Expected Behavior

Should inform project collaborators of potential security issues (example: xss, sql injection)

Actual Behavior

Does not inform of security problems

Steps to Recreate

Create a PR to cause CI spec run

brakeman

Expected Behavior

We can run bundle exec guard and have the the test suite listen for changes to code and automatically run.

Expected Behavior

You cannot send invalid dates to the backend breaking the system with generic 500 error page.

Add a date-picker to make this easier to use and prevent invalid dates.

Actual Behavior

On views like /volunteers/region_admin you can pick dates from a drop-down. There is no validation to check that 6/31 shouldn't be entered and sent to the backend to do log / reporting lookups.

Steps to Recreate

1. Go to a view that has you doing date lookups: (/logs/by_day?utf8=%E2%9C%93&date%5Bd%283i%29%5D=31&date%5Bd%282i%29%5D=6&date%5Bd%281i%29%5D=2017&commit=Go)
2. You'll see an 'invalid date' error.

See https://github.com/collectiveidea/interactor and a5c59b6

• Volunteers#knight (#108)
• Volunteers#reactivate (#109)
• ScheduleChains#update
• ScheduleChains#take
• ScheduleChains#leave
• Logs#take
• Logs#leave
• Absences#create

Expected Behavior

The comment prior to this method states, "weight in db is always lbs, so convert to what the user expects to see (in the units of the scale)". Based on this comment, I would expect this method would convert a weight in pounds to a weight in other units.

Actual Behavior

The method reads as follows:

  def scale_weight
    display_unit = self.log.scale_type.weight_unit
    if display_unit == 'kg'
      self.weight * 2.2
    elsif display_unit == 'st'
      self.weight * 14
    else
      self.weight
    end
  end

This method in fact converts weights in other units (kilograms and stones) to weights in pounds.

Steps to Recreate

The method appears to be faulty on its face.

Suggested Action

It seems one of three things should happen:

1. The method should be deleted. This may be the most appropriate action as it does not appear to be used anywhere in the code.

2. The method should be rewritten to convert pounds to other units of measurement. This would simply require dividing instead of multiplying by the conversion factors.

3. The method should remain functionally unchanged, and the comment should be updated to reflect what the method actually does. This would make sense only if weights in the database are actually stored in other units and we need a method that converts to pounds.

Environment

Screenshots/Screencasts

See PR #64.

• ScheduleChains#show (@ericfreese in progress)
• Volunteers#stats
• Logs#receipt
• Logs#export

Expected Behavior

Expect sign up to allow new user to create account and log in

Actual Behavior

After 'Sign up' link is followed and form is submitted the following error appears in the 'Sign in' box:
translation missing: en.devise.registrations.volunteer.signed_up_but_not_assigned
When attempting to sign in, the following error is thrown:
Your account has not been assigned to a region yet. A region administrator must do this before you can sign in.

Steps to Recreate

Create new account through sign up from root page

Environment

OSX - Sierra, Ruby 2.1.5

Expected Behavior

Data Export at https://robot.boulderfoodrescue.org/logs/export.csv?utf8=%E2%9C%93&start_date%5Bmonth%5D=8&start_date%5Bday%5D=1&start_date%5Byear%5D=2017&stop_date%5Bmonth%5D=9&stop_date%5Bday%5D=27&stop_date%5Byear%5D=2017&commit=Export

does NOT time-out.

Actual Behavior

It times out!

Steps to Recreate

Log in as a super admin or a region admin and select a large data range and try to export. It will work fine locally, but on web server Heroku will kill it after 30 seconds.

Look for N+1 queries and ways to clean up / generate more cleanly.

Currently: When a one time schedule item is created from Schedule > Full Schedule > New Scheduled Route for, the rescue log isn't generated until the scripts run in the afternoon. This causes a problem if the shift is for that day.

Desired Behavior: Rescue Log for a one time item is generated immediately.

Lots of factories have random behavior, which is a recipe for flaky tests. We saw this recently with the spec added in #112. The flaky behavior was traced to a factory that would sometimes add zero associated objects and fixed in #116.

We should update factories one by one to remove all random behavior so that we can depend on stable data for our tests.

Expected Behavior

Actual Behavior

Steps to Recreate

Environment

Screenshots/Screencasts

Here is what the email pickup reminder looks like.

