impress/config/environments/development.rb

require "active_support/core_ext/integer/time"

Rails.application.configure do
  # Settings specified here will take precedence over those in config/application.rb.

  # Make code changes take effect immediately without server restart.
  config.enable_reloading = true

  # Do not eager load code on boot.
  config.eager_load = false

  # Show full error reports.
  config.consider_all_requests_local = true

  # Enable server timing.
  config.server_timing = true

  # Enable/disable Action Controller caching. By default Action Controller caching is disabled.
  # Run rails dev:cache to toggle Action Controller caching.
  if Rails.root.join("tmp/caching-dev.txt").exist?
    config.action_controller.perform_caching = true
    config.action_controller.enable_fragment_cache_logging = true

    config.public_file_server.headers = { "cache-control" => "public, max-age=#{2.days.to_i}" }
  else
    config.action_controller.perform_caching = false
  end

  # Change to :null_store to avoid any caching.
  config.cache_store = :memory_store

  # Don't care if the mailer can't send.
  config.action_mailer.raise_delivery_errors = false

  # Use the letter_opener gem to output emails to the console.
  config.action_mailer.delivery_method = :letter_opener

  # Make template changes take effect immediately.
  config.action_mailer.perform_caching = false

  # Set localhost to be used by links generated in mailer templates.
  config.action_mailer.default_url_options = {host: "localhost", port: 3000}

  # Print deprecation notices to the Rails logger.
  config.active_support.deprecation = :log

  # Raise an error on page load if there are pending migrations.
  config.active_record.migration_error = :page_load

  # Highlight code that triggered database queries in logs.
  config.active_record.verbose_query_logs = true

  # Append comments with runtime information tags to SQL queries in logs.
  config.active_record.query_log_tags_enabled = true

  # Highlight code that enqueued background job in logs.
  config.active_job.verbose_enqueue_logs = true

  config.react.variant = :development

  # Raises error for missing translations.
  # config.i18n.raise_on_missing_translations = true

  # Annotate rendered view with file names.
  config.action_view.annotate_rendered_view_with_filenames = true

  # Raise error when a before_action's only/except options reference missing actions.
  config.action_controller.raise_on_missing_callback_actions = true

  # Apply autocorrection by RuboCop to files generated by `bin/rails generate`.
  # config.generators.apply_rubocop_autocorrect_after_generate!

  # Don't use the assets precompiled for production; recompile live instead.
  # HACK: We do this by just telling it that dev assets belong in a special
  # folder, so if you run precompile in development it'll look there instead,
  # as recommended by the Rails guide. But I don't actually use that irl!
  # https://guides.rubyonrails.org/v7.0.7/asset_pipeline.html#local-precompilation
  config.assets.prefix = "/dev-assets"

  # Fix file reloading in a Vagrant environment.
  # The `ActiveSupport::EventedFileUpdateChecker` is faster, but doesn't work
  # correctly for Vagrant's networked folders!
  # https://stackoverflow.com/a/36616931
  #
  # TODO: In the future, if we don't expect the use of Vagrant or similar tech
  # anymore, we could remove this for a minor dev perf improvement. We're on
  # Vagrant now because it's hard to get older Ruby running on many modern
  # systems, but later on that could change!
  #
  # NOTE: But I also see that this might be the default anyway in current
  # Rails? idk when that changed... so maybe just delete this later?
  config.file_watcher = ActiveSupport::FileUpdateChecker

  # Allow connections on Vagrant's private network.
  config.web_console.permissions = '10.0.2.2'

  # Allow pets to model new data. (If modeling is ever broken, disable this in
  # production while we fix it!)
  config.modeling_enabled = true

  # Use a local copy of Impress 2020, presumably running on port 4000. (Can
  # override this with the IMPRESS_2020_ORIGIN environment variable!)
  config.impress_2020_origin = ENV.fetch("IMPRESS_2020_ORIGIN",
    "http://localhost:4000")

  # Save the Neopets Media Archive in the local `tmp` folder. (In production,
  # we keep this in a long-term location instead!)
  config.neopets_media_archive_root = Rails.root / "tmp" /
    "neopets_media_archive" / "development"

  # When developing the `public_data:commit` command, save to the local `tmp`
  # folder. (In production, we keep this in a long-term location instead!)
  config.public_data_root = Rails.root / "tmp" / "public_data"

  # Use the local NeoPass development server.
  config.neopass_origin = "https://localhost:8585"

  # Set the NeoPass redirect callback URL.
  config.neopass_redirect_uri =
    "http://localhost:3000/users/auth/neopass/callback"

  # If the "USE_LIVE_NEOPASS=1" environment variable is set, override the
  # NeoPass config with the production values instead.
  #
  # Note that this does *not* allow you to just use NeoPass with the
  # development server as one might like! Our `localhost:3000` redirect URL is
  # not registered with live NeoPass, so we have to provide the production
  # callback, or else NeoPass will reject the initial auth request altogether!
  #
  # Instead, you'll need to somehow intercept the flow:
  #     1. Dress to Impress (development) sends you to NeoPass, with production
  #        configuration in the request.
  #     2. NeoPass redirects back to Dress to Impress (production).
  #     3. Use some kind of tool to prevent the above redirect, and rewrite it
  #        to `localhost:3000` instead.
  #        - For me, it's convenient to do this via the Burp Suite's "Proxy"
  #          tool: intercept the request, cancel it, and manually rewrite the
  #          URL and navigate to it.
  #        - Another way I've used for similar things in the past is to edit my
  #          /etc/hosts file to temporarily point `impress.openneo.net` to
  #          `127.0.0.1`. Then, when the request fails, manually rewrite the
  #          URL and navigate to it.
  #        - I suppose you could also have your browser's Network panel persist
  #          logs, then you can see the `/users/auth/neopass/callback` request
  #          that fails and redirects back to the production sign-in page, and
  #          manually rewrite it? (The request should be safe to let through,
  #          because production DTI will reject the callback, because it knows
  #          from the `state` parameter that it didn't initiate this flow.)
  if ENV["USE_LIVE_NEOPASS"].present?
    puts "Using live NeoPass, instead of the development server."
    config.neopass_origin = "https://oidc.neopets.com"
    config.neopass_redirect_uri =
      "https://impress.openneo.net/users/auth/neopass/callback"
  end
end