Example Debian Buster install script

FBJS updates

.circleci/circle_envs

@@ -1,4 +1,3 @@
-DOCKER_COMPOSE_VERSION=1.22.0
 ADMIN_PASSWORD=this_is_a_fake_admin_pass
 POSTGRES_PASSWORD=fake_db_password_also
 API_HOST=10.1.10.219

.circleci/config.yml

@@ -1,44 +1,77 @@
-version: 2
-jobs:
-  build:
+version: 2.1
+
+executors:
+  build-executor:
     machine: true
+    working_directory: /home/circleci/project
+
+commands:
+  build-commands:
     steps:
       - checkout
+      - restore_cache:
+          keys:
+            - cache-v1-{{ .Revision }}-{{ .Environment.CIRCLE_WORKFLOW_ID }}
       - run:
-          name: Shuffle configs around, install Docker-Compose
+          name: After cache restore
           command: |
-            curl -L https://github.com/docker/compose/releases/download/1.22.0/docker-compose-`uname -s`-`uname -m` > docker-compose
-            chmod +x docker-compose
-            sudo mv docker-compose /usr/local/bin
+            git clean -xdn
+            mkdir -p docker_cache
+            ls docker_cache
+            #sudo docker images
+            #if [ -f docker_cache/images.tar.gz ]; then gunzip -c docker_cache/images.tar.gz | sudo docker load; fi
+      - run:
+          name: Build and Install Deps
+          command: |
+            sudo curl -L "https://github.com/docker/compose/releases/download/1.24.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
             mv .circleci/circle_envs .env
-      - run:
-          name: Install Ruby/JS deps
-          command: |
+            echo -e '\ndocker_volumes/db/pg_wal/*' >> .dockerignore
+            sudo docker-compose run web gem install bundler
             sudo docker-compose run web bundle install
             sudo docker-compose run web npm install
-      - run:
-          name: Create databases and secrets
-          command: |
             sudo docker-compose run web bundle exec rails db:create
             sudo docker-compose run web bundle exec rails db:migrate
             sudo docker-compose run web rake keys:generate
       - run:
-          name: Run Ruby tests
+          name: After cache update
           command: |
-            sudo docker-compose run web rspec spec
+            git clean -xdn
+            ls docker_cache
+            #sudo docker images
+            #if [ ! -f docker_cache/images.tar.gz ]; then sudo docker save $(sudo docker images ruby -q) | gzip > docker_cache/images.tar.gz; fi
+      - save_cache:
+          key: cache-v1-{{ .Revision }}-{{ .Environment.CIRCLE_WORKFLOW_ID }}
+          paths:
+            - docker_volumes
+            - node_modules
+            - docker_cache
+  rspec-commands:
+    steps:
       - run:
-          name: Run linters
+          name: Run Ruby Tests
           command: |
-            sudo docker-compose run web npm run linters
+            sudo docker-compose run web rspec spec --format progress --format RspecJunitFormatter --out test-results/rspec/rspec.xml
+  jest-commands:
+    steps:
       - run:
           name: Run JS tests
           command: |
-            sudo docker-compose run web npm run test-slow
+            sudo docker-compose run web npm run test-very-slow -- -c .circleci/jest-ci.config.js
             echo 'export COVERAGE_AVAILABLE=true' >> $BASH_ENV
+  lint-commands:
+    steps:
       - run:
-          name: Check Coveralls coverage on staging
+          name: Run JS Linters
           command: |
-            sudo docker-compose run -e CIRCLE_SHA1="$CIRCLE_SHA1" -e CIRCLE_BRANCH="$CIRCLE_BRANCH" web rake coverage:run
+            sudo docker-compose run web npm run linters
+          when: always
+  coverage-commands:
+    steps:
+      - run:
+          name: Check coverage status
+          command: |
+            sudo docker-compose run -e CIRCLE_SHA1="$CIRCLE_SHA1" -e CIRCLE_BRANCH="$CIRCLE_BRANCH" -e CIRCLE_PULL_REQUEST="$CIRCLE_PULL_REQUEST" web rake coverage:run
+          when: always
       - run:
           name: Report coverage to Coveralls
           command: |
@@ -47,3 +80,60 @@ jobs:
               sudo docker-compose run -e COVERALLS_REPO_TOKEN=lEX6nkql7y2YFCcIXVq5ORvdvMtYzfZdG web npm run coverage
             fi
           when: always # change to `on_success` for a stricter comparison
+
+
+workflows:
+  version: 2
+  build_and_test:
+    jobs:
+      #- build
+      - all
+      #- test-api:
+      #    requires:
+      #      - build
+      #- run-linters:
+      #    requires:
+      #      - build
+      #- test-fe:
+      #    requires:
+      #      - build
+
+jobs:
+  build:
+    executor: build-executor
+    steps:
+      - build-commands
+  all:
+    executor: build-executor
+    steps:
+      - build-commands
+      - rspec-commands
+      - lint-commands
+      - jest-commands
+      - store_test_results:
+          path: test-results
+      - coverage-commands
+  test-api:
+    executor: build-executor
+    steps:
+      - build-commands
+      - rspec-commands
+      - store_test_results:
+          path: test-results
+  run-linters:
+    executor: build-executor
+    steps:
+      - build-commands
+      - lint-commands
+  test-fe:
+    executor: build-executor
+    parallelism: 4
+    steps:
+      - build-commands
+      - run:
+          name: Run JS Tests
+          command: |
+            circleci tests glob **/__tests__/**/*.ts* | circleci tests split > /tmp/tests-to-run
+            sudo docker-compose run web npm run test-very-slow -- -c .circleci/jest-ci.config.js $(cat /tmp/tests-to-run)
+      - store_test_results:
+          path: test-results

.circleci/jest-ci.config.js

@@ -0,0 +1,11 @@
+const baseConfig = require("../jest.config");
+
+baseConfig.rootDir = "..";
+baseConfig.reporters.push([
+  "jest-junit",
+  {
+    outputDirectory: "test-results/jest"
+  }
+]);
+
+module.exports = baseConfig;

.gitignore

@@ -1,6 +1,7 @@
 .cache
 .env
 .vscode
+.idea
 *.log
 *.pem
 coverage_api
@@ -13,17 +14,18 @@ package-lock.json
 public/assets/
 public/direct_upload/temp/*.jpg
 public/dist
-public/system
 tmp
 api_docs.md
 erd_diagram.png
 erd.pdf
 *scratchpad*
-scratchpad.rb
 /config/master.key
 config/credentials.yml.enc
+# ActiveStorage blobs:
+storage/*
 
 # === Legacy
+public/system
 config/application.yml
 coverage
 mqtt/

.ruby-version

@@ -1 +1 @@
-2.6.1
+2.6.5

Gemfile

@@ -1,54 +1,45 @@
 source "https://rubygems.org"
-ruby "~> 2.6.1"
+ruby "~> 2.6.5"
 
+gem "rails"
 gem "active_model_serializers"
 gem "bunny"
 gem "delayed_job_active_record" # TODO: Get off of SQL backed jobs. Use Redis
 gem "delayed_job"
 gem "devise"
 gem "discard"
-gem "figaro"
-gem "fog-google"
 gem "font-awesome-rails"
-gem "foreman"
+gem "google-cloud-storage", "~> 1.11", require: false
 gem "jwt"
 gem "mutations"
-gem "paperclip"
 gem "pg"
-gem "polymorphic_constraints"
+gem "rabbitmq_http_api_client"
 gem "rack-attack"
 gem "rack-cors"
 gem "rails_12factor"
-gem "rails"
+gem "redis", "~> 4.0"
 gem "request_store"
 gem "rollbar"
 gem "scenic"
 gem "secure_headers"
-gem "skylight"
 gem "tzinfo" # For validation of user selected timezone names
 gem "valid_url"
-gem "rabbitmq_http_api_client"
-gem "zero_downtime_migrations"
-gem "redis", "~> 4.0"
+gem "kaminari"
 
 group :development, :test do
-  gem "thin"
+  gem "climate_control"
   gem "codecov", require: false
-  gem "simplecov"
   gem "database_cleaner"
   gem "factory_bot_rails"
   gem "faker"
   gem "hashdiff"
-  gem "letter_opener"
-  gem "lol_dba"
   gem "pry-rails"
   gem "pry"
-  gem "rails-erd"
   gem "rspec-rails"
   gem "rspec"
-  gem "selenium-webdriver"
+  gem 'rspec_junit_formatter'
+  gem "simplecov"
   gem "smarf_doc", git: "https://github.com/RickCarlino/smarf_doc.git"
-  gem "climate_control"
 end
 