Hi Teresa Curtiss,
Just a quick reminder that you have upcoming shifts:
Fri Jan 20 (1 days from now)
between 8PM and 8:30PM
OU The District Dining Hall to Bishopville Food Pantry, Bishopville Food Pantry
Food Types: Frozen
Info Link
Data Reporting Link
Fri Jan 20 (1 days from now)
between 8PM and 8:30PM
OU The District Dining Hall to Bishopville Food Pantry, Bishopville Food Pantry
Food Types: Frozen
Info Link
Data Reporting Link
Thanks!
chirp beep
--
The Food Rescue Robot
http://robot. boulderfoodrescue.org

Hi,

The current version still on rails 3.2 which is way older.

Please migrate to Rails 5, where it allows to take new features like Turbolinks for mobile app development.

Kiran.

At a recent outreach meeting a bunch of people wanted support for pair-pickups. The idea would be that one or two people could sign up for a slot. Has that come up for you? How have you handled it?

Check into this PR: #82

See what is required to get it merge-able and up-to-date.

Expected Behavior

Volunteer.all is called all over the application and then iterated on in memory. We currently have 2342 volunteers across 40 regions.

Actual Behavior

These calls can all be scoped down to the region being worked on and/or active volunteers

To manage environment variables such as the google maps API key at

Expected Behavior

When showing pickup window start/end times, the robot should consistently use either 12hr "AM/PM" format, or 24hr format. It would be extra cool if the user could select their preference on the Settings page.

Actual Behavior

Both formats are used!

Steps to Recreate

Look at a shift info page, for example https://robot.boulderfoodrescue.org/schedule_chains/776

Environment

Chrome on Linux, but I don't think that matters.

More 'often will' than 'can'

Expected Behavior

When the 'Add to Google Calendar' button is pressed, one may expect the resulting calendar event to have the full name of the local food rescue org in the event title. For example 'Boulder Food Rescue'.

Actual Behavior

The region is not automatically populated.

Example URL:

https://calendar.google.com/calendar/u/0/r/eventedit?text=++++++++++++Food+Rescue:+Sprouts+Market:++Baseline+-%3E+BHP+@+Madison++++++++++++&dates=20200929T150000Z/20200929T170000Z&details&location=2950+Baseline+Rd.+Boulder,+CO+80303&trp=true&sprop=http://boulderfoodrescue.org&sprop=name:Boulder+Food+Rescue&sf=true

Example Screenshot

Steps to Recreate

1. Navigate to a 'schedule chain' page, eg: https://robot.boulderfoodrescue.org/schedule_chains/774
2. Click on the 'Add to Google Calendar' button.
3. Sign in with Google Account if prompted.

Many of the models are not accurately named to describe their role in the app.

I was thinking the following could be renamed:

ScheduleChain     => Route
ScheduleVolunteer => RouteVolunteer

Schedule          => Stop (or RouteStop?)
SchedulePart      => StopFoodType

Log               => PickupLog
LogPart           => PickupLogFoodType
LogRecipient      => PickupLogRecipient
LogVolunteer      => PickupLogVolunteer

When I login and select the [username]/account menu item I get sent to the login page (http://robot.boulderfoodrescue.org/volunteers/edit). Should that menu item not exist? The 'settings' item works fine.

See PRs #85 and #93.

From @virtuallybing:

The basic idea is that we’ve catalogued all of the Rubocop offenses that haven’t been looked at in the rubocop_todo.yml file so that we can decide what we want to do with cops one by one.

If you want to tackle a cop, delete that section from the rubocop_todo.yml file, then run Rubocop to see what offenses associated with that cop need to be addressed.

Some of the cops should be discussed with @rylanb and @ericfreese to determine whether or not we even want to enforce them in the first place, and if so, whether or not we want to relax its configuration.

This issue will be closed when rubocop_todo.yml is empty or deleted.

In config/initializers/constant.rb, there's a Webapp::Application.config.DayOfWeek setting that's not necessary, since we can use Ruby helpers. That array is only used in one form.

I recommend using Ruby's Date::DAYNAMES, rather than Rails's Date::DAYS_INTO_WEEK since that indexes Monday as 0.

Date::DAYNAMES.each_with_index.to_a
# => [["Sunday", 0], ["Monday", 1], ["Tuesday", 2], ["Wednesday", 3], ["Thursday", 4], ["Friday", 5], ["Saturday", 6]]

And you can use the :prompt => "Unknown/varies" option on the select helper to get that option.

This would be a great contribution for a beginner. :)

Expected Behavior

On a shift page, I expect the "Add to Google Calendar" button to create a calendar event at the time of the start of the pickup window.

Actual Behavior

The "Add to Google Calendar" button opens Google Calendar with many fields filled out with useful information, but the times are wrong. In the page linked below, the shift's pickup time is between 4:30PM and 6:00PM, but the calendar even is scheduled for 10:30AM to 12:00PM

I don't know if this problem is specific to that shift, or a general issue.

