforms

  def label_string
    name
  end

  scope :active, -> { where(status: :active) }
end

  add_column :campaign_platforms, :platform_id, :string, null: false
  add_index :campaign_platforms, :platform_id

# app/models/campaign_platform.rb
class CampaignPlatform < ApplicationRecord
  extend ActiveHash::Associations::ActiveRecordExtensions
  belongs_to :campaign
  belongs_to :platform, class_name: "Platform", foreign_key: "platform_id"
end

# app/models/campaign.rb
class Campaign < ApplicationRecord
  extend ActiveHash::Associations::ActiveRecordExtensions
  has_many :campaign_platforms, dependent: :destroy
  has_many :platforms, through: :campaign_platforms

# config/application.rb
  config.mission_control.jobs.http_basic_auth_enabled = false

# config/routes.rb
  mount MissionControl::Jobs::Engine, at: "/jobs"

<%= form.text_field :name,
                    data: { controller: "autonumeric",
                            autonumeric_currency_value: "€",
                            autonumeric_min_value: 0, autonumeric_max_value: 999999.99 },
                    class: "" %>

button_to "Delete", my_path, method: :delete, data: { turbo_confirm: "Are you sure?" }

# config/importmap.rb
pin "confirm", to: "confirm.js"

# Gemfile
gem "avo", ">= 3.4.1"
gem "pundit"
group :avo, optional: true do
  source "https://packager.dev/avo-hq/" do
    gem "avo-pro"
  end
end
group :development, :test do
  gem "dotenv"
end

# config/initializers/avo.rb
Avo.configure do |config|
  config.license_key = ENV["AVO_LICENSE_KEY"]
end

unless defined?(Avo::Pro)
  Rails.autoloaders.main.ignore(Rails.root.join("app/avo/cards"))
  Rails.autoloaders.main.ignore(Rails.root.join("app/avo/dashboards"))
end

  def index
    cookies[:seed] ||= SecureRandom.random_number
    @posts = Post.order(Arel.sql("random()")).from("(SELECT setseed(#{cookies[:seed]})) as seed_setup, posts")
    @pagy, @posts = pagy_countless(@posts, items: 24)
  end

# config/initializers/typesense.rb
TYPESENSE_CLIENT = Typesense::Client.new(
  nodes: [{
    host: ENV.fetch('TYPESENSE_HOST', 'localhost'),
    port: ENV.fetch('TYPESENSE_PORT', '8108'),
    protocol: ENV.fetch('TYPESENSE_PROTOCOL', 'http')
  }],
  api_key: ENV.fetch('TYPESENSE_API_KEY', 'xyz'),
  connection_timeout_seconds: 2
)

# app/services/typesense_service.rb
class TypesenseService
  class << self
    # create an empty "table" of posts in typesense with attributes "title", "body", "created_at"
    # TypesenseService.create_schema
    def create_schema
      TYPESENSE_CLIENT.collections.create({
                                            name: 'posts',
                                            fields: [
                                              { name: 'title', type: 'string' },
                                              { name: 'body', type: 'string' },
                                              { name: 'created_at', type: 'int64' }
                                            ],
                                            default_sorting_field: 'created_at'
                                          })
    end

    # get info about the current state of the posts "table"
    def get_schema
      TYPESENSE_CLIENT.collections['posts'].retrieve
    end

    # drop "posts" table from typesense
    def delete_schema
      TYPESENSE_CLIENT.collections['posts'].delete
    end

    # dump all indexed posts data as a text blob
    def export_documents
      TYPESENSE_CLIENT.collections['posts'].documents.export
    end

    # find an indexed post by id
    def retrieve_document(id)
      TYPESENSE_CLIENT.collections['posts'].documents[id.to_s].retrieve
    end

    # see how many posts are actually indexed
    def documents_count
      search_posts('')['out_of']
    end

    # CREATE - use in Active Record callback
    def index_post(post)
      TYPESENSE_CLIENT.collections['posts'].documents.create({
                                                               id: post.id.to_s,
                                                               title: post.title || '',
                                                               body: post.body || '',
                                                               created_at: post.created_at.to_i
                                                             })
    end

    # UPDATE - use in Active Record callback
    def update_post(post)
      TYPESENSE_CLIENT.collections['posts'].documents[post.id.to_s].update({
                                                                             title: post.title || '',
                                                                             body: post.body || '',
                                                                             created_at: post.created_at.to_i
                                                                           })
    end

    # DESTROY - use in Active Record callback
    def delete_post(post_id)
      TYPESENSE_CLIENT.collections['posts'].documents[post_id.to_s].delete
    end

    # Make an API call to search posts in the typesense index
    def search_posts(query, options = {})
      search_parameters = {
        q: query,
        query_by: 'title,body',
        sort_by: 'created_at:desc',
        per_page: options[:per_page] || 10,
        page: options[:page] || 1
      }

      TYPESENSE_CLIENT.collections['posts'].documents.search(search_parameters)
    end
  end
end

# lib/tasks/typesense.rake

# rails typesense:setup
namespace :typesense do
  desc 'Create Typesense schema and index all posts'
  task setup: :environment do
    TypesenseService.create_schema
    Post.find_each do |post|
      TypesenseService.index_post(post)
    end
  end
end

# rails c
result = TypesenseService.search_posts("hotwir")
# or
result = TypesenseService.search_posts("hotwir", per_page: 5, page: 2)

# app/models/post.rb
 after_create_commit do
    TypesenseService.index_post(self)
  end

  after_update_commit do
    TypesenseService.update_post(self)
  end

  after_destroy_commit do
    TypesenseService.delete_post(id)
  end

# config/routes.rb
resources :posts do
  collection do
    get :search
  end
end

# app/controllers/posts_controller.rb
  def search
    results = if params[:query].present?
                TypesenseService.search_posts(
                  params[:query],
                  page: params[:page],
                  per_page: params[:per_page] || 10
                )
              else
                { 'hits' => [] }
              end

    @posts = results['hits'].map do |hit|
      {
        id: hit['document']['id'],
        title: hit['document']['title'],
        description: hit['document']['description'],
        highlight: hit['highlights']
      }
    end
    respond_to do |format|
      format.json { render json: @posts }
      format.html
    end
  end

# app/views/posts/search.html.erb
<%= form_with url: search_posts_path, method: :get, data: { turbo_frame: :results} do |f| %>
  <%= f.text_field :query, value: params[:query], autofocus: true, autocomplete: 'off', autocorrect: 'off', oninput: "this.form.requestSubmit()" %>
  <%= f.submit %>
<% end %>

<br>

<%= turbo_frame_tag :results, target: "_top", data: { turbo_action: "advance" } do %>
  <% if @posts.any? %>
    <% @posts.each do |result| %>
      <%= render "search_result", result: %>
    <% end %>
  <% elsif params[:query].present? %>
    No results found for "<%= params[:query] %>"
  <% end %>
<% end %>

# app/views/posts/_search_result.html.erb
<%= link_to post_path(result[:id]) do %>
  <h3>
    <% if result[:highlight]&.find { |h| h["field"] == "title" } %>
      <%= sanitize result[:highlight].find { |h| h["field"] == "title" }["snippet"] %>
    <% else %>
      <%= result[:title] %>
    <% end %>
  </h3>

  <% if result[:description].present? %>
    <p><%= result[:description] %></p>
  <% end %>

  <% if result[:highlight]&.find { |h| h["field"] == "body" } %>
    <div>
      <%= sanitize result[:highlight].find { |h| h["field"] == "body" }["snippet"] %>
    </div>
  <% end %>
<% end %>