 group :production do

Gemfile.lock

@@ -7,325 +7,300 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (5.2.3)
-      actionpack (= 5.2.3)
+    actioncable (6.0.2.2)
+      actionpack (= 6.0.2.2)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailer (5.2.3)
-      actionpack (= 5.2.3)
-      actionview (= 5.2.3)
-      activejob (= 5.2.3)
+    actionmailbox (6.0.2.2)
+      actionpack (= 6.0.2.2)
+      activejob (= 6.0.2.2)
+      activerecord (= 6.0.2.2)
+      activestorage (= 6.0.2.2)
+      activesupport (= 6.0.2.2)
+      mail (>= 2.7.1)
+    actionmailer (6.0.2.2)
+      actionpack (= 6.0.2.2)
+      actionview (= 6.0.2.2)
+      activejob (= 6.0.2.2)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (5.2.3)
-      actionview (= 5.2.3)
-      activesupport (= 5.2.3)
-      rack (~> 2.0)
+    actionpack (6.0.2.2)
+      actionview (= 6.0.2.2)
+      activesupport (= 6.0.2.2)
+      rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.2.3)
-      activesupport (= 5.2.3)
+      rails-html-sanitizer (~> 1.0, >= 1.2.0)
+    actiontext (6.0.2.2)
+      actionpack (= 6.0.2.2)
+      activerecord (= 6.0.2.2)
+      activestorage (= 6.0.2.2)
+      activesupport (= 6.0.2.2)
+      nokogiri (>= 1.8.5)
+    actionview (6.0.2.2)
+      activesupport (= 6.0.2.2)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    active_model_serializers (0.10.9)
-      actionpack (>= 4.1, < 6)
-      activemodel (>= 4.1, < 6)
+      rails-html-sanitizer (~> 1.1, >= 1.2.0)
+    active_model_serializers (0.10.10)
+      actionpack (>= 4.1, < 6.1)
+      activemodel (>= 4.1, < 6.1)
       case_transform (>= 0.2)
       jsonapi-renderer (>= 0.1.1.beta1, < 0.3)
-    activejob (5.2.3)
-      activesupport (= 5.2.3)
+    activejob (6.0.2.2)
+      activesupport (= 6.0.2.2)
       globalid (>= 0.3.6)
-    activemodel (5.2.3)
-      activesupport (= 5.2.3)
-    activerecord (5.2.3)
-      activemodel (= 5.2.3)
-      activesupport (= 5.2.3)
-      arel (>= 9.0)
-    activestorage (5.2.3)
-      actionpack (= 5.2.3)
-      activerecord (= 5.2.3)
+    activemodel (6.0.2.2)
+      activesupport (= 6.0.2.2)
+    activerecord (6.0.2.2)
+      activemodel (= 6.0.2.2)
+      activesupport (= 6.0.2.2)
+    activestorage (6.0.2.2)
+      actionpack (= 6.0.2.2)
+      activejob (= 6.0.2.2)
+      activerecord (= 6.0.2.2)
       marcel (~> 0.3.1)
-    activesupport (5.2.3)
+    activesupport (6.0.2.2)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    addressable (2.6.0)
-      public_suffix (>= 2.0.2, < 4.0)
-    amq-protocol (2.3.0)
-    arel (9.0.0)
-    bcrypt (3.1.12)
-    builder (3.2.3)
-    bunny (2.14.1)
-      amq-protocol (~> 2.3, >= 2.3.0)
+      zeitwerk (~> 2.2)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
+    amq-protocol (2.3.1)
+    bcrypt (3.1.13)
+    builder (3.2.4)
+    bunny (2.15.0)
+      amq-protocol (~> 2.3, >= 2.3.1)
     case_transform (0.2)
       activesupport
-    childprocess (0.9.0)
-      ffi (~> 1.0, >= 1.0.11)
-    choice (0.2.0)
     climate_control (0.2.0)
-    codecov (0.1.14)
+    codecov (0.1.16)
       json
       simplecov
       url
     coderay (1.1.2)
-    concurrent-ruby (1.1.5)
-    crass (1.0.4)
-    daemons (1.3.1)
-    database_cleaner (1.7.0)
+    concurrent-ruby (1.1.6)
+    crass (1.0.6)
+    database_cleaner (1.8.3)
     declarative (0.0.10)
     declarative-option (0.1.0)
-    delayed_job (4.1.5)
-      activesupport (>= 3.0, < 5.3)
-    delayed_job_active_record (4.1.3)
-      activerecord (>= 3.0, < 5.3)
+    delayed_job (4.1.8)
+      activesupport (>= 3.0, < 6.1)
+    delayed_job_active_record (4.1.4)
+      activerecord (>= 3.0, < 6.1)
       delayed_job (>= 3.0, < 5)
-    devise (4.6.2)
+    devise (4.7.1)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 4.1.0, < 6.0)
+      railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
     diff-lcs (1.3)
-    discard (1.0.0)
-      activerecord (>= 4.2, < 6)
-    docile (1.3.1)
-    erubi (1.8.0)
-    eventmachine (1.2.7)
-    excon (0.62.0)
-    factory_bot (5.0.2)
+    digest-crc (0.5.1)
+    discard (1.2.0)
+      activerecord (>= 4.2, < 7)
+    docile (1.3.2)
+    erubi (1.9.0)
+    factory_bot (5.1.2)
       activesupport (>= 4.2.0)
-    factory_bot_rails (5.0.1)
-      factory_bot (~> 5.0.0)
+    factory_bot_rails (5.1.1)
+      factory_bot (~> 5.1.0)
       railties (>= 4.2.0)
-    faker (1.9.3)
-      i18n (>= 0.7)
-    faraday (0.15.4)
+    faker (2.11.0)
+      i18n (>= 1.6, < 2)
+    faraday (0.17.3)
       multipart-post (>= 1.2, < 3)
-    faraday_middleware (0.13.1)
+    faraday_middleware (0.14.0)
       faraday (>= 0.7.4, < 1.0)
-    ffi (1.10.0)
-    figaro (1.1.1)
-      thor (~> 0.14)
-    fog-core (2.1.0)
-      builder
-      excon (~> 0.58)
-      formatador (~> 0.2)
-      mime-types
-    fog-google (1.9.1)
-      fog-core (<= 2.1.0)
-      fog-json (~> 1.2)
-      fog-xml (~> 0.1.0)
-      google-api-client (~> 0.23.0)
-    fog-json (1.2.0)
-      fog-core
-      multi_json (~> 1.10)
-    fog-xml (0.1.3)
-      fog-core
-      nokogiri (>= 1.5.11, < 2.0.0)
-    font-awesome-rails (4.7.0.4)
-      railties (>= 3.2, < 6.0)
-    foreman (0.85.0)
-      thor (~> 0.19.1)
-    formatador (0.2.5)
+    font-awesome-rails (4.7.0.5)
+      railties (>= 3.2, < 6.1)
     globalid (0.4.2)
       activesupport (>= 4.2.0)
-    google-api-client (0.23.9)
+    google-api-client (0.37.2)
       addressable (~> 2.5, >= 2.5.1)
-      googleauth (>= 0.5, < 0.7.0)
+      googleauth (~> 0.9)
       httpclient (>= 2.8.1, < 3.0)
-      mime-types (~> 3.0)
+      mini_mime (~> 1.0)
       representable (~> 3.0)
       retriable (>= 2.0, < 4.0)
-      signet (~> 0.9)
-    googleauth (0.6.7)
-      faraday (~> 0.12)
+      signet (~> 0.12)
+    google-cloud-core (1.5.0)
+      google-cloud-env (~> 1.0)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (1.3.1)
+      faraday (>= 0.17.3, < 2.0)
+    google-cloud-errors (1.0.0)
+    google-cloud-storage (1.25.1)
+      addressable (~> 2.5)
+      digest-crc (~> 0.4)
+      google-api-client (~> 0.33)
+      google-cloud-core (~> 1.2)
+      googleauth (~> 0.9)
+      mini_mime (~> 1.0)
+    googleauth (0.11.0)
+      faraday (>= 0.17.3, < 2.0)
       jwt (>= 1.4, < 3.0)
       memoist (~> 0.16)
       multi_json (~> 1.11)
       os (>= 0.9, < 2.0)
-      signet (~> 0.7)
-    hashdiff (0.3.8)
+      signet (~> 0.12)
+    hashdiff (1.0.1)
     hashie (3.6.0)
     httpclient (2.8.3)
-    i18n (1.6.0)
+    i18n (1.8.2)
       concurrent-ruby (~> 1.0)
-    json (2.2.0)
-    jsonapi-renderer (0.2.0)
-    jwt (2.1.0)
-    launchy (2.4.3)
-      addressable (~> 2.3)
-    letter_opener (1.7.0)
-      launchy (~> 2.2)
-    lol_dba (2.1.5)
-      actionpack (>= 3.0)
-      activerecord (>= 3.0)
-      railties (>= 3.0)
-    loofah (2.2.3)
+    json (2.3.0)
+    jsonapi-renderer (0.2.2)
+    jwt (2.2.1)
+    kaminari (1.2.0)
+      activesupport (>= 4.1.0)
+      kaminari-actionview (= 1.2.0)
+      kaminari-activerecord (= 1.2.0)
+      kaminari-core (= 1.2.0)
+    kaminari-actionview (1.2.0)
+      actionview
+      kaminari-core (= 1.2.0)
+    kaminari-activerecord (1.2.0)
+      activerecord
+      kaminari-core (= 1.2.0)
+    kaminari-core (1.2.0)
+    loofah (2.5.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
     marcel (0.3.3)
       mimemagic (~> 0.3.2)
-    memoist (0.16.0)
-    method_source (0.9.2)
-    mime-types (3.2.2)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2019.0331)
-    mimemagic (0.3.3)
-    mini_mime (1.0.1)
+    memoist (0.16.2)
+    method_source (1.0.0)
+    mimemagic (0.3.4)
+    mini_mime (1.0.2)
     mini_portile2 (2.4.0)
-    minitest (5.11.3)
+    minitest (5.14.0)
     multi_json (1.13.1)
-    multipart-post (2.0.0)
-    mutations (0.9.0)
+    multipart-post (2.1.1)
+    mutations (0.9.1)
       activesupport
-    nio4r (2.3.1)
-    nokogiri (1.10.2)
+    nio4r (2.5.2)
+    nokogiri (1.10.9)
       mini_portile2 (~> 2.4.0)
     orm_adapter (0.5.0)
-    os (1.0.0)
-    paperclip (6.1.0)
-      activemodel (>= 4.2.0)
-      activesupport (>= 4.2.0)
-      mime-types
-      mimemagic (~> 0.3.0)
-      terrapin (~> 0.6.0)
-    passenger (6.0.2)
+    os (1.0.1)
+    passenger (6.0.4)
       rack
       rake (>= 0.8.1)
-    pg (1.1.4)
-    polymorphic_constraints (1.0.0)
-      rails
-    pry (0.12.2)
-      coderay (~> 1.1.0)
-      method_source (~> 0.9.0)
+    pg (1.2.3)
+    pry (0.13.1)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
     pry-rails (0.3.9)
       pry (>= 0.10.4)
-    public_suffix (3.0.3)
-    rabbitmq_http_api_client (1.12.0)
-      faraday (~> 0.15.4)
-      faraday_middleware (~> 0.13.0)
+    public_suffix (4.0.3)
+    rabbitmq_http_api_client (1.13.0)
+      faraday (>= 0.15, < 1)
+      faraday_middleware (>= 0.13.0, < 1)
       hashie (~> 3.6)
       multi_json (~> 1.13.1)
-    rack (2.0.7)
-    rack-attack (5.4.2)
+    rack (2.2.2)
+    rack-attack (6.2.2)
       rack (>= 1.0, < 3)
-    rack-cors (1.0.3)
+    rack-cors (1.1.1)
+      rack (>= 2.0.0)
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rails (5.2.3)
-      actioncable (= 5.2.3)
-      actionmailer (= 5.2.3)
-      actionpack (= 5.2.3)
-      actionview (= 5.2.3)
-      activejob (= 5.2.3)
-      activemodel (= 5.2.3)
-      activerecord (= 5.2.3)
-      activestorage (= 5.2.3)
-      activesupport (= 5.2.3)
+    rails (6.0.2.2)
+      actioncable (= 6.0.2.2)
+      actionmailbox (= 6.0.2.2)
+      actionmailer (= 6.0.2.2)
+      actionpack (= 6.0.2.2)
+      actiontext (= 6.0.2.2)
+      actionview (= 6.0.2.2)
+      activejob (= 6.0.2.2)
+      activemodel (= 6.0.2.2)
+      activerecord (= 6.0.2.2)
+      activestorage (= 6.0.2.2)
+      activesupport (= 6.0.2.2)
       bundler (>= 1.3.0)
-      railties (= 5.2.3)
+      railties (= 6.0.2.2)
       sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-erd (1.5.2)
-      activerecord (>= 3.2)
-      activesupport (>= 3.2)
-      choice (~> 0.2.0)
-      ruby-graphviz (~> 1.2)
-    rails-html-sanitizer (1.0.4)
-      loofah (~> 2.2, >= 2.2.2)
+    rails-html-sanitizer (1.3.0)
+      loofah (~> 2.3)
     rails_12factor (0.0.3)
       rails_serve_static_assets
       rails_stdout_logging
     rails_serve_static_assets (0.0.5)
     rails_stdout_logging (0.0.5)
-    railties (5.2.3)
-      actionpack (= 5.2.3)
-      activesupport (= 5.2.3)
+    railties (6.0.2.2)
+      actionpack (= 6.0.2.2)
+      activesupport (= 6.0.2.2)
       method_source
       rake (>= 0.8.7)
-      thor (>= 0.19.0, < 2.0)
-    rake (12.3.2)
-    redis (4.1.0)
+      thor (>= 0.20.3, < 2.0)
+    rake (13.0.1)
+    redis (4.1.3)
     representable (3.0.4)
       declarative (< 0.1.0)
       declarative-option (< 0.2.0)
       uber (< 0.2.0)
-    request_store (1.4.1)
+    request_store (1.5.0)
       rack (>= 1.4)
-    responders (2.4.1)
-      actionpack (>= 4.2.0, < 6.0)
-      railties (>= 4.2.0, < 6.0)
+    responders (3.0.0)
+      actionpack (>= 5.0)
+      railties (>= 5.0)
     retriable (3.1.2)
-    rollbar (2.19.3)
-      multi_json
-    rspec (3.8.0)
-      rspec-core (~> 3.8.0)
-      rspec-expectations (~> 3.8.0)
-      rspec-mocks (~> 3.8.0)
-    rspec-core (3.8.0)
-      rspec-support (~> 3.8.0)
-    rspec-expectations (3.8.2)
+    rollbar (2.24.0)
+    rspec (3.9.0)
+      rspec-core (~> 3.9.0)
+      rspec-expectations (~> 3.9.0)
+      rspec-mocks (~> 3.9.0)
+    rspec-core (3.9.1)
+      rspec-support (~> 3.9.1)
+    rspec-expectations (3.9.1)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-mocks (3.8.0)
+      rspec-support (~> 3.9.0)
+    rspec-mocks (3.9.1)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-rails (3.8.2)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      railties (>= 3.0)
-      rspec-core (~> 3.8.0)
-      rspec-expectations (~> 3.8.0)
-      rspec-mocks (~> 3.8.0)
-      rspec-support (~> 3.8.0)
-    rspec-support (3.8.0)
-    ruby-graphviz (1.2.4)
-    rubyzip (1.2.2)
-    scenic (1.5.1)
+      rspec-support (~> 3.9.0)
+    rspec-rails (4.0.0)
+      actionpack (>= 4.2)
+      activesupport (>= 4.2)
+      railties (>= 4.2)
+      rspec-core (~> 3.9)
+      rspec-expectations (~> 3.9)
+      rspec-mocks (~> 3.9)
+      rspec-support (~> 3.9)
+    rspec-support (3.9.2)
+    rspec_junit_formatter (0.4.1)
+      rspec-core (>= 2, < 4, != 2.12.0)
+    scenic (1.5.2)
       activerecord (>= 4.0.0)
       railties (>= 4.0.0)
-    secure_headers (6.1.0)
-    selenium-webdriver (3.141.0)
-      childprocess (~> 0.5)
-      rubyzip (~> 1.2, >= 1.2.2)
-    signet (0.11.0)
+    secure_headers (6.3.0)
+    signet (0.13.0)
       addressable (~> 2.3)
-      faraday (~> 0.9)
+      faraday (>= 0.17.3, < 2.0)
       jwt (>= 1.5, < 3.0)
       multi_json (~> 1.10)
-    simplecov (0.16.1)
+    simplecov (0.18.5)
       docile (~> 1.1)
-      json (>= 1.8, < 3)
-      simplecov-html (~> 0.10.0)
-    simplecov-html (0.10.2)
-    skylight (3.1.5)
-      skylight-core (= 3.1.5)
-    skylight-core (3.1.5)
-      activesupport (>= 4.2.0)
-    sprockets (3.7.2)
+      simplecov-html (~> 0.11)
+    simplecov-html (0.12.2)
+    sprockets (4.0.0)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
     sprockets-rails (3.2.1)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
-    terrapin (0.6.0)
-      climate_control (>= 0.0.3, < 1.0)
-    thin (1.7.2)
-      daemons (~> 1.0, >= 1.0.9)
-      eventmachine (~> 1.0, >= 1.0.4)
-      rack (>= 1, < 3)
-    thor (0.19.4)
+    thor (1.0.1)
     thread_safe (0.3.6)
-    tzinfo (1.2.5)
+    tzinfo (1.2.7)
       thread_safe (~> 0.1)
     uber (0.1.0)
     url (0.3.2)
@@ -334,11 +309,10 @@ GEM
       rails
     warden (1.2.8)
       rack (>= 2.0.6)
-    websocket-driver (0.7.0)
+    websocket-driver (0.7.1)
       websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.3)
-    zero_downtime_migrations (0.0.7)
-      activerecord
+    websocket-extensions (0.1.4)
+    zeitwerk (2.3.0)
 
 PLATFORMS
   ruby
@@ -355,45 +329,36 @@ DEPENDENCIES
   discard
   factory_bot_rails
   faker
-  figaro
-  fog-google
   font-awesome-rails
-  foreman
+  google-cloud-storage (~> 1.11)
   hashdiff
   jwt
-  letter_opener
-  lol_dba
+  kaminari
   mutations
-  paperclip
   passenger
   pg
-  polymorphic_constraints
   pry
   pry-rails
   rabbitmq_http_api_client
   rack-attack
   rack-cors
   rails
-  rails-erd
   rails_12factor
   redis (~> 4.0)
   request_store
   rollbar
   rspec
   rspec-rails
+  rspec_junit_formatter
   scenic
   secure_headers
-  selenium-webdriver
   simplecov
-  skylight
   smarf_doc!
-  thin
   tzinfo
   valid_url
-  zero_downtime_migrations
 
 RUBY VERSION
-   ruby 2.6.1p33
+   ruby 2.6.5p114
 
 BUNDLED WITH
-   1.17.2
+   2.1.4

Procfile

@@ -2,4 +2,4 @@ worker:         bundle exec rake jobs:work
 rabbit_workers: bin/rails r lib/rabbit_workers.rb
 web:            bundle exec passenger start -p $PORT -e $RAILS_ENV --max-pool-size 2
 # This will perform a hard refresh on all connected browsers.
-release:        rails r User.refresh_everyones_ui
+release:        rails r "User.refresh_everyones_ui"

README.md

@@ -18,7 +18,7 @@ There are only a handful of use cases where running a third party server is advi
 
 FarmBot, Inc. provides a publicly accessible server at [https://my.farm.bot/](https://my.farm.bot/) for end users that are not familiar with Ruby on Rails application development. Hosting your own server will require an understanding of how Ruby on Rails applications (and databases) operate. It is designed for use by software engineers. Self-hosting the Web App will not provide you with a more stable user experience and may result in accidental security issues or data loss.
 
-**If you are not a Ruby on Rails developer**, or you have never written a Ruby on Rails application, you are encouraged to use [the publicly available web app](http://my.farmbot.io/). Running a server is *a non-trivial task with security implications*. Data loss and security issues are possible in some circumstances. Self hosting requires an intermediate background in Ruby, SQL and Linux system administration.
+**If you are not a Ruby on Rails developer**, or you have never written a Ruby on Rails application, you are encouraged to use [the publicly available web app](http://my.farm.bot/). Running a server is *a non-trivial task with security implications*. Data loss and security issues are possible in some circumstances. Self hosting requires an intermediate background in Ruby, SQL and Linux system administration.
 
 We do not have the resources available to help novice developers learn to setup servers, environments, configurations, or perform basic Linux command line instructions.
 