Steps to Recreate

1. Go to this shift page: https://robot.boulderfoodrescue.org/schedule_chains/776
2. Observe the pickup time.
3. Click on the "Add to Google Calendar" button.
4. Observe the pre-set calendar event times.

Environment

Chrome on Linux, but I don't think that matters.

Expected Behavior

When a volunteer takes a cover shift they don't get assigned to it permanently.

Actual Behavior

The Robot seems to be assigning volunteers to permanent shifts instead of cover shifts. The difference being a I do a permanent or regular shift every Thursday. A cover shift is covering a volunteer's permanent shift absence. Say I'm going out of town for a week, I schedule an absence for the time I am out of town and then another volunteer can go to /logs/open and cover my shift for me for that one time.

Steps to Recreate

The volunteers / coordinators aren't super technical, but here is the descriptions from Trello card:

Descriptions:

1. Okay, M. Rush is having some issues with the wrong shifts showing up on his account.

A while back, M took 4 consecutive weekly shifts (Tuesday, 7-8am, Sprouts Arapahoe) that an old volunteer had scheduled an absence for. After M had taken these 4 one-time covers, I realized the volunteer who had scheduled the absence did not intend to return and I opened up the shift for a regular volunteer. G Miller took the regular shift and the Robot sent out this error:

=============================

2. A Wien signed up for a one-time cover of last week's Tuesday Sprouts Baseline to Harvest of Hope shift (July 12), but the Robot incorrectly included him on the schedule for this week (7/19), as well. I believe the Robot had him on the permanent schedule for that shift, but I can't seem to remember (if he was, I already took him off of it). He is confident he originally took the shift from the "one-time shifts" page and NOT the "recurring shifts" page.

Expected Behavior

/volunteers/super_admin has a link to 'assignments_path' that goes nowhere, was or is not implemented. Need to know why and fix.

Actual Behavior

Links where?

Steps to Recreate

Go to /volunteers/super_admin and see that 'assignments' text link does not work

From Hana:

I wasn't sure but just tried to find that link and did. If I go to "Super Admin," and then I go to "Controls" that is the link it generates and it says the Sorry, something went wrong. That page used to give me the ability to make other people super admins and access data across everyone on the network. The page looked similar to the one that you access when you go to "region admin," and then "controls."

This is a low priority feature request. It would be handy if the robot's Shift Info pages included links to call the donor and recipient. Maybe as part of the "Stops" boxes, next to the addresses?

This line:

(In progress by @mfrost)

On MacOS Catalina (10.15.7), bundle install failed on the following dependencies, with similar error codes:
ffi (1.9.18) [Dependency tree: guard-rspec (4.7.3) -> guard (2.14.1) -> listen (3.1.5) -> rb-inotify (0.9.10) -> ffi (1.9.18)]
pg (0.18.4)
thin (1.7.2)

As documented on several sites, the error relates to the fact that

Clang now enables -Werror=implicit-function-declaration by default:

Clang now reports an error when you use a function without an explicit declaration when building C or Objective-C code for macOS (-Werror=implicit-function-declaration flag is on). This additional error detection unifies Clang’s behavior for iOS/tvOS and macOS 64-bit targets for this diagnostic. (49917738)

I was able to workaround the issues by using the following commands:

bundle config build.ffi --with-cflags="-Wno-error=implicit-function-declaration"
bundle config build.pg --with-cflags="-Wno-error=implicit-function-declaration"
bundle config build.thin --with-cflags="-Wno-error=implicit-function-declaration"
bundle install

References:
ffi/ffi#611 (comment)
https://stackoverflow.com/questions/36455625/postgresql-gem-install-pg-0-18-4-passes-bundle-install-fails

Originally posted by @rylanb in #167 (comment)

See https://github.com/CanCanCommunity/cancancan and PR #69

• VolunteersController
• AbsencesController
• LogsController#index
• ScheduleChainsController (#135)

Expected Behavior

Running bundle install installs all of the project's dependencies.

