Gemfile

# frozen_string_literal: true

source 'https://rubygems.org'

ruby '3.4.10'

# Bundle edge Rails instead: gem 'rails', github: 'rails/rails'
gem 'rails', '~> 8.1.0'
# Use postgresql as the database for Active Record
gem 'pg', '>= 0.18', '< 2.0'
# Catch unsafe migrations (table locks, blocking backfills) in dev/CI before
# they reach a production table. Config in config/initializers/strong_migrations.rb.
gem 'strong_migrations', '~> 2.8'
# Use Puma as the app server
gem 'puma', '~> 8.0'
# Asset pipeline for JavaScript bundling
gem 'jsbundling-rails'
# Asset pipeline for Rails
gem 'propshaft'
# Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder
gem 'jbuilder', '~> 2.7'
# Use HAML instead of ERB
gem 'haml-rails', '~> 3.1'
# Add Devise for authentication
gem 'devise', '~> 5.0'
# PBKDF2-SHA512 password hashing for FIPS 140-2 compliance
gem 'devise-encryptable'
# Session limiting (AC-10), session tracking, and server-side session store
gem 'activerecord-session_store'
gem 'devise-security', github: 'mitre/devise-security', ref: '54a79d0'
# Use Omniauth to support additional login providers
gem 'omniauth', '~> 2.1'
# LDAP Auth — original omniauth-ldap (actively maintained, no nkf/kconv dependency).
# Replaces gitlab_omniauth-ldap which had a dead `require 'kconv'` that triggered
# Ruby VM crash bugs.ruby-lang.org/issues/21967 on parallel_tests forking.
gem 'omniauth-ldap', '~> 3.0', require: false
# Allow users to sign in with GitHub
gem 'omniauth-github'
# https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
gem 'omniauth-rails_csrf_protection', '~> 2.0'
# Allow users to sign in with OIDC providers
gem 'omniauth_openid_connect', '~> 0.8'
# Vulcan settings - upgraded for Ruby 3.1+ compatibility
gem 'mitre-settingslogic', '~> 3.0'
# Use Redis adapter to run Action Cable in production
# gem 'redis', '~> 4.0'
# Use Active Model has_secure_password
# gem 'bcrypt', '~> 3.1.7'

# Use Active Storage variant
# gem 'image_processing', '~> 1.2'

# Reduces boot times through caching; required in config/boot.rb
gem 'bootsnap', '>= 1.4.2', require: false

# Ruby 3.4 compatibility - these will be removed from stdlib
gem 'abbrev'
gem 'csv'

gem 'audited', '~> 5.8.0'

# Advisory locks for preventing race conditions (PostgreSQL/MySQL)
gem 'with_advisory_lock', '~> 5.1'

# Health check endpoints for Kubernetes/Docker probes
gem 'health_check', '~> 3.1'

# PostgreSQL full-text search with prefix matching and weighted ranking
gem 'pg_search'

# Versioned SQL functions and triggers that survive schema.rb dumps —
# maintains the base_rules.searchable full-text vector
gem 'fx', '~> 0.11'

gem 'activerecord-import'

gem 'ffaker', '~> 2.10'

gem 'nokogiri'
gem 'nokogiri-happymapper'

gem 'amoeba'

# For writing excel files with xml:space="preserve" (fixes whitespace round-trip)
gem 'caxlsx'
# For reading excel files
gem 'roo', '~> 3.0'

# REXML - required explicitly in Ruby 3.0+
gem 'rexml'

gem 'ox'

gem 'rubyzip'

# Markdown rendering for in-app DISA guide
gem 'commonmarker'

# Rate limiting and request throttling
gem 'rack-attack'

gem 'mitre-inspec-objects'
# inspec-core is only consumed as a library (control-code generation via
# mitre-inspec-objects). It resolves from the Cinc Project's community gem
# server, which builds current InSpec releases from source.
source 'https://rubygems.cinc.sh' do
  gem 'inspec-core', '~> 7.1'
end
gem 'rest-client'

group :development do
  gem 'listen', '~> 3.7'
  # Access an interactive console on exception pages or by calling 'console' anywhere in the code.
  gem 'web-console', '>= 3.3.0'
  # Letter opener for email previews in development
  gem 'letter_opener'
  # Process manager for Procfile-based applications (development only)
  gem 'foreman'
  # Git hooks management (lefthook installed via brew, not bundled)
  # Security vulnerability scanner for Ruby dependencies
  gem 'bundler-audit', require: false
end

group :test do
  # Adds support for Capybara system testing and selenium driver
  gem 'capybara', '>= 2.15'
  # Parallel-safe ENV mutation for specs (never bare ENV assignment)
  gem 'climate_control', '~> 1.2'
  gem 'selenium-webdriver'
  # Easy installation and use of web drivers to run system tests with browsers
  # gem 'webdrivers'

  gem 'database_cleaner-active_record'
  gem 'rubocop', require: false
  gem 'rubocop-capybara'
  gem 'rubocop-factory_bot'
  gem 'rubocop-performance'
  gem 'rubocop-rails'
  gem 'rubocop-rspec'
  gem 'rubocop-rspec_rails'
  gem 'shoulda-matchers', '~> 8.0'
  gem 'simplecov', require: false
  gem 'test-prof', '~> 1.5'
  gem 'webmock'
end

group :development, :test do
  gem 'brakeman'
  gem 'byebug'
  gem 'factory_bot_rails', '~> 6.5.0'
  gem 'parallel_tests'
  gem 'rspec-mocks'
  gem 'rspec-rails', '~> 8.0'
  # Load environment variables from .env files in development and test
  gem 'dotenv-rails'
  # OpenAPI 3.2 contract testing (MITRE forks until upstream merges 3.2 support)
  # Upstream PRs: json_schemer#230, openapi_first#479, swagcov#202
  gem 'json_schemer', github: 'aaronlippold/json_schemer', branch: 'feat/openapi-3.2-support'
  gem 'openapi_first', github: 'aaronlippold/openapi_first', branch: 'feat/openapi-3.2-support'
  gem 'swagcov', github: 'aaronlippold/swagcov', branch: 'fix/optional-route-segments'
end

# Windows and Mac do not include zoneinfo files, so bundle the tzinfo-data gem
gem 'tzinfo-data'

gem 'highline', '~> 2.0'
# Ruby wrapper around slack API
gem 'slack-ruby-client', '~> 3.2'
# Slack notification formatting
gem 'slack_block_kit', '0.3.3'

gem 'blueprinter', '~> 1.2'

gem 'blueprinter-activerecord', '~> 1.3'

gem 'oj', '~> 3.16'

gem 'has_scope', '~> 0.9.0'
gem 'pagy', '~> 43.5'

gem 'faraday', '~> 2.0'