SECURITY.md

@@ -0,0 +1,9 @@
+# Security Policy
+
+## Supported Versions
+
+Please see our [official support policy](http://support-policy.farm.bot).
+
+## Reporting a Vulnerability
+
+Please see our [guidelines for responsibly disclosing security vulnerabilities](http://vulnerabilities.farm.bot/).

app/assets/config/manifest.js

@@ -0,0 +1 @@
+//= link application.css

app/controllers/api/abstract_controller.rb

@@ -11,11 +11,12 @@ module Api
     CONSENT_REQUIRED =
       "all device users must agree to terms of service."
     NOT_JSON = "That request was not valid JSON. Consider checking the" \
-    " request body with a JSON validator.."
+    " request body with a JSON validator."
     NULL = Gem::Version.new("0.0.0")
     NOT_FBOS = Gem::Version.new("999.999.999")
 
     respond_to :json
+    before_action :raw_json, only: [:update, :create]
     before_action :check_fbos_version
     before_action :set_default_stuff
     before_action :authenticate_user!
@@ -23,7 +24,7 @@ module Api
     after_action :skip_set_cookies_header
 
     rescue_from(CeleryScript::TypeCheckError) do |err|
-      sorry err.message, 422
+      sorry err.message
     end
 
     rescue_from(ActionController::RoutingError) { sorry "Not found", 404 }
@@ -31,22 +32,26 @@ module Api
 
     rescue_from(JWT::VerificationError) { |e| auth_err }
 
-    rescue_from(ActionDispatch::Http::Parameters::ParseError) { sorry NOT_JSON, 422 }
+    rescue_from(ActionDispatch::Http::Parameters::ParseError) { sorry NOT_JSON }
+    rescue_from(JSON::ParserError) { sorry NOT_JSON }
 
     rescue_from(ActiveRecord::ValueTooLong) do
-      sorry "Please use reasonable lengths on string inputs", 422
+      sorry "Please use reasonable lengths on string inputs"
     end
 
     rescue_from Errors::Forbidden do |exc|
       sorry "You can't perform that action. #{exc.message}", 403
     end
 
+    ONLY_JSON = "This is a JSON API. " \
+    "Please use a _valid_ JSON object or array. " \
+    "Validate JSON objects at https://jsonlint.com/"
     rescue_from OnlyJson do |e|
-      sorry "This is a JSON API. Please use _valid_ JSON.", 422
+      sorry ONLY_JSON
     end
 
     rescue_from Errors::NoBot do |exc|
-      sorry "You need to register a device first.", 422
+      sorry "You need to register a device first."
     end
 
     rescue_from ActiveRecord::RecordNotFound do |exc|
@@ -63,34 +68,53 @@ module Api
 
     rescue_from ActiveModel::RangeError do |_|
       sorry "One of those numbers was too big/small. " +
-            "If you need larger numbers, let us know.", 422
+            "If you need larger numbers, let us know."
     end
 
+    TOO_MUCH_DATA = "The resource exceeds database limits. " \
+    "Please reduce the amount of data stored in a single resource"
+
+    rescue_from(PG::ProgramLimitExceeded) { sorry TOO_MUCH_DATA }
+
     def default_serializer_options
       { root: false, user: current_user }
     end
 
+    def maybe_paginate(collection)
+      page = params[:page]
+      per = params[:per]
+
+      if page && per
+        render json: collection.page(page).per(per)
+      else
+        render json: collection
+      end
+    end
     private
 
     def clean_expired_farm_events
       FarmEvents::CleanExpired.run!(device: current_device)
+      # TODO: The app is leaking `Fragment` records, creating
+      #       orphaned DB entries. This should be fixable via
+      #       ActiveRecord config. Most likely a misconfiguration.
+      #         - RC 4 OCT 19
+      Fragment.remove_old_fragments_for_device(current_device)
     end
 
     # Rails 5 params are no longer simple hashes. This was for security reasons.
     # Our API does not do things the "Rails way" (we use Mutations for input
     # sanitation) so we can ignore this and grab the raw input.
     def raw_json
-      @raw_json ||= JSON.parse(request.body.read).tap { |x| symbolize(x) }
+      @raw_json ||= parse_json
     rescue JSON::ParserError
       raise OnlyJson
     end
 
-    # PROBLEM: We want to deep_symbolize_keys! on all JSON inputs, but what if
-    # the user POSTs an Array? It will crash because [] does not respond_to
-    # deep_symbolize_keys! This is the workaround. I could probably use a
-    # refinement.
-    def symbolize(x)
-      x.is_a?(Array) ? x.map(&:deep_symbolize_keys!) : x.deep_symbolize_keys!
+    def parse_json
+      body = request.body.read
+      json = body.present? ? JSON.parse(body, symbolize_names: true) : nil
+      raise OnlyJson unless json.is_a?(Hash) || json.is_a?(Array)
+      json
     end
 
     REQ_ID = "X-Farmbot-Rpc-Id"
@@ -123,7 +147,7 @@ module Api
       strategy = Auth::DetermineAuthStrategy.run!(context)
       case strategy
       when :jwt
-        sign_in(Auth::FromJWT.run!(context).require_consent!)
+        sign_in(Auth::FromJwt.run!(context).require_consent!)
       when :already_connected
         # Probably provided a cookie.
         # 9 times out of 10, it's a unit test.
@@ -144,7 +168,7 @@ module Api
             " provide a JSON Web Token in the `Authorization:` header.", 401)
     end
 
-    def sorry(msg, status)
+    def sorry(msg, status = 422)
       render json: { error: msg }, status: status
     end
 

app/controllers/api/alerts_controller.rb

@@ -0,0 +1,17 @@
+module Api
+  class AlertsController < Api::AbstractController
+    def index
+      maybe_paginate current_device.alerts
+    end
+
+    def destroy
+      mutate Alerts::Destroy.run(alert: alert)
+    end
+
+    private
+
+    def alert
+      @alert ||= current_device.alerts.find(params[:id])
+    end
+  end
+end

app/controllers/api/demo_accounts_controller.rb

@@ -0,0 +1,70 @@
+module Api
+  class DemoAccountsController < Api::AbstractController
+    skip_before_action :authenticate_user!, only: :create
+
+    # Usually mutations go in seperate files.
+    # In the case of demo accounts, I want the
+    # feature to be easy to delete. If we decide
+    # that things are working fine later on, we
+    # can move this out.
+    class CreateDemo < Mutations::Command
+      required { string :secret }
+
+      def execute
+        self.delay.doing_it_asap
+        {}
+      end
+
+      def doing_it_asap
+        create_user
+        update_fields
+        seed_user
+        broadcast_the_token
+      end
+
+      private
+
+      def email
+        @email ||= ["guest_",
+                    SecureRandom.alphanumeric.downcase,
+                    "@farmbot.guest"].join("")
+      end
+
+      def user
+        @user ||= User.find_by!(email: email)
+      end
+
+      def create_user
+        Users::Create.run!(name: "Guest",
+                           email: email,
+                           password: secret,
+                           password_confirmation: secret,
+                           agree_to_terms: true,
+                           skip_email: true)
+      end
+
+      def update_fields
+        user.update!(confirmed_at: Time.now)
+      end
+
+      def seed_user
+        Devices::CreateSeedData.run!(device: user.device,
+                                     product_line: "demo_account")
+      end
+
+      def broadcast_the_token
+        Transport.current.send_demo_token_to(user, secret)
+      end
+    end
+
+    def create
+      mutate CreateDemo.run(create_params)
+    end
+
+    private
+
+    def create_params
+      @create_params ||= { secret: raw_json.fetch(:secret) }
+    end
+  end
+end

app/controllers/api/devices_controller.rb

@@ -12,12 +12,12 @@ module Api
 
     # POST /api/device
     def create
-      mutate Devices::Create.run(params.as_json, user: current_user)
+      mutate Devices::Create.run(raw_json, user: current_user)
     end
 
     # PATCH/PUT /api/device
     def update
-      mutate Devices::Update.run(params.as_json, device: current_device)
+      mutate Devices::Update.run(raw_json, device: current_device)
     end
 
     # DELETE /api/devices/1
@@ -34,7 +34,15 @@ module Api
       mutate Devices::Sync.run(device: current_device)
     end
 
-  private
+    def seed
+      mutate Devices::CreateSeedData.run raw_json, device: current_device
+    end
+
+    def reset
+      mutate Devices::Reset.run(raw_json, device: current_device)
+    end
+
+    private
 
     # Store the JSON on the local filesystem for self hosted users that don't
     # have email set up.

app/controllers/api/diagnostic_dumps_controller.rb

@@ -1,28 +0,0 @@
-module Api
-  class DiagnosticDumpsController < Api::AbstractController
-
-    def index
-      render json: diagnostic_dumps
-    end
-
-    def create
-      Rollbar.info("Device #{current_device.id} created a diagnostic")
-      mutate DiagnosticDumps::Create.run(raw_json, device: current_device)
-    end
-
-    def destroy
-      diagnostic_dump.destroy!
-      render json: ""
-    end
-
-private
-
-    def diagnostic_dumps
-      current_device.diagnostic_dumps
-    end
-
-    def diagnostic_dump
-      @diagnostic_dump ||= diagnostic_dumps.find(params[:id])
-    end
-  end
-end

app/controllers/api/farm_events_controller.rb

@@ -3,7 +3,7 @@ module Api
     before_action :clean_expired_farm_events, only: [:index]
 
     def index
-      render json: current_device.farm_events
+      maybe_paginate current_device.farm_events
     end
 
     def show

app/controllers/api/farmware_envs_controller.rb

@@ -6,11 +6,11 @@ module Api
   class FarmwareEnvsController < Api::AbstractController
 
     def create
-      mutate FarmwareEnvs::Create.run(params.as_json, device: current_device)
+      mutate FarmwareEnvs::Create.run(raw_json, device: current_device)
     end
 
     def index
-      render json: farmware_envs
+      maybe_paginate farmware_envs
     end
 
     def show

app/controllers/api/farmware_installations_controller.rb

@@ -1,7 +1,7 @@
 module Api
   class FarmwareInstallationsController < Api::AbstractController
     def index
-      render json: farmware_installations
+      maybe_paginate farmware_installations
     end
 
     def show

app/controllers/api/first_party_farmwares_controller.rb

@@ -0,0 +1,32 @@
+module Api
+  class FirstPartyFarmwaresController < Api::AbstractController
+    UPDATED_AT = "2019-08-14 18:33:08.428306"
+    STUBS = {
+      "take-photo" => "https://raw.githubusercontent.com/FarmBot-Labs/farmware_manifests/master/packages/take-photo/manifest_v2.json",
+      "camera-calibration" => "https://raw.githubusercontent.com/FarmBot-Labs/farmware_manifests/master/packages/camera-calibration/manifest_v2.json",
+      "plant-detection" => "https://raw.githubusercontent.com/FarmBot-Labs/farmware_manifests/master/packages/plant-detection/manifest_v2.json",
+      "historical-camera-calibration" => "https://raw.githubusercontent.com/FarmBot-Labs/farmware_manifests/master/packages/historical-camera-calibration/manifest_v2.json",
+      "historical-plant-detection" => "https://raw.githubusercontent.com/FarmBot-Labs/farmware_manifests/master/packages/historical-plant-detection/manifest_v2.json",
+    }
+      .to_a
+      .each_with_index
+      .map do |(package, url), id|
+      {
+        id: (id + 1),
+        created_at: UPDATED_AT,
+        updated_at: UPDATED_AT,
+        url: url,
+        package: package,
+        package_error: nil,
+      }.with_indifferent_access
+    end.index_by { |x| x.fetch(:id).to_s }
+
+    def index
+      render json: STUBS.values
+    end
+
+    def show
+      render json: STUBS.fetch(params[:id])
+    end
+  end
+end

app/controllers/api/folders_controller.rb

@@ -0,0 +1,35 @@
+module Api
+  class FoldersController < Api::AbstractController
+    def create
+      mutate Folders::Create.run(raw_json, device: current_device)
+    end
+
+    def index
+      render json: folders
+    end
+
+    def show
+      render json: folder
+    end
+
+    def update
+      mutate Folders::Update.run(raw_json,
+                                 folder: folder,
+                                 device: current_device)
+    end
+
+    def destroy
+      mutate Folders::Destroy.run(folder: folder, device: current_device)
+    end
+
+    private
+
+    def folder
+      folders.find(params[:id])
+    end
+
+    def folders
+      current_device.folders
+    end
+  end
+end

app/controllers/api/global_bulletins_controller.rb

@@ -0,0 +1,16 @@
+module Api
+  class GlobalBulletinsController < Api::AbstractController
+    skip_before_action :authenticate_user!
+    skip_before_action :check_fbos_version
+
+    def show
+      render json: search_results
+    end
+
+    private
+
+    def search_results
+      @search_results ||= GlobalBulletin.find_by(slug: params[:id])
+    end
+  end
+end

app/controllers/api/logs_controller.rb

@@ -2,21 +2,31 @@ module Api
   class LogsController < Api::AbstractController
     before_action :trim_logs
 
+    SEARCH_FIELDS = {
+      message: :to_s,
+      type: :to_s,
+      verbosity: :to_i,
+      x: :to_f,
+      y: :to_f,
+      z: :to_f,
+    }
+
     def search
-      conf       = current_device.web_app_config
-      mt         = CeleryScriptSettingsBag::ALLOWED_MESSAGE_TYPES
-      query      = mt
-                    .map { |x| "(type = '#{x}' AND verbosity <= ?)" }
-                    .join(" OR ")
-      conditions = mt.map { |x| "#{x}_log" }.map{|x| conf.send(x) }
-      args_      = conditions.unshift(query)
-      limit      = current_device.max_log_count || Device::DEFAULT_MAX_LOGS
+      conf = current_device.web_app_config
+      mt = CeleryScriptSettingsBag::ALLOWED_MESSAGE_TYPES
+      query = mt
+        .map { |x| "(type = '#{x}' AND verbosity <= ?)" }
+        .join(" OR ")
+      conditions = mt.map { |x| "#{x}_log" }.map { |x| conf.send(x) }
+      args_ = conditions.unshift(query)
+      limit = current_device.max_log_count || Device::DEFAULT_MAX_LOGS
 
       render json: current_device
-        .logs
-        .order(created_at: :desc)
-        .where(*args_)
-        .limit(limit)
+               .logs
+               .order(created_at: :desc)
+               .where(*args_)
+               .limit(limit)
+               .where(search_params)
     end
 
     def create
@@ -32,7 +42,7 @@ module Api
       render json: current_device.logs.destroy_all && ""
     end
 