Actual Behavior

The following error message is produced:

Fetching https://github.com/thoughtbot/paperclip
Fetching https://github.com/rweng/jquery-datatables-rails.git
Fetching gem metadata from https://rubygems.org/........
Fetching gem metadata from https://rubygems.org/.
Resolving dependencies....................................................................................................................................................................
.........
Bundler could not find compatible versions for gem "actionmailer":
  In Gemfile:
    exception_notification-rake (~> 0.0.6) was resolved to 0.0.7, which depends on
      exception_notification (~> 3.0.1) was resolved to 3.0.1, which depends on
        actionmailer (>= 3.0.4)

    rails (~> 3.2.16) was resolved to 3.2.22.5, which depends on
      actionmailer (= 3.2.22.5)

Bundler could not find compatible versions for gem "actionpack":
  In Gemfile:
    twitter-bootstrap-rails was resolved to 3.2.2, which depends on
      less-rails (>= 2.5.0) was resolved to 4.0.0, which depends on
        actionpack (>= 4)

    rails (~> 3.2.16) was resolved to 3.2.22.5, which depends on
      actionpack (= 3.2.22.5)

Bundler could not find compatible versions for gem "activemodel":
  In Gemfile:
    rails (~> 3.2.16) was resolved to 3.2.22.5, which depends on
      activerecord (= 3.2.22.5) was resolved to 3.2.22.5, which depends on
        activemodel (= 3.2.22.5)

    paperclip was resolved to 4.3.1, which depends on
      activemodel (>= 3.2.0)

    simple_form was resolved to 2.1.3, which depends on
      activemodel (~> 3.0)

Bundler could not find compatible versions for gem "activerecord":
  In Gemfile:
    rails (~> 3.2.16) was resolved to 3.2.22.5, which depends on
      activerecord (= 3.2.22.5)

    rails-erd was resolved to 1.5.2, which depends on
      activerecord (>= 3.2)

    ranked-model was resolved to 0.4.1, which depends on
      activerecord (>= 3.1.12)

Bundler could not find compatible versions for gem "activesupport":
  In Gemfile:
    paperclip was resolved to 4.3.1, which depends on
      activesupport (>= 3.2.0)

    rails (~> 3.2.16) was resolved to 3.2.22.5, which depends on
      activesupport (= 3.2.22.5)

    rspec-rails (~> 3.5) was resolved to 3.9.1, which depends on
      activesupport (>= 3.0)

Bundler could not find compatible versions for gem "capybara":
  In Gemfile:
    capybara

    capybara-screenshot was resolved to 1.0.25, which depends on
      capybara (>= 1.0, < 4)

    poltergeist (~> 1.12) was resolved to 1.18.1, which depends on
      capybara (>= 2.1, < 4)

Bundler could not find compatible versions for gem "jquery-rails":
  In Gemfile:
    jquery-rails (= 2.1.4)

    jquery-datatables-rails was resolved to 3.4.0, which depends on
      jquery-rails

Bundler could not find compatible versions for gem "json":
  In Gemfile:
    json

    rails (~> 3.2.16) was resolved to 3.2.22.5, which depends on
      railties (= 3.2.22.5) was resolved to 3.2.22.5, which depends on
        rdoc (~> 3.4) was resolved to 3.12.2, which depends on
          json (~> 1.4)

Bundler could not find compatible versions for gem "mimemagic":
  In Gemfile:
    paperclip was resolved to 4.3.1, which depends on
      mimemagic (= 0.3.0)

Could not find gem 'mimemagic (= 0.3.0)', which is required by gem 'paperclip', in any of the sources.

Bundler could not find compatible versions for gem "nokogiri":
  In Gemfile:
    poltergeist (~> 1.12) was resolved to 1.18.1, which depends on
      capybara (>= 2.1, < 4) was resolved to 2.18.0, which depends on
        nokogiri (>= 1.3.3)

    poltergeist (~> 1.12) was resolved to 1.18.1, which depends on
      capybara (>= 2.1, < 4) was resolved to 2.18.0, which depends on
        xpath (>= 2.0, < 4.0) was resolved to 3.2.0, which depends on
          nokogiri (~> 1.8)

Bundler could not find compatible versions for gem "prawn":
  In Gemfile:
    prawn (~> 2.1.0)

    prawn-table (~> 0.2.2) was resolved to 0.2.2, which depends on
      prawn (>= 1.3.0, < 3.0.0)

Bundler could not find compatible versions for gem "rack":
  In Gemfile:
    rails (~> 3.2.16) was resolved to 3.2.22.5, which depends on
      actionpack (= 3.2.22.5) was resolved to 3.2.22.5, which depends on
        rack (~> 1.4.5)

    better_errors was resolved to 2.9.1, which depends on
      rack (>= 0.9.0)

    poltergeist (~> 1.12) was resolved to 1.18.1, which depends on
      capybara (>= 2.1, < 4) was resolved to 2.18.0, which depends on
        rack (>= 1.0.0)

    rails (~> 3.2.16) was resolved to 3.2.22.5, which depends on
      actionpack (= 3.2.22.5) was resolved to 3.2.22.5, which depends on
        rack-cache (~> 1.2) was resolved to 1.12.1, which depends on
          rack (>= 0.4)

    rails (~> 3.2.16) was resolved to 3.2.22.5, which depends on
      actionpack (= 3.2.22.5) was resolved to 3.2.22.5, which depends on
        sprockets (~> 2.2.1) was resolved to 2.2.3, which depends on
          rack (~> 1.0)

    thin was resolved to 1.8.0, which depends on
      rack (>= 1, < 3)