-  private
+    private
 
     def trim_logs
       # WARNING: Calls to `destroy_all` rather than
@@ -40,5 +50,15 @@ module Api
       #   a big table! RC
       current_device.excess_logs.delete_all
     end
+
+    def search_params
+      SEARCH_FIELDS.reduce({}) do |acc, (k, v)|
+        search_term = params[k]
+        if search_term
+          acc[k] = search_term.send(v)
+        end
+        acc
+      end
+    end
   end
 end

app/controllers/api/password_resets_controller.rb

@@ -3,14 +3,15 @@ module Api
     skip_before_action :authenticate_user!, only: [:create, :update]
 
     def create
-      mutate PasswordResets::Create.run(email: params[:email])
+      mutate PasswordResets::Create.run(email: raw_json[:email])
     end
 
     def update
       mutate PasswordResets::Update.run(
-        password:              params[:password],
-        password_confirmation: params[:password_confirmation],
-        token:                 params[:id])
+        password: raw_json[:password],
+        password_confirmation: raw_json[:password_confirmation],
+        token: raw_json[:id],
+      )
     end
   end
 end

app/controllers/api/peripherals_controller.rb

@@ -1,7 +1,7 @@
 module Api
   class PeripheralsController < Api::AbstractController
     def index
-      render json: current_device.peripherals
+      maybe_paginate current_device.peripherals
     end
 
     def show

app/controllers/api/pin_bindings_controller.rb

@@ -1,7 +1,7 @@
 module Api
   class PinBindingsController < Api::AbstractController
     def index
-      render json: pin_bindings
+      maybe_paginate pin_bindings
     end
 
     def show

app/controllers/api/plant_templates_controller.rb

@@ -1,7 +1,7 @@
 module Api
   class PlantTemplatesController < Api::AbstractController
     def index
-      render json: current_device.plant_templates
+      maybe_paginate current_device.plant_templates
     end
 
     def create

app/controllers/api/point_groups_controller.rb

@@ -0,0 +1,39 @@
+module Api
+  class PointGroupsController < Api::AbstractController
+    before_action :clean_expired_farm_events, only: [:destroy]
+
+    def index
+      maybe_paginate your_point_groups
+    end
+
+    def show
+      render json: the_point_group
+    end
+
+    def create
+      mutate PointGroups::Create.run(raw_json, point_group_params)
+    end
+
+    def update
+      mutate PointGroups::Update.run(raw_json, point_group_params, point_group: the_point_group)
+    end
+
+    def destroy
+      mutate PointGroups::Destroy.run(point_group: the_point_group, device: current_device)
+    end
+
+    private
+
+    def the_point_group
+      your_point_groups.find(params[:id])
+    end
+
+    def your_point_groups
+      PointGroup.preload(:point_group_items).where(point_group_params)
+    end
+
+    def point_group_params
+      @point_group_params ||= { device: current_device }
+    end
+  end
+end

app/controllers/api/points_controller.rb

@@ -1,4 +1,4 @@
-require_relative "../../lib/hstore_filter"
+# require_relative "../../lib/mutations/hstore_filter"
 
 module Api
   class PointsController < Api::AbstractController
@@ -7,12 +7,20 @@ module Api
     # Points::Create::POINT_SOFT_LIMIT
     HARD_DELETE_AFTER = 2.months
 
+    # "?filter=all", "?filter=old", "?filter=kept"
+    ARCHIVAL_SCOPES = {
+                        "all" => Point.all,
+                        "old" => Point.discarded,
+                        "kept" => Point.kept,
+                      }
+
     def index
       Point
         .discarded
         .where("discarded_at < ?", Time.now - HARD_DELETE_AFTER)
         .destroy_all
-      render json: points
+
+      maybe_paginate points(params.fetch(:filter) { "kept" })
     end
 
     def show
@@ -35,30 +43,22 @@ module Api
       # TODO: We don't need to do batch requests like this any more.
       # This should be removed when possible. -RC 1 AUG 2018
       ids = params[:id].to_s.split(",").map(&:to_i)
-      mutate Points::Destroy.run({point_ids: ids}, device_params)
+      mutate Points::Destroy.run({ point_ids: ids }, device_params)
     end
 
-  private
+    private
 
     def point
       @point ||= points.find(params[:id])
     end
 
-    def points
-      @points ||= unrestricted_archival_scope.where(device_params)
-    end
-
-    def unrestricted_archival_scope
-      case params[:filter]
-      when "all" then return Point.all
-      when "old" then return Point.discarded
-      else
-        return Point.kept
-      end
+    def points(filter = params[:filter])
+      @points ||=
+        (ARCHIVAL_SCOPES[filter] || ARCHIVAL_SCOPES["all"]).where(device_params)
     end
 
     def device_params
-      @device_params ||= {device: current_device}
+      @device_params ||= { device: current_device }
     end
   end
 end

app/controllers/api/regimens_controller.rb

@@ -3,7 +3,7 @@ module Api
     before_action :clean_expired_farm_events, only: [:destroy]
 
     def index
-      render json: your_regimens
+      maybe_paginate your_regimens
     end
 
     def show

app/controllers/api/rmq_utils_controller.rb

@@ -5,25 +5,66 @@ module Api
   # Any other response results in denial.
   # Results are cached for 10 minutes to prevent too many requests to the API.
   class RmqUtilsController < Api::AbstractController
+    class BrokerConnectionLimiter
+      attr_reader :cache
+
+      CACHE_KEY_TPL = "mqtt_limiter:%s"
+      TTL = 60 * 5 # Five Minutes
+      PER_DEVICE_MAX = 20
+      MAX_GUEST_COUNT = 256
+      WARNING = "'%s' was rate limited."
+
+      class RateLimit < StandardError; end
+
+      def self.current(cache = Rails.cache.redis)
+        self.new(cache)
+      end
+
+      def initialize(cache)
+        @cache = cache
+      end
+
+      def maybe_continue(username)
+        is_guest = (username == FARMBOT_DEMO_USER)
+        max = is_guest ? MAX_GUEST_COUNT : PER_DEVICE_MAX
+        key = CACHE_KEY_TPL % username
+        total = (cache.get(key) || "0").to_i
+        needs_ttl = cache.ttl(key) < 1
+        if total < max
+          cache.incr(key)
+          cache.expire(key, TTL) if needs_ttl
+          yield
+        else
+          Device
+            .delay
+            .connection_warning(username) if !is_guest
+          raise RateLimit, username
+        end
+      end
+    end
+
     # List of AMQP/MQTT topics we support in the following format:
     # "bot.device_123.<MAIN TOPIC HERE>"
     BOT_CHANNELS = %w(
-      nerves_hub
+      from_api
       from_clients
       from_device
       logs
+      nerves_hub
+      ping
+      pong
+      resources_v0
       status
       status_v8
       sync
-      resources_v0
-      from_api
+      telemetry
       \\#
       \\*
     ).map { |x| x + "(\\.|\\z)" }.join("|")
 
     # The only valid format for AMQP / MQTT topics.
     # Prevents a whole host of abuse / security issues.
-    DEVICE_SPECIFIC_CHANNELS = \
+    DEVICE_SPECIFIC_CHANNELS =
       Regexp.new("bot\\.device_\\d*\\.(#{BOT_CHANNELS})")
     PUBLIC_BROADCAST = "public_broadcast"
     PUBLIC_CHANNELS = ["", ".*", ".#"].map { |x| PUBLIC_BROADCAST + x }
@@ -32,6 +73,14 @@ module Api
     VHOST = ENV.fetch("MQTT_VHOST") { "/" }
     RESOURCES = ["queue", "exchange"]
     PERMISSIONS = ["configure", "read", "write"]
+    FARMBOT_DEMO_USER = "farmbot_demo"
+    DEMO_REGISTRY_ROOT = "demos"
+
+    class PasswordFailure < Exception; end
+
+    rescue_from PasswordFailure, with: :report_suspicious_behavior
+    rescue_from BrokerConnectionLimiter::RateLimit, with: :do_rate_limit
+
     skip_before_action :check_fbos_version, except: []
     skip_before_action :authenticate_user!, except: []
 
@@ -44,10 +93,17 @@ module Api
       #   "vhost"     => "/",
       #   "client_id" => "MQTT_FX_Client",
       case username_param
-      when "guest" then deny
+      # NOTE: "guest" is not the same as
+      #       "farmbot_demo". We intentionally
+      #       differentiate to avoid accidental
+      #       security issues. -RC
+      when "guest" then deny("Can't use guest account on this server.")
       when "admin" then authenticate_admin
+      when FARMBOT_DEMO_USER
+        with_rate_limit { allow }
       else
-        device_id_in_username == current_device.id ? allow : deny
+        is_ok = device_id_in_username == current_device.id
+        is_ok ? (with_rate_limit { allow }) : deny("Guests are rate limited")
       end
     end
 
@@ -56,7 +112,7 @@ module Api
       #   "username" => "admin",
       #   "vhost"    => "/",
       #   "ip"       => "::ffff:172.23.0.1",
-      vhost_param == VHOST ? allow : deny
+      vhost_param == VHOST ? allow : deny("Bad vhost")
     end
 
     def resource_action
@@ -67,7 +123,7 @@ module Api
       #   "name"       => "mqtt-subscription-MQTT_FX_Clientqos0",
       #   "permission" => "configure",
       ok = RESOURCES.include?(resource_param) && PERMISSIONS.include?(permission_param)
-      ok ? allow : deny
+      ok ? allow : deny("Bad resource action")
     end
 
     def topic_action # Called during subscribe
@@ -80,10 +136,14 @@ module Api
       #   "vhost"       => "/",
       case routing_key_param
       when *PUBLIC_CHANNELS
-        permission_param == "read" ? allow : deny
+        permission_param == "read" ? allow : deny("Topic is read only")
       else
         if_topic_is_safe do
-          device_id_in_topic == device_id_in_username ? allow : deny
+          if device_id_in_topic == device_id_in_username
+            allow
+          else
+            deny("Unsafe topic")
+          end
         end
       end
     end
@@ -95,17 +155,41 @@ module Api
       allow if admin?
     end
 
+    def farmbot_demo?
+      username_param == FARMBOT_DEMO_USER
+    end
+
     def admin?
       username_param == "admin"
     end
 
     def authenticate_admin
-      correct_pw = password_param == ENV.fetch("ADMIN_PASSWORD")
+      correct_pw = password_param == admin_password
       ok = admin? && correct_pw
-      ok ? allow("management", "administrator") : deny
+      if ok
+        allow("management", "administrator")
+      else
+        raise PasswordFailure
+      end
     end
 
-    def deny
+    def admin_password
+      @admin_password ||= ENV.fetch("ADMIN_PASSWORD")
+    rescue KeyError
+      raise PasswordFailure
+    end
+
+    def report_suspicious_behavior
+      Rollbar.error("Failed password attempt on  RMQ: " + password_param)
+      deny("Failed password attempt")
+    end
+
+    def do_rate_limit
+      deny("Device is rate limited")
+    end
+
+    def deny(reason)
+      maybe_alert_user(reason)
       render json: "deny", status: 403
     end
 
@@ -114,35 +198,76 @@ module Api
     end
 
     def username_param
-      @username ||= params["username"]
+      @username ||= params.fetch("username")
     end
 
     def password_param
-      @password ||= params["password"]
+      @password ||= params.fetch("password")
     end
 
     def routing_key_param
-      @routing_key ||= params["routing_key"]
+      @routing_key ||= params.fetch("routing_key")
     end
 
     def vhost_param
-      @vhost ||= params["vhost"]
+      @vhost ||= params.fetch("vhost")
     end
 
     def resource_param
-      @resource ||= params["resource"]
+      @resource ||= params.fetch("resource")
     end
 
     def permission_param
-      @permission ||= params["permission"]
+      @permission ||= params.fetch("permission")
     end
 
     def if_topic_is_safe
+      if farmbot_demo?
+        a, b, c = (routing_key_param || "").split(".")
+
+        if !(permission_param == "read")
+          deny("!(permission_param == read)")
+          return
+        end
+
+        if !(a == DEMO_REGISTRY_ROOT)
+          deny("!(a == DEMO_REGISTRY_ROOT)")
+          return
+        end
+
+        if b.nil?
+          deny("b.nil?")
+          return
+        end
+
+        if b.include?("*")
+          deny("b.include?(*)")
+          return
+        end
+
+        if b.include?("#")
+          deny("b.include?(#)")
+          return
+        end
+
+        if c.present?
+          deny("c.present?")
+          return
+        end
+
+        yield
+        return
+      end
+
       if !!DEVICE_SPECIFIC_CHANNELS.match(routing_key_param)
         yield
-      else
-        render json: MALFORMED_TOPIC, status: 422
+        return
       end
+
+      msg = "Subscribed to illegal topic #{routing_key_param || ""}"
+      maybe_alert_user(msg)
+
+      render json: MALFORMED_TOPIC, status: 422
     end
 
     def device_id_in_topic
@@ -153,8 +278,15 @@ module Api
         .to_i || 0 # 9
     end
 
+    def with_rate_limit
+      # TODO: Replace this with `ThrottlePolicy`.
+      BrokerConnectionLimiter
+        .current
+        .maybe_continue(username_param) { yield }
+    end
+
     def current_device
-      @current_device ||= Auth::FromJWT.run!(jwt: password_param).device
+      @current_device ||= Auth::FromJwt.run!(jwt: password_param).device
     rescue Mutations::ValidationException => e
       raise JWT::VerificationError, "RMQ Provided bad token"
     end
@@ -162,5 +294,13 @@ module Api
     def device_id_in_username
       @device_id ||= username_param.gsub("device_", "").to_i
     end
+
+    def maybe_alert_user(reason)
+      msg = "MQTT ACCESS DENIED #{reason}"
+      puts msg unless Rails.env.test?
+      if device_id_in_username > 0
+        Device.find(device_id_in_username).delay.tell(msg)
+      end
+    end
   end
 end

app/controllers/api/saved_gardens_controller.rb

@@ -1,7 +1,7 @@
 module Api
   class SavedGardensController < Api::AbstractController
     def index
-      render json: current_device.saved_gardens
+      maybe_paginate current_device.saved_gardens
     end
 
     def create
@@ -19,13 +19,13 @@ module Api
     end
 
     def snapshot
-      mutate SavedGardens::Snapshot.run(params.as_json, device: current_device)
+      mutate SavedGardens::Snapshot.run(raw_json, device: current_device)
     end
 
     def apply
-      params  = { garden:      garden,
-                  device:      current_device,
-                  destructive: (request.method == "POST") }
+      params = { garden: garden,
+                device: current_device,
+                destructive: (request.method == "POST") }
       mutate SavedGardens::Apply.run(params)
     end
 

app/controllers/api/sensor_readings_controller.rb

@@ -1,11 +1,14 @@
 module Api
   class SensorReadingsController < Api::AbstractController
+    LIMIT = 5000
+    before_action :clean_old
+
     def create
-        mutate SensorReadings::Create.run(raw_json, device: current_device)
+      mutate SensorReadings::Create.run(raw_json, device: current_device)
     end
 
     def index
-      render json: readings
+      maybe_paginate(readings)
     end
 
     def show
@@ -17,10 +20,23 @@ module Api
       render json: ""
     end
 
-  private
+    private
+
+    def clean_old
+      if current_device.sensor_readings.count > LIMIT
+        current_device
+          .sensor_readings
+          .where
+          .not(id: readings.pluck(:id))
+          .delete_all
+      end
+    end
 
     def readings
-      SensorReading.where(device: current_device)
+      @readings ||= SensorReading
+        .where(device: current_device)
+        .order(created_at: :desc)
+        .limit(LIMIT)
     end
 
     def reading

app/controllers/api/sensors_controller.rb

@@ -1,7 +1,7 @@
 module Api
   class SensorsController < Api::AbstractController
     def index
-      render json: current_device.sensors
+      maybe_paginate current_device.sensors
     end
 
     def show

app/controllers/api/sequences_controller.rb

@@ -4,8 +4,8 @@ module Api
 
     def index
       render json: sequences
-        .to_a
-        .map { |s| CeleryScript::FetchCelery.run!(sequence: s) }
+               .to_a
+               .map { |s| CeleryScript::FetchCelery.run!(sequence: s) }
     end
 
     def show
@@ -18,8 +18,8 @@ module Api
 
     def update
       mutate Sequences::Update.run(sequence_params,
-                                    device: current_device,
-                                    sequence: sequence)
+                                   device: current_device,
+                                   sequence: sequence)
     end
 
     def destroy
@@ -29,7 +29,7 @@ module Api
     private
 
     def sequence_params
-        @sequence_params ||= raw_json[:sequence] || raw_json || {}
+      @sequence_params ||= raw_json[:sequence] || raw_json || {}
     end
 
     def sequences

app/controllers/api/tokens_controller.rb

@@ -48,7 +48,7 @@ module Api
     end
 
     def if_properly_formatted
-      user = params.as_json.deep_symbolize_keys.fetch(:user, {})
+      user = raw_json.fetch(:user, {})
       # If data handling for this method gets any more complicated,
       # extract into a mutation.
       if(user.is_a?(Hash))

app/controllers/api/tools_controller.rb

@@ -2,7 +2,7 @@ module Api
   class ToolsController < Api::AbstractController
 
     def index
-      render json: tools
+      maybe_paginate tools
     end
 
     def show

app/controllers/api/users_controller.rb

@@ -22,7 +22,7 @@ module Api
 
     def resend_verification
       mutate Users::ResendVerification
-        .run(user: User.find_by!(email: params[:email]))
+               .run(user: User.find_by!(email: raw_json[:email]))
     end
 
     def control_certificate
@@ -32,17 +32,17 @@ module Api
     private
 
     def user_params
-      user = params
-        .as_json
-        .merge!(params.as_json["user"] || {})
+      user = raw_json
+        .merge!(raw_json[:user] || {})
         .deep_symbolize_keys
-      {email:                     user[:email],
-       name:                      user[:name],
-       password:                  user[:password],
-       password_confirmation:     user[:password_confirmation],
-       new_password:              user[:new_password],
+      { email: user[:email],
+       name: user[:name],
+       password: user[:password],
+       password_confirmation: user[:password_confirmation],
+       new_password: user[:new_password],
        new_password_confirmation: user[:new_password_confirmation],
-       agree_to_terms:            user[:agree_to_terms]}
+       agree_to_terms: user[:agree_to_terms],
+       skip_email: User::SKIP_EMAIL_VALIDATION }
     end
   end
 end

app/controllers/api/webcam_feeds_controller.rb

@@ -3,11 +3,11 @@
 module Api
   class WebcamFeedsController < Api::AbstractController
     def create
-      mutate WebcamFeeds::Create.run(params.as_json, device: current_device)
+      mutate WebcamFeeds::Create.run(raw_json, device: current_device)
     end
 
     def index
-      render json: webcams
+      maybe_paginate webcams
     end
 
     def show
@@ -15,14 +15,14 @@ module Api
     end
 
     def update
-      mutate WebcamFeeds::Update.run(params.as_json, webcam_feed: webcam)
+      mutate WebcamFeeds::Update.run(raw_json, webcam_feed: webcam)
     end
 
     def destroy
       render json: webcam.destroy! && ""
     end
 
-  private
+    private
 
     def webcam
       webcams.find(params[:id])

app/controllers/application_controller.rb

@@ -7,7 +7,8 @@ class ApplicationController < ActionController::Base
       @current_device
     else
       @current_device = (current_user.try(:device) || no_device)
-      Device.current  = @current_device # Mutable state eww
+      # Mutable state eww
+      Device.send(:current=, @current_device)
       @current_device
     end
   end

app/controllers/dashboard_controller.rb

@@ -3,43 +3,47 @@ class DashboardController < ApplicationController
   layout "dashboard"
 
   # === THESE CONSTANTS ARE CONFIGURABLE: ===
-  EVERY_STATIC_PAGE = [ :front_page,
-                        :main_app,
-                        :password_reset,
-                        :tos_update, ]
+  EVERY_STATIC_PAGE = [:front_page,
+                       :main_app,
+                       :password_reset,
+                       :tos_update,
+                       :os_download,
+                       :demo]
 
   OUTPUT_URL = "/" + File.join("assets", "parcel") # <= served from public/ dir
                                                    # <= See PUBLIC_OUTPUT_DIR
-  CACHE_DIR  = File.join(".cache")
+  CACHE_DIR = File.join(".cache")
 
-  CSS_INPUTS  = {
+  CSS_INPUTS = {
     front_page: "/css/laptop_splash.scss",
-    default:    "/css/_index.scss",
+    default: "/css/_index.scss",
   }.with_indifferent_access
 
-  JS_INPUTS   = {
-    main_app:       "/entry.tsx",
-    front_page:     "/front_page/index.tsx",
+  JS_INPUTS = {
+    main_app: "/entry.tsx",
+    front_page: "/front_page/index.tsx",
     password_reset: "/password_reset/index.tsx",
-    tos_update:     "/tos_update/index.tsx",
+    tos_update: "/tos_update/index.tsx",
+    demo: "/demo/index.tsx",
+    os_download: "/os_download/index.tsx"
   }.with_indifferent_access
 
   # === THESE CONSTANTS ARE NON-CONFIGURABLE. ===
   # They are calculated based on config above.
 
-  RELEASE_CHUNK     = GlobalConfig::LONG_REVISION == "NONE" ?
+  RELEASE_CHUNK = GlobalConfig::LONG_REVISION == "NONE" ?
     SecureRandom.hex.first(5) : GlobalConfig::LONG_REVISION
   CACHE_BUST_STRING = "?version=#{RELEASE_CHUNK}"
   PUBLIC_OUTPUT_DIR = File.join("public", OUTPUT_URL)
 
   CSS_OUTPUTS = CSS_INPUTS.reduce({}) do |acc, (k, v)|
-    file     = v.gsub(/\.scss$/, ".css")
+    file = v.gsub(/\.scss$/, ".css")
     acc[k] = File.join(OUTPUT_URL, file)
     acc
   end.with_indifferent_access
 
   JS_OUTPUTS = JS_INPUTS.reduce({}) do |acc, (k, v)|
-    file   = v.gsub(/\.tsx?$/, ".js")
+    file = v.gsub(/\.tsx?$/, ".js")
     acc[k] = File.join(OUTPUT_URL, file)
     acc
   end.with_indifferent_access
@@ -50,9 +54,9 @@ class DashboardController < ApplicationController
     .map { |x| File.join("frontend", x) }
     .join(" ")
 
-  PARCEL_HMR_OPTS   = [
+  PARCEL_HMR_OPTS = [
     "--no-hmr",
-    "--no-cache"
+    "--no-cache",
   ].join(" ")
 
   EVERY_STATIC_PAGE.map do |actn|
@@ -61,22 +65,22 @@ class DashboardController < ApplicationController
         # If you don't do this, you will hit hard to debug
         # CSP errors on local when changing API_HOST.
         response.headers["Cache-Control"] = "no-cache, no-store"
-        response.headers["Pragma"]        = "no-cache"
-        response.headers["Expires"]       = "0"
+        response.headers["Pragma"] = "no-cache"
+        response.headers["Expires"] = "0"
         load_css_assets
         load_js_assets
         render actn
       rescue ActionView::MissingTemplate => q
-        raise ActionController::RoutingError, "Bad URL in dashboard"
+        raise ActionController::RoutingError, "Bad URL in dashboard. -Rick"
       end
     end
   end
 
   def confirmation_page
     load_css_assets
-    user   = User.find_by!(confirmation_token: params.fetch(:token))
+    user = User.find_by!(confirmation_token: params.fetch(:token))
     # Two use cases:                  re-confirmation   Email change
-    klass  = user.unconfirmed_email? ? Users::Reverify : Users::Verify
+    klass = user.unconfirmed_email? ? Users::Reverify : Users::Verify
     @token = klass.run!(user: user).to_json
     render :confirmation_page
   rescue User::AlreadyVerified
@@ -90,10 +94,8 @@ class DashboardController < ApplicationController
     begin
       report = JSON.parse(payload)
     rescue
-      report = {problem: "Crashed while parsing report"}
+      report = { problem: "Crashed while parsing report" }
     end
-    Rollbar.info("CSP Violation", report)
-
     render json: report
   end
 
@@ -101,13 +103,17 @@ class DashboardController < ApplicationController
   # Do not use this if you use GCS- it will slow your app down.
   def direct_upload
     raise "No." unless Api::ImagesController.store_locally
-    name        = params.fetch(:key).split("/").last
-    path        = File.join("public", "direct_upload", "temp", name)
+    name = params.fetch(:key).split("/").last
+    path = File.join("public", "direct_upload", "temp", name)
     File.open(path, "wb") { |f| f.write(params[:file]) }
     render json: ""
   end
 
-private
+  def logout
+  end
+
+  private
+
   def load_css_assets
     @css_assets ||= [action_name, :default].reduce([]) do |list, action|
       asset = CSS_OUTPUTS[action] # Not every endpoint has custom CSS.
@@ -118,8 +124,8 @@ private
 
   def load_js_assets
     # Every DashboardController has a JS SBundle.
-    @js_assets ||= \
-      [ JS_OUTPUTS.fetch(action_name) ].map { |x| x + CACHE_BUST_STRING }
+    @js_assets ||=
+      [JS_OUTPUTS.fetch(action_name)].map { |x| x + CACHE_BUST_STRING }
   end
 
   def set_global_config

app/jobs/inactive_account_job.rb

@@ -0,0 +1,72 @@
+# Recurring task that deletes inactive accounts.
+class InactiveAccountJob < ApplicationJob
+  queue_as :default
+  LIMIT = 1000
+  ORDER = "RANDOM()"
+  INACTIVE_WITH_DEVICE = 11.months + 15.days
+  INACTIVE_NO_DEVICE = 2.months + 15.days
+  WARNING_TIME = 14.days
+
+  def users
+    User.includes(:device)
+  end
+
+  # They signed up for an account, but never configured a device.
+  def no_device
+    users
+      .where("devices.fbos_version" => nil)
+      .references(:devices)
+  end
+
+  # They signed up for an account and once had a working device.
+  def ok_device
+    users
+      .where
+      .not("devices.fbos_version" => nil)
+      .references(:devices)
+  end
+
+  def inactive_3mo
+    no_device
+      .where("last_sign_in_at < ?", INACTIVE_NO_DEVICE.ago)
+  end
+
+  def inactive_11mo
+    ok_device
+      .where("last_sign_in_at < ?", INACTIVE_WITH_DEVICE.ago)
+  end
+
+  # Returns a Map. Key is the number of warnings sent, value is a User object
+  # (not a device, but device is preloaded)
+  def all_inactive
+    @all_inactive ||= inactive_11mo.or(inactive_3mo).order(ORDER).limit(LIMIT)
+  end
+
+  def notify_old_accounts
+    all_inactive
+      .where(inactivity_warning_sent_at: nil)
+      .map(&:send_inactivity_warning)
+  end
+
+  def delete_old_accounts
+    all_inactive
+      .where
+      .not(inactivity_warning_sent_at: nil)
+      .where("inactivity_warning_sent_at < ?", WARNING_TIME.ago)
+      .map(&:deactivate_account)
+  end
+
+  # EDGE CASE: Accounts that register but never sign in.
+  def cleanup_nils
+    User
+      .where(last_sign_in_at: nil)
+      .limit(LIMIT)
+      .map { |x| x.update!(last_sign_in_at: x.created_at) }
+  end
+
+  def perform
+    cleanup_nils
+    notify_old_accounts
+    delete_old_accounts
+  end
+end

app/lib/abstract_service_runner.rb

@@ -0,0 +1,19 @@
+class AbstractServiceRunner
+  WAIT_TIME = Rails.env.test? ? 0.01 : 5
+  OFFLINE_ERROR = Bunny::TCPConnectionFailedForAllHosts
+  CRASH_MSG = Rails.env.test? ?
+    "\e[32m.\e[0m" : "Something caused the broker to crash...\n"
+
+  def go!(channel)
+    channel.subscribe(block: true) do |info, _, payl|
+      self.process(info, payl.force_encoding("UTF-8"))
+    end
+  rescue OFFLINE_ERROR, StandardError => e
+    unless e.is_a?(OFFLINE_ERROR)
+      Rollbar.error(e)
+      print CRASH_MSG
+    end
+    sleep WAIT_TIME
+    retry
+  end
+end

app/lib/amqp_log_parser.rb

@@ -7,20 +7,22 @@ class AmqpLogParser < Mutations::Command
   TOO_OLD = "fbos version is out of date"
   DISCARD = "message type field is not the kind that gets saved in the DB"
   NOT_HASH = "logs must be a hash"
-
+  NOT_JSON = "Invalid JSON. Use a JSON validator."
   # I keep a Ruby copy of the JSON here for reference.
   # This is what a log will look like after JSON.parse()
   EXAMPLE_JSON = {
-    "meta" => {
-      "x" => 0,
-      "y" => 0,
-      "z" => 0,
-      "type" => "info",
-    },
-    "major_version" => 6,        # <=  up-to-date bots do this
-    "message" => "HQ FarmBot TEST 123 Pin 13 is 0",
-    "created_at" => 1512585641,
     "channels" => [],
+    "created_at" => 1572015955,
+    "major_version" => 8,
+    "message" => "Syncing",
+    "meta" => {},
+    "minor_version" => 1,
+    "patch_version" => 1,
+    "type" => "info",
+    "verbosity" => 3,
+    "x" => 0.0,
+    "y" => 0.0,
+    "z" => 0.0,
   }
 
   required do
@@ -48,7 +50,7 @@ class AmqpLogParser < Mutations::Command
     # Prevents "runaway" bots from flooding the server with frivolous database
     # hits by using in memory cache of results for 150 seconds.
     def device
-      Device.cached_find(device_id)
+      Device.find(device_id)
     end
   end
 