Bundler could not find compatible versions for gem "rack-test":
  In Gemfile:
    rack-test

    poltergeist (~> 1.12) was resolved to 1.18.1, which depends on
      capybara (>= 2.1, < 4) was resolved to 2.18.0, which depends on
        rack-test (>= 0.5.4)

Bundler could not find compatible versions for gem "rails":
  In Gemfile:
    rails (~> 3.2.16)

    active_scaffold was resolved to 3.4.43, which depends on
      rails (>= 3.2.22.2, < 5)

    browser-timezone-rails was resolved to 1.1.0, which depends on
      rails (>= 3.1)

    yaml_db was resolved to 0.7.0, which depends on
      rails (>= 3.0)

Bundler could not find compatible versions for gem "railties":
  In Gemfile:
    devise (~> 3.2.0) was resolved to 3.2.4, which depends on
      railties (>= 3.2.6, < 5)

    dotenv-rails was resolved to 2.7.6, which depends on
      railties (>= 3.2)

    jquery-datatables-rails was resolved to 3.4.0, which depends on
      railties (>= 3.1)

    jquery-rails (= 2.1.4) was resolved to 2.1.4, which depends on
      railties (>= 3.0, < 5.0)

    rails (~> 3.2.16) was resolved to 3.2.22.5, which depends on
      railties (= 3.2.22.5)

    rspec-rails (~> 3.5) was resolved to 3.9.1, which depends on
      railties (>= 3.0)

    sass-rails (~> 3.2.6) was resolved to 3.2.6, which depends on
      railties (~> 3.2.0)

Bundler could not find compatible versions for gem "rb-fsevent":
  In Gemfile:
    rb-fsevent (~> 0.9.0)

    guard-rspec was resolved to 4.7.3, which depends on
      guard (~> 2.1) was resolved to 2.16.2, which depends on
        listen (>= 2.7, < 4.0) was resolved to 3.5.0, which depends on
          rb-fsevent (~> 0.10, >= 0.10.3)

Bundler could not find compatible versions for gem "ruby":
  In Gemfile:
    ruby (~> 2.3.7.0)

    capybara-screenshot was resolved to 1.0.25, which depends on
      launchy was resolved to 2.5.0, which depends on
        ruby (>= 2.4.0)

Bundler could not find compatible versions for gem "sass-rails":
  In Gemfile:
    sass-rails (~> 3.2.6)

    jquery-datatables-rails was resolved to 3.4.0, which depends on
      sass-rails

Steps to Recreate

Follow the instructions to set up the dev environment on OSX. After cding into the food-rescue-robot directory, run

gem install bundler -v 1.17.3
bundle install

Environment

Operating System: MacOS BigSur (11.2.3)
Ruby version: 2.3.7
bundler version: 1.17.3

Hi, thanks for making such a wonderful resource available! After some trial and error, I finally got the Robot running for our organization. Still, there are a number of oddities I encountered. The main issue: once I got to the "asset precompile" stage I got a ton of "can't dump anonymous class" errors:

bundle exec rake assets:precompile
...
Warning. Error encountered while saving cache /home/user/tmp/food-rescue-robot/cache/sass/0ff4030c6c0d0ceff44d126bd6d5c928f9de1435/home.css.scssc: can't dump anonymous class #<Class:0x0000000545e8e0>
...
rake aborted!

After searching around, this seems to be a problem with sass/sprockets: sass/sass#1162. Problem is, I can't seem to get this to work by downgrading sass to an older version such as 3.2.15.

Am I missing something here? How are you able to get the asset precompile to work? I ended up configuring "config.assets.compress = false" for now to get the site working. Thanks for your help!

• Taking a one-time shift (in progress #81)
• Taking a recurring shift
• Scheduling an absence (in progress #82)
• Seeing upcoming shifts on the home page
• Seeing todo pickup reports on the home page
• Seeing shifts that need covering on the home page (#112)
• Filling out a pickup report

I'm helping some admins and volunteers get started using the Robot (coming in from the cold so to speak as an IT dev) and wonder if there's any docs or help resources for end users on how to use the system.

Thanks!

We need to standardize versioning / contributing / change log.