@@ -75,6 +77,8 @@ class AmqpLogParser < Mutations::Command
   def set_payload!
     # Parse from string to a Ruby hash (JSON)
     @output.payload = JSON.parse(payload)
+  rescue JSON::ParserError
+    add_error :json, :not_json, NOT_JSON
   end
 
   def log
@@ -100,8 +104,19 @@ class AmqpLogParser < Mutations::Command
   end
 
   def find_problems!
-    @output.problems.push(NOT_HASH) and return if not_hash?
-    @output.problems.push(TOO_OLD) and return if major_version < 6
-    @output.problems.push(DISCARD) and return if discard?
+    if not_hash?
+      @output.problems.push(NOT_HASH)
+      return
+    end
+
+    if (major_version || 0) < 7
+      @output.problems.push(TOO_OLD)
+      return
+    end
+
+    if discard?
+      @output.problems.push(DISCARD)
+      return
+    end
   end
 end

app/lib/celery_script/ast_leaf.rb

@@ -6,9 +6,10 @@
 module CeleryScript
   class AstLeaf < AstBase
     FRIENDLY_ERRORS = CeleryScript::Checker::FRIENDLY_ERRORS
-    BAD_LEAF        = CeleryScript::Checker::BAD_LEAF
+    BAD_LEAF = CeleryScript::Checker::BAD_LEAF
 
     attr_reader :kind, :value, :parent
+
     def initialize(parent, value, kind)
       @parent, @value, @kind = parent, value, kind
     end
@@ -17,14 +18,13 @@ module CeleryScript
       allowed = corpus.fetchArg(kind).allowed_values
       unless allowed.any? { |spec| spec.valid?(self, corpus) }
         message = (FRIENDLY_ERRORS.dig(kind, parent.kind) || BAD_LEAF) % {
-          kind:        kind,
+          kind: kind,
           parent_kind: parent.kind,
-          allowed:     "[#{allowed.map(&:name).join(", ")}]",
-          actual:      value.class
+          allowed: "[#{allowed.map(&:name).join(", ")}]",
+          actual: value.class,
         }
         raise TypeCheckError, message
       end
     end
-
   end
 end

app/lib/celery_script/ast_node.rb

@@ -3,102 +3,102 @@
 # other nodes (*always* optional).
 module CeleryScript
   class AstNode < AstBase
-      attr_reader :args, :body, :comment, :kind, :parent
-      BODY_HAS_NON_NODES = "The `body` of a node can only contain nodes- " \
-                           "no leaves here."
-      LEAVES_NEED_KEYS   = "Tried to initialize a leaf without a key."
-      NEVER              = :__NEVER__
-      FRIENDLY_ERRORS    = CeleryScript::Checker::FRIENDLY_ERRORS
-      BAD_LEAF           = CeleryScript::Checker::BAD_LEAF
+    attr_reader :args, :body, :comment, :kind, :parent
+    BODY_HAS_NON_NODES = "The `body` of a node can only contain nodes- " \
+                         "no leaves here."
+    LEAVES_NEED_KEYS = "Tried to initialize a leaf without a key."
+    NEVER = :__NEVER__
+    FRIENDLY_ERRORS = CeleryScript::Checker::FRIENDLY_ERRORS
+    BAD_LEAF = CeleryScript::Checker::BAD_LEAF
 
-      def initialize(parent = nil, args:, body: nil, comment: "", kind:, uuid: nil)
-          @comment, @kind, @parent = comment, kind, parent
+    def initialize(parent = nil, args:, body: nil, comment: "", kind:, uuid: nil)
+      @comment, @kind, @parent = comment, kind, parent
 
-          @args = args.map do |key, value|
-            [key.to_sym, maybe_initialize(self, value, key)]
-          end.to_h if args
+      @args = args.map do |key, value|
+        [key.to_sym, maybe_initialize(self, value, key)]
+      end.to_h if args
 
-          @body = body.map do |e|
-            raise TypeCheckError, BODY_HAS_NON_NODES unless is_node?(e)
-            maybe_initialize(self, e)
-          end if body
+      @body = body.map do |e|
+        raise TypeCheckError, BODY_HAS_NON_NODES unless is_node?(e)
+        maybe_initialize(self, e)
+      end if body
+    end
+
+    def maybe_initialize(parent, leaf_or_node, key = NEVER)
+      if is_node?(leaf_or_node)
+        AstNode.new(parent, **leaf_or_node)
+      else
+        raise TypeCheckError, LEAVES_NEED_KEYS if key == NEVER
+        AstLeaf.new(parent, leaf_or_node, key)
+      end
+    end
+
+    def is_node?(hash)
+      hash.is_a?(Hash) &&
+      hash.symbolize_keys! &&
+      hash.has_key?(:kind) &&
+      hash.has_key?(:args) &&
+      (hash[:body].is_a?(Array) || hash[:body] == nil) &&
+      (hash[:comment].is_a?(String) || hash[:comment] == nil) &&
+      (hash[:args].is_a?(Hash)) &&
+      (hash[:kind].is_a?(String))
+    end
+
+    # Calling this method with only one parameter
+    # indicates a starting condition 🏁
+    def resolve_variable!(origin = self)
+      locals = args[:locals]
+
+      if locals&.kind === "scope_declaration"
+        label = origin.args[:label]&.value
+        result = (locals.body || []).select do |x|
+          x.args[:label]&.value == label
+        end.first
+        return result if result
       end
 
-      def maybe_initialize(parent, leaf_or_node, key = NEVER)
-        if is_node?(leaf_or_node)
-          AstNode.new(parent, leaf_or_node)
-        else
-          raise TypeCheckError, LEAVES_NEED_KEYS if key == NEVER
-          AstLeaf.new(parent, leaf_or_node, key)
-        end
+      case parent
+      when AstNode
+        # sequence: Check the `scope` arg
+        # Keep recursing if we can't find a scope on this node
+        parent.resolve_variable!(origin)
+      when nil # We've got an unbound variable.
+        origin.invalidate!(UNBOUND_VAR % origin.args[:label].value)
       end
+    end
 
-      def is_node?(hash)
-        hash.is_a?(Hash) &&
-        hash.symbolize_keys! &&
-        hash.has_key?(:kind) &&
-        hash.has_key?(:args) &&
-        (hash[:body].is_a?(Array) || hash[:body] == nil) &&
-        (hash[:comment].is_a?(String) || hash[:comment] == nil) &&
-        (hash[:args].is_a?(Hash)) &&
-        (hash[:kind].is_a?(String))
-      end
-
-      # Calling this method with only one parameter
-      # indicates a starting condition 🏁
-      def resolve_variable!(origin = self)
-        locals = args[:locals]
-
-        if locals&.kind === "scope_declaration"
-          label  = origin.args[:label]&.value
-          result = (locals.body || []).select do |x|
-            x.args[:label]&.value == label
-          end.first
-          return result if result
-        end
-
-        case parent
-        when AstNode
-          # sequence: Check the `scope` arg
-          # Keep recursing if we can't find a scope on this node
-          parent.resolve_variable!(origin)
-        when nil # We've got an unbound variable.
-          origin.invalidate!(UNBOUND_VAR % origin.args[:label].value)
-        end
-      end
-
-      def todo
+    def todo
 
       # Don't delete this- it is currently unreachable code, but as soon as we
       # allow identifiers other than `point`, `tool` and `coordinate` we will
       # need it again (and can write tests)
-      end
+    end
 
-      def cross_check(corpus, key)
-        actual  = kind
-        allowed = corpus.fetchArg(key).allowed_values
-        # It would be safe to run type checking here.
-        if (actual == "identifier")
-          allowed_types  = allowed.filter { |x| x.tag == :identifier }
-          var = resolve_variable!
-          case var.kind
-          when "parameter_declaration" then todo
-          when "variable_declaration"
-            # REASSIGNMENT WARNING!:
-            actual = var.args[:data_value].kind
-          end
-        end
-
-        unless allowed.map(&:name).include?(actual)
-          message = (FRIENDLY_ERRORS.dig(kind, parent.kind) || BAD_LEAF) % {
-            kind:        kind,
-            parent_kind: parent.kind,
-            allowed:     allowed.map(&:name),
-            actual:      actual
-          }
-
-          raise TypeCheckError, message
+    def cross_check(corpus, key)
+      actual = kind
+      allowed = corpus.fetchArg(key).allowed_values
+      # It would be safe to run type checking here.
+      if (actual == "identifier")
+        allowed_types = allowed.filter { |x| x.tag == :identifier }
+        var = resolve_variable!
+        case var.kind
+        when "parameter_declaration" then todo
+        when "variable_declaration"
+          # REASSIGNMENT WARNING!:
+          actual = var.args[:data_value].kind
         end
       end
+
+      unless allowed.map(&:name).include?(actual)
+        message = (FRIENDLY_ERRORS.dig(kind, parent.kind) || BAD_LEAF) % {
+          kind: kind,
+          parent_kind: parent.kind,
+          allowed: allowed.map(&:name),
+          actual: actual,
+        }
+
+        raise TypeCheckError, message
+      end
+    end
   end
 end

app/lib/celery_script/checker.rb

@@ -3,17 +3,20 @@
 # this part last
 module CeleryScript
   UNBOUND_VAR = "Unbound variable: %s"
+
   class TypeCheckError < StandardError; end
 
   class Checker
     MISSING_ARG = "Expected node '%s' to have a '%s', but got: %s."
-    EXTRA_ARGS  = "'%s' has unexpected arguments: %s. Allowed arguments: %s"
-    BAD_LEAF    = "Expected leaf '%{kind}' within '%{parent_kind}'"\
-                  " to be one of: %{allowed} but got %{actual}"
-    MALFORMED   = "Expected '%s' to be a node or leaf, but it was neither"
-    BAD_BODY    = "Body of '%s' node contains '%s' node. "\
-                  "Expected one of: %s"
-    T_MISMATCH  = "Type mismatch. %s must be one of: %s. Got: %s"
+    EXTRA_ARGS = "'%s' has unexpected arguments: %s. Allowed arguments: %s"
+    BAD_LEAF = "Expected leaf '%{kind}' within '%{parent_kind}'" \
+               " to be one of: %{allowed} but got %{actual}"
+    MALFORMED = "Expected '%s' to be a node or leaf, but it was neither"
+    BAD_BODY = "Body of '%s' node contains '%s' node. " \
+               "Expected one of: %s"
+    T_MISMATCH = "Type mismatch. %s must be one of: %s. Got: %s"
+    MISSING_VAR = "You must select a Location for the Location Variable."
+    MISSING_PARAM = "You must select a Default Value for the Location Variable."
 
     # Certain CeleryScript pairing errors are more than just a syntax error.
     # For instance, A `nothing` node in a `parameter_declaration` is often an
@@ -22,8 +25,13 @@ module CeleryScript
     # BAD_LEAF template.
     FRIENDLY_ERRORS = {
       nothing: {
-        variable_declaration: "You must provide a value for all parameters",
-        parameter_declaration: "You must provide a value for all parameters",
+        write_pin: "You must select a Peripheral in the Control Peripheral step.",
+        toggle_pin: "You must select a Peripheral in the Toggle Peripheral step.",
+        variable_declaration: MISSING_VAR,
+        parameter_declaration: MISSING_PARAM,
+        read_pin: "You must select a Sensor in the Read Sensor step.",
+        move_absolute: "You must select a Location in the Move To step.",
+        execute: CeleryScriptSettingsBag::NO_SUB_SEQ,
       },
     }.with_indifferent_access
 
@@ -37,7 +45,12 @@ module CeleryScript
 
     # This is the type checker entry point after initialization.
     def run!
-      CeleryScript::TreeClimber.travel(tree, method(:validate).to_proc)
+      # NOTE: Some nodes require knowledge of
+      # `Device.current` in order to validate
+      # properly
+      device.auto_sync_transaction do
+        CeleryScript::TreeClimber.travel(tree, method(:validate).to_proc)
+      end
       tree
     end
 
@@ -89,7 +102,7 @@ module CeleryScript
         unless has_key
           msgs = node.args.keys.join(", ")
           msgs = "nothing" if msgs.length < 1
-          msg  = MISSING_ARG % [node.kind, arg, msgs]
+          msg = MISSING_ARG % [node.kind, arg, msgs]
           raise TypeCheckError, msg
         end
       end

app/lib/celery_script/cs_heap.rb

@@ -9,8 +9,8 @@
 #   * You need to create "traces" of where you are in a sequence (using numbers)
 # MORE INFO: https://github.com/FarmBot-Labs/Celery-Slicer
 module CeleryScript
-  # Supporting class for CSHeap (below this class)
-  # PROBLEM:  CSHeap uses numbers to address sibling/parent nodes.
+  # Supporting class for CsHeap (below this class)
+  # PROBLEM:  CsHeap uses numbers to address sibling/parent nodes.
   # PROBLEM:  Numbers are very easy to mix up. Is it an array index? A SQL
   #           primary key? A primitive value? It's not always easy to say.
   # SOLUTION: Create a `HeapAddress` value type to remove ambiguity.
@@ -60,21 +60,22 @@ module CeleryScript
     end
   end
 
-  class CSHeap
-    class BadAddress < Exception; end;
+  class CsHeap
+    class BadAddress < Exception; end
+
     BAD_ADDR = "Bad node address: "
     # Nodes that point to other nodes rather than primitive data types (eg:
     # `locals` and friends) will be prepended with a LINK.
-    LINK    = "__"
+    LINK = "__"
     # Points to the originator (parent) of an `arg` or `body` node.
-    PARENT  = (LINK + "parent").to_sym
+    PARENT = (LINK + "parent").to_sym
     # Points to the first element in the `body``
-    BODY    = (LINK + "body").to_sym
+    BODY = (LINK + "body").to_sym
     # Points to the next node in the body chain. Pointing to NOTHING indicates
     # the end of the body linked list.
-    NEXT    = (LINK + "next").to_sym
+    NEXT = (LINK + "next").to_sym
     # Unique key name. See `celery_script_settings_bag.rb`
-    KIND    = :__KIND__
+    KIND = :__KIND__
     COMMENT = :__COMMENT__
 
     # Keys that primary nodes must have
@@ -82,17 +83,16 @@ module CeleryScript
 
     # Index 0 of the heap represents a null pointer of sorts.
     # If a field points to this address, it is considered empty.
-    NULL    = HeapAddress[0]
+    NULL = HeapAddress[0]
 
     # What you will find at index 0 of the heap:
     NOTHING = {
-      KIND   => "nothing",
+      KIND => "nothing",
       PARENT => NULL,
-      BODY   => NULL,
-      NEXT   => NULL
+      BODY => NULL,
+      NEXT => NULL,
     }
 
-
     # A dictionary of nodes in the CeleryScript tree, as stored in the heap.
     # Nodes will have:
     #   * A `KIND` field   - What kind of node is it?
@@ -113,7 +113,7 @@ module CeleryScript
 
     # Set "here" to "null". Prepopulates "here" with an empty entry.
     def initialize
-      @here    = NULL
+      @here = NULL
       @entries = { @here => NOTHING }
     end
 

app/lib/celery_script/fetch_celery.rb

@@ -1,4 +1,4 @@
-require_relative "./csheap"
+require_relative "./cs_heap"
 
 # Service object that:
 # 1. Pulls out all PrimaryNodes and EdgeNodes for a sequence node (AST Flat IR form)
@@ -8,7 +8,7 @@ require_relative "./csheap"
 # DEFAULT.
 module CeleryScript
   class FetchCelery < Mutations::Command
-  private  # = = = = = = =
+    private  # = = = = = = =
     # This class is too CPU intensive to make multiple SQL requests.
     # To speed up querying, we create an in-memory index for frequently
     # looked up attributes such as :id, :kind, :parent_id, :primary_node_id
@@ -60,7 +60,7 @@ module CeleryScript
     # that node's children (or an empty array, since body is always optional).
     def get_body_elements(origin)
       next_node = find_by_id_in_memory(origin.body_id)
-      results   = []
+      results = []
       until next_node.kind == "nothing"
         results.push(next_node)
         next_node = find_by_id_in_memory(next_node[:next_id])
@@ -71,7 +71,7 @@ module CeleryScript
     # Top level function call for converting a single EdgeNode into a JSON
     # document. Returns Ruby hash that conforms to CeleryScript semantics.
     def recurse_into_node(node)
-      out  = { kind: node.kind, args: recurse_into_args(node) }
+      out = { kind: node.kind, args: recurse_into_args(node) }
       body = get_body_elements(node)
       if body.empty?
         # Legacy sequences *must* have body on sequence. Others are fine.
@@ -87,16 +87,18 @@ module CeleryScript
     # Eg: color, id, etc.
     def misc_fields
       return {
-        id:         sequence.id,
-        created_at: sequence.created_at,
-        updated_at: sequence.updated_at,
-        args:       Sequence::DEFAULT_ARGS,
-        color:      sequence.color,
-        name:       sequence.name
-      }
+               id: sequence.id,
+               created_at: sequence.created_at,
+               updated_at: sequence.updated_at,
+               folder_id: sequence.folder_id,
+               args: Sequence::DEFAULT_ARGS,
+               color: sequence.color,
+               name: sequence.name,
+             }
     end
 
-  public # = = = = = = =
+    public # = = = = = = =
+
     NO_SEQUENCE = "You must have a root node `sequence` at a minimum."
 
     required do

app/lib/celery_script/first_pass.rb

@@ -1,7 +1,7 @@
-require_relative "./csheap"
+require_relative "./cs_heap"
 
 # ABOUT THIS CLASS:
-#   CSHeap creates an in memory representation of a Flat IR tree using array
+#   CsHeap creates an in memory representation of a Flat IR tree using array
 #   indexes (HeapAddress instances, really). This class takes a flat IR tree
 #   from memory and converts `HeapAddress`es to SQL primary/foreign keys.
 module CeleryScript
@@ -10,14 +10,14 @@ module CeleryScript
     # The following constants are abbreviations of the full name, since the
     # full name is quite long and they are referenced frequently in the code.
     # Just remember that "B" is "BODY", "K" is "KIND", etc...
-    B    = CeleryScript::CSHeap::BODY
-    C    = CeleryScript::CSHeap::COMMENT
-    K    = CeleryScript::CSHeap::KIND
-    L    = CeleryScript::CSHeap::LINK
-    N    = CeleryScript::CSHeap::NEXT
-    P    = CeleryScript::CSHeap::PARENT
-    NULL = CeleryScript::CSHeap::NULL
-    I    = :instance
+    B = CeleryScript::CsHeap::BODY
+    C = CeleryScript::CsHeap::COMMENT
+    K = CeleryScript::CsHeap::KIND
+    L = CeleryScript::CsHeap::LINK
+    N = CeleryScript::CsHeap::NEXT
+    P = CeleryScript::CsHeap::PARENT
+    NULL = CeleryScript::CsHeap::NULL
+    I = :instance
 
     required do
       model :sequence, class: Sequence
@@ -28,7 +28,7 @@ module CeleryScript
     def validate
       #       IF YOU REMOVE THIS BAD STUFF WILL HAPPEN:
       #       version is never user definable!
-      sequence_hash[:args] = \
+      sequence_hash[:args] =
         Sequence::DEFAULT_ARGS.merge(sequence_hash[:args] || {})
       # See comment above ^ TODO: Investigate removal now that EdgeNodes exist.
     end
@@ -37,67 +37,67 @@ module CeleryScript
       Sequence.transaction do
         flat_ir
           .each do |node|
-            # Step 1- instantiate records.
-            node[I] = PrimaryNode.create!(kind:     node[K],
-                                          sequence: sequence,
-                                          comment:  node[C] || nil)
-          end
+          # Step 1- instantiate records.
+          node[I] = PrimaryNode.create!(kind: node[K],
+                                        sequence: sequence,
+                                        comment: node[C] || nil)
+        end
           .each_with_index do |node, index|
-            # Step 2- Assign SQL ids (not to be confused with array index IDs or
-            # instances of HeapAddress), also sets parent_arg_name
-            model                 = node[I]
-            model.parent_arg_name = parent_arg_name_for(node, index)
-            model.body_id         = fetch_sql_id_for(B, node)
-            model.parent_id       = fetch_sql_id_for(P, node)
-            model.next_id         = fetch_sql_id_for(N, node)
-            node
-          end
+          # Step 2- Assign SQL ids (not to be confused with array index IDs or
+          # instances of HeapAddress), also sets parent_arg_name
+          model = node[I]
+          model.parent_arg_name = parent_arg_name_for(node, index)
+          model.body_id = fetch_sql_id_for(B, node)
+          model.parent_id = fetch_sql_id_for(P, node)
+          model.next_id = fetch_sql_id_for(N, node)
+          node
+        end
           .map do |node|
-            # Step 3- Set edge nodes
-            pairs = node
-              .to_a
-              .select do |x|
-                key = x.first.to_s
-                (x.first != I) && !key.starts_with?(L)
-              end
-              .map do |(key, value)|
-                EdgeNode.create!(kind:            key,
-                                 value:           value,
-                                 sequence_id:     sequence.id,
-                                 primary_node_id: node[:instance].id)
-              end
-              node[:instance]
+          # Step 3- Set edge nodes
+          pairs = node
+            .to_a
+            .select do |x|
+            key = x.first.to_s
+            (x.first != I) && !key.starts_with?(L)
           end
-          .tap { |x| sequence.update_attributes(migrated_nodes: true) unless sequence.migrated_nodes }
+            .map do |(key, value)|
+            EdgeNode.create!(kind: key,
+                             value: value,
+                             sequence_id: sequence.id,
+                             primary_node_id: node[:instance].id)
+          end
+          node[:instance]
+        end
+          .tap { |x| sequence.update(migrated_nodes: true) unless sequence.migrated_nodes }
           .map { |x|
-            x.save! if x.changed?
-            x
-          }
+          x.save! if x.changed?
+          x
+        }
       end
     end
 
-private
+    private
 
     # Index every primary node in memory by its `HeapAddress`.
     # We need this info in order to fill out the `parent_arg_name` of a node.
     def every_primary_link
       @every_primary_link ||= flat_ir
         .map do |x|
-          x
-            .except(B,C,I,K,L,N,P)
-            .invert
-            .to_a
-            .select{|(k,v)| k.is_a?(HeapAddress)}
-        end
+        x
+          .except(B, C, I, K, L, N, P)
+          .invert
+          .to_a
+          .select { |(k, v)| k.is_a?(HeapAddress) }
+      end
         .map(&:to_h)
         .reduce({}, :merge)
     end
 
     def parent_arg_name_for(node, index)
-      resides_in_args  = (node[N] == NULL) && (node[P] != NULL)
-      link_symbol      = every_primary_link[HeapAddress[index]]
+      resides_in_args = (node[N] == NULL) && (node[P] != NULL)
+      link_symbol = every_primary_link[HeapAddress[index]]
       needs_p_arg_name = (resides_in_args && link_symbol)
-      parent_arg_name  = (needs_p_arg_name ? link_symbol.to_s.gsub(L, "") : nil)
+      parent_arg_name = (needs_p_arg_name ? link_symbol.to_s.gsub(L, "") : nil)
       return parent_arg_name
     end
 
@@ -107,7 +107,7 @@ private
     end
 
     def sequence_hash
-      @sequence_hash ||= \
+      @sequence_hash ||=
         HashWithIndifferentAccess.new(kind: "sequence", args: args, body: body)
     end
 

app/lib/celery_script/json_climber.rb

@@ -2,18 +2,18 @@ module CeleryScript
   # THIS IS A MORE MINIMAL VERSION OF CeleryScript::TreeClimber.
   # It is a NON-VALIDATING tree climber.
   # Don't use this on unverified data structures.
-  class JSONClimber
+  class JsonClimber
     HASH_ONLY = "Expected a Hash."
-    NOT_NODE  = "Expected hash with at least a `kind` and `args` prop."
+    NOT_NODE = "Expected hash with at least a `kind` and `args` prop."
 
     def self.climb(thing, &callable)
       raise HASH_ONLY unless thing.is_a?(Hash)
-      raise NOT_NODE  unless is_node?(thing)
+      raise NOT_NODE unless is_node?(thing)
       go(thing, callable)
       thing
     end
 
-  private
+    private
 
     def self.is_node?(maybe)
       maybe.is_a?(Hash) &&

app/lib/celery_script/slicer.rb

@@ -1,4 +1,4 @@
-require_relative "./csheap.rb"
+require_relative "./cs_heap.rb"
 # ORIGINAL IMPLEMENTATION HERE: https://github.com/FarmBot-Labs/Celery-Slicer
 # Take a nested ("canonical") representation of a CeleryScript sequence and
 # transforms it to a flat/homogenous intermediate representation which is better
@@ -11,12 +11,12 @@ module CeleryScript
       raise "Not a hash" unless node.is_a?(Hash)
       @nesting_level = 0
       @root_node = node
-      heap = CSHeap.new()
-      allocate(heap, node, CSHeap::NULL)
+      heap = CsHeap.new()
+      allocate(heap, node, CsHeap::NULL)
       @heap_values = heap.values
       @heap_values.map do |x|
-        x[CSHeap::BODY] ||= CSHeap::NULL
-        x[CSHeap::NEXT] ||= CSHeap::NULL
+        x[CsHeap::BODY] ||= CsHeap::NULL
+        x[CsHeap::NEXT] ||= CsHeap::NULL
       end
       heap.dump()
     end
@@ -31,8 +31,8 @@ module CeleryScript
 
     def allocate(h, s, parentAddr)
       addr = h.allot(s[:kind])
-      h.put(addr, CSHeap::PARENT, parentAddr)
-      h.put(addr, CSHeap::COMMENT, s[:comment]) if s[:comment]
+      h.put(addr, CsHeap::PARENT, parentAddr)
+      h.put(addr, CsHeap::COMMENT, s[:comment]) if s[:comment]
       iterate_over_body(h, s, addr)
       iterate_over_args(h, s, addr)
       addr
@@ -44,7 +44,7 @@ module CeleryScript
         .map do |key|
           v = s[:args][key]
           if (is_celery_script(v))
-            k = CSHeap::LINK + key.to_s
+            k = CsHeap::LINK + key.to_s
             h.put(parentAddr, k, allocate(h, v, parentAddr))
           else
             h.put(parentAddr, key, v)
@@ -64,12 +64,12 @@ module CeleryScript
         is_head         = index == 0
         # BE CAREFUL EDITING THIS LINE, YOU MIGHT BREAK `BODY` NODES:
         heap # See note above!
-          .put(previous_address, CSHeap::BODY, previous_address + 1) if is_head
+          .put(previous_address, CsHeap::BODY, previous_address + 1) if is_head
 
         my_heap_address = allocate(heap, canonical_list[index], previous_address)
 
-        prev_next_key = is_head ? CSHeap::NULL : my_heap_address
-        heap.put(previous_address, CSHeap::NEXT, prev_next_key)
+        prev_next_key = is_head ? CsHeap::NULL : my_heap_address
+        heap.put(previous_address, CsHeap::NEXT, prev_next_key)
 
         recurse_into_body(heap, canonical_list, my_heap_address, index + 1)
       end

app/lib/log_service.rb

@@ -1,36 +1,54 @@
 # A singleton that runs on a separate process than the web server.
 # Listens to *ALL* incoming logs and stores them to the DB.
 # Also handles throttling.
-class LogService
-  T = ThrottlePolicy::TimePeriod
-  THROTTLE_POLICY  = ThrottlePolicy.new T.new(1.minute) => 0.5 * 1_000,
-                                        T.new(1.hour)   => 0.5 * 10_000,
-                                        T.new(1.day)    => 0.5 * 100_000
+class LogService < AbstractServiceRunner
+  THROTTLE_POLICY = ThrottlePolicy.new(name, min: 250, hour: 5_000, day: 25_000)
 
-  def self.process(delivery_info, payload)
+  LOG_TPL = Rails.env.test? ?
+    "\e[32m.\e[0m" : "FBOS LOG (device_%s) [v%s]: %s\n"
+  ERR_TPL = "MALFORMED LOG CAPTURE: %s"
+  # Clean up excess logs in a non-deterministic manner.
+  # Performs the slow DB query every nth request.
+  TIDY_RATE = Rails.env.test? ? 0 : 10
+
+  def process(delivery_info, payload)
     params = { routing_key: delivery_info.routing_key, payload: payload }
-    data   = AmqpLogParser.run!(params)
-    puts data.payload["message"] if Rails.env.production?
-    THROTTLE_POLICY.track(data.device_id)
-    maybe_deliver(data)
+    m = AmqpLogParser.run!(params)
+    THROTTLE_POLICY.track(m.device_id)
+    m.device.excess_logs.delete_all if rand(0..TIDY_RATE) == TIDY_RATE
+    maybe_deliver(m)
+  rescue Mutations::ValidationException => e
+    msg = ERR_TPL % [params.merge({ e: e }).to_json]
+    puts msg unless Rails.env.test?
+    raise e
   end
 
-  def self.maybe_deliver(data)
-    violation = THROTTLE_POLICY.is_throttled(data.device_id)
-    ok        = data.valid? && !violation
+  def maybe_deliver(data)
+    return unless data.valid?
+
+    violation = THROTTLE_POLICY.violation_for(data.device_id)
+
+    if violation
+      return warn_user(data, violation)
+    end
 
     data.device.auto_sync_transaction do
-      ok ? deliver(data) : warn_user(data, violation)
+      deliver(data)
     end
   end
 
-  def self.deliver(data)
+  def deliver(data)
     dev, log = [data.device, data.payload]
     dev.maybe_unthrottle
-    Log.deliver(dev, Logs::Create.run!(log, device: dev))
+    Log.deliver(Logs::Create.run!(log, device: dev).id)
+    print LOG_TPL % [data.device_id,
+      dev.fbos_version || "?",
+      data.payload["message"] || "??"]
+  rescue => x
+    Rollbar.error(x)
   end
 
-  def self.warn_user(data, violation)
+  def warn_user(data, violation)
     data.device.maybe_throttle(violation)
   end
 end

app/lib/nerves_hub.rb

@@ -46,6 +46,7 @@ class NervesHub
   NERVES_HUB_HOST = ENV.fetch("NERVES_HUB_HOST") { "api.nerves-hub.org" }
   NERVES_HUB_PORT = ENV.fetch("NERVES_HUB_PORT") { 443 }
   NERVES_HUB_ORG = ENV.fetch("NERVES_HUB_ORG") { "farmbot" }
+  NERVES_HUB_PRODUCT = ENV.fetch("NERVES_HUB_PRODUCT") { "farmbot" }
   NERVES_HUB_BASE_URL = "https://#{NERVES_HUB_HOST}:#{NERVES_HUB_PORT}"
   NERVES_HUB_URI = URI.parse(NERVES_HUB_BASE_URL)
 
@@ -96,7 +97,6 @@ class NervesHub
     # It's really hard to debug malformed tags; Catch them here:
     if tags.detect { |x| !x.include?(COLON) }
       report_problem(error: BAD_TAG, serial_number: serial_number, tags: tags)
-      return
     end
 
     if current_nerves_hub_device
@@ -187,7 +187,7 @@ class NervesHub
 
   # Helper for making requests to a device url on NervesHub
   def self.devices_path(*chunks)
-    ["/orgs", NERVES_HUB_ORG, "devices"].concat(chunks).join("/")
+    ["/orgs", NERVES_HUB_ORG, "products", NERVES_HUB_PRODUCT, "devices"].concat(chunks).join("/")
   end
 
   # Helper for making requests to a particular device on NervesHub

app/lib/resources.rb

@@ -46,5 +46,6 @@ module Resources
     Plant         => Points,
     Point         => Points,
     ToolSlot      => Points,
+    Weed          => Points,
   }
 end # Resources

app/lib/resources/service.rb

@@ -1,55 +1,60 @@
 module Resources
-  MQTT_CHAN         = "from_api"
-  CHANNEL_TPL       =
+  MQTT_CHAN = "from_api"
+  CHANNEL_TPL =
     "bot.device_%{device_id}.resources_v0.%{action}.%{klass}.%{uuid}.%{id}"
   INDEX_OF_USERNAME = 1
-  INDEX_OF_OP       = 3
-  INDEX_OF_KIND     = 4
-  INDEX_OF_UUID     = 5
-  INDEX_OF_ID       = 6
+  INDEX_OF_OP = 3
+  INDEX_OF_KIND = 4
+  INDEX_OF_UUID = 5
+  INDEX_OF_ID = 6
 
-  class Service
-
-    def self.ok(uuid)
+  class Service < AbstractServiceRunner
+    def ok(uuid)
       { kind: "rpc_ok", args: { label: uuid } }.to_json
     end
 
-    def self.rpc_err(uuid, error)
+    def rpc_err(uuid, error)
       {
         kind: "rpc_error",
         args: { label: uuid },
         body: (error
-        .errors
-        .values
-        .map { |err| { kind: "explanation", args: { message: err.message }} })
+          .errors
+          .values
+          .map { |err| { kind: "explanation", args: { message: err.message } } }),
       }.to_json
     end
 
-    def self.step1(delivery_info, body) # Returns params or nil
+    def step1(delivery_info, body) # Returns params or nil
       Preprocessor.from_amqp(delivery_info, body)
     rescue Mutations::ValidationException => q
-      Rollbar.error(q)
+      # AUTHORS NOTE: Some of the Bunny data structures have circular
+      #               references that will cause the JSON serializer
+      #               to crash. the safe_attrs var reduces the risk of
+      #               stack overflow during serialization.
+      safe_attrs = [:consumer_tag, :redelivered, :exchange, :routing_key]
+      x = delivery_info.to_h.slice(*safe_attrs).merge(body: body)
+      Rollbar.error(q, x)
       raw_chan = delivery_info&.routing_key&.split(".") || []
-      id       = raw_chan[INDEX_OF_USERNAME]&.gsub("device_", "")&.to_i
-      uuid     = raw_chan[INDEX_OF_UUID] || "NONE"
+      id = raw_chan[INDEX_OF_USERNAME]&.gsub("device_", "")&.to_i
+      uuid = raw_chan[INDEX_OF_UUID] || "NONE"
       Transport.current.amqp_send(rpc_err(uuid, q), id, MQTT_CHAN) if id
       nil
     end
 
-    def self.step2(params)
-      dev    = params[:device]
+    def step2(params)
+      dev = params[:device]
 
       dev.auto_sync_transaction do
         Job.run!(params)
-        uuid   = (params[:uuid] || "NONE")
+        uuid = (params[:uuid] || "NONE")
         Transport.current.amqp_send(ok(uuid), dev.id, MQTT_CHAN)
       end
     rescue Mutations::ValidationException => q
       device = params.fetch(:device)
       Rollbar.info("device_#{device.id} using AMQP resource mgmt")
-      uuid   = params.fetch(:uuid)
+      uuid = params.fetch(:uuid)
       errors = q.errors.values.map do |err|
-        { kind: "explanation", args: { message: err.message }}
+        { kind: "explanation", args: { message: err.message } }
       end
       message = { kind: "rpc_error",
                   args: { label: uuid },
@@ -57,7 +62,7 @@ module Resources
       Transport.current.amqp_send(message, device.id, MQTT_CHAN)
     end
 
-    def self.process(delivery_info, body)
+    def process(delivery_info, body)
       params = step1(delivery_info, body)
       params && step2(params)
     end

app/lib/service_runner_base.rb

@@ -1,28 +0,0 @@
-class ServiceRunner
-  WAIT_TIME     = Rails.env.test? ? 0.01 : 5
-  OFFLINE_ERROR = Bunny::TCPConnectionFailedForAllHosts
-  CRASH_MSG     = Rails.env.test? ?
-    "\e[32m.\e[0m" : "Something caused the broker to crash...\n"
-
-  def self.go!(channel, worker_klass)
-    self.new(channel, worker_klass).run!
-  end
-
-  def initialize(channel, worker_klass)
-    @channel = channel
-    @worker  = worker_klass
-  end
-
-  def run!
-    @channel.subscribe(block: true) do |info, _, payl|
-      @worker.process(info, payl.force_encoding("UTF-8"))
-    end
-  rescue OFFLINE_ERROR, StandardError => e
-    unless e.is_a?(OFFLINE_ERROR)
-      Rollbar.error(e)
-      print CRASH_MSG
-    end
-    sleep WAIT_TIME
-    retry
-  end
-end

app/lib/telemetry_service.rb

@@ -0,0 +1,30 @@
+# A singleton that runs on a separate process than the web server.
+# Listens to *ALL* incoming logs and stores them to the DB.
+# Also handles throttling.
+class TelemetryService < AbstractServiceRunner
+  MESSAGE = "TELEMETRY MESSAGE FROM %s"
+  FAILURE = "FAILED TELEMETRY MESSAGE FROM %s"
+  THROTTLE_POLICY = ThrottlePolicy.new(name, min: 25,
+                                             hour: 250,
+                                             day: 1500)
+
+  def process(delivery_info, payload)
+    device_key = delivery_info
+      .routing_key
+      .split(".")[1]
+    json = JSON.parse(payload)
+    other_stuff = { device: device_key,
+                   is_telemetry: true,
+                   message: MESSAGE % device_key }
+    THROTTLE_POLICY.track(device_key)
+    violation = THROTTLE_POLICY.violation_for(device_key)
+    unless violation
+      puts json.merge(other_stuff).to_json
+    end
+  rescue JSON::ParserError
+    puts ({ device: device_key,
+           is_telemetry: true,
+           bad_json: payload,
+           message: FAILURE % device_key }).to_json
+  end
+end

app/lib/throttle_policy.rb

@@ -1,28 +1,81 @@
 # Handles devices that spin out of control and send too many logs to the server.
-# Class Hierarchy:
-# ThrottlePolicy has => Rules creates => Violation
-# Violation has => Rule has => TimePeriod
 class ThrottlePolicy
-  attr_reader :rules
+  TTL = { min: 60,
+         hour: 60 * 60,
+         day: 60 * 60 * 24 }
+  ROUNDING_HELPERS = { min: :beginning_of_minute,
+                       hour: :beginning_of_hour,
+                       day: :beginning_of_day }
 
-  # Dictionary<TimePeriod, Integer>
-  def initialize(policy_rules)
-    @rules = policy_rules.map { |rule_set| Rule.new(*rule_set) }
+  TIME_UNITS = TTL.keys
+  VIOLATION_TPL = "more than %{limit} / %{period}"
+  Violation = Struct.new(:ends_at, :explanation)
+  attr_reader :rule_map, :namespace
+
+  def initialize(namespace, rule_map)
+    @namespace = namespace
+    @rule_map = rule_map
+    each_rule { |unit| validate_unit!(unit) }
   end
 
-  def track(unique_id, now = Time.now)
-    rules.each { |r| r.time_period.record_event(unique_id, now) }
+  def track(id)
+    each_rule { |unit| incr(id, unit) }
   end
 
-  # If throttled, returns the timeperiod when device will be unthrottled
-  # returns nil if not throttled
-  def is_throttled(unique_id)
-    rules
-      .map do |rule|
-        is_violation = rule.time_period.usage_count_for(unique_id) > rule.limit
-        is_violation ? Violation.new(rule) : nil
-      end
-      .compact
-      .max
+  def violation_for(id)
+    v = all_violations(id)
+    if v.empty?
+      return nil
+    else
+      period, limit = v.max_by { |(unit)| TTL.fetch(unit) }
+      message = VIOLATION_TPL % { period: period, limit: limit }
+      return Violation.new(next_window(period), message)
+    end
+  end
+
+  private
+
+  def validate_unit!(unit)
+    raise "BAD TIME UNIT" unless TIME_UNITS.include?(unit)
+  end
+
+  def each_rule
+    rule_map.map { |(k, v)| yield(k, v) }
+  end
+
+  def redis
+    Rails.cache.redis
+  end
+
+  def the_time_part(period, now = Time.now)
+    [period, next_window(period).to_i].map(&:to_s).join()
+  end
+
+  def cache_key(id, period)
+    [namespace, the_time_part(period), id].join(":")
+  end
+
+  def get(id, period)
+    (redis.get(cache_key(id, period)) || "0").to_i
+  end
+
+  def next_window(period, now = Time.now)
+    helper = ROUNDING_HELPERS.fetch(period)
+    offset = TTL.fetch(period).seconds
+    (now + offset).send(helper)
+  end
+
+  def incr(id, period)
+    key = cache_key(id, period)
+    redis.incr(key)
+
+    if (redis.ttl(key) < 0)
+      ttl = (next_window(period) - Time.now).seconds.to_i
+      redis.expire(key, ttl)
+    end
+  end
+
+  def all_violations(id)
+    each_rule { |k, v| (get(id, k) > v) ? [k, v] : nil }.compact
   end
 end

app/lib/throttle_policy/rule.rb

@@ -1,10 +0,0 @@
-class ThrottlePolicy
-  # A time_period object paired with a max limit
-  class Rule
-    attr_reader :time_period, :limit
-
-    def initialize(time_period, limit)
-      @time_period, @limit = time_period, limit
-    end
-  end
-end

app/lib/throttle_policy/time_period.rb

@@ -1,57 +0,0 @@
-# Track the number of occurrences of an event over time.
-#
-# Given:
-#   * A fixed size duration (1 minute, 1 week etc)
-#   * An event (In our case, log creation)
-#   * An initiator id (eg: device_id)
-#
-# Produces:
-#   * A table of event counts for the current time period, indexed by
-#     the initiator ID.
-class ThrottlePolicy
-  class TimePeriod
-    attr_reader :time_unit,
-                :current_period, # Slice time into fixed size windows
-                :entries
-
-    def initialize(active_support_duration, now = Time.now)
-      @time_unit = active_support_duration
-      reset_everything now
-    end
-
-
-    def record_event(unique_id, now = Time.now)
-      period = calculate_period(now)
-      case period <=> current_period
-      when -1 then return                         # Out of date- don't record.
-      when  0 then increment_count_for(unique_id) # Right on schedule.
-      when  1 then reset_everything(now)          # Clear out old data.
-      end
-    end
-
-    def usage_count_for(unique_id)
-      @entries[unique_id] || 0
-    end
-
-    def when_does_next_period_start?
-      Time.at(current_period * time_unit.to_i) + time_unit
-    end
-
-  private
-
-    def reset_everything(now)
-      @current_period = calculate_period(now)
-      @entries        = {}
-    end
-
-    def increment_count_for(unique_id)
-      @entries[unique_id] ||= 0
-      @entries[unique_id]  += 1
-    end
-
-    # Returns integer representation of current clock period
-    def calculate_period(time)
-      (time.to_i / @time_unit)
-    end
-  end
-end

app/lib/throttle_policy/violation.rb

@@ -1,29 +0,0 @@
-class ThrottlePolicy
-  class Violation
-    attr_reader :rule
-
-    def initialize(rule)
-      @rule = rule
-    end
-
-    def ends_at
-      @rule.time_period.when_does_next_period_start?
-    end
-
-    def <=>(other)
-      self.timeframe <=> other.timeframe
-    end
-
-    def timeframe
-      rule.time_period.time_unit
-    end
-
-    def limit
-      rule.limit.to_i
-    end
-
-    def explanation
-      "more than #{limit} logs in #{timeframe.inspect}"
-    end
-  end
-end

app/mailers/fatal_error_mailer.rb

@@ -13,7 +13,7 @@ class FatalErrorMailer < ApplicationMailer
                       .map{|(t,m)| [t.in_time_zone(device.timezone || "UTC"), m] }
                       .map{|(x,y)| "[#{x}]: #{y}"}
                       .join("\n\n")
-      @device_name = device.name || "Farmbot"
+      @device_name = device.name || "FarmBot"
       mail(to: @emails, subject: "🚨 New error reported by #{@device_name}!")
       @logs.update_all(sent_at: Time.now)
     end

app/mailers/inactivity_mailer.rb

@@ -0,0 +1,11 @@
+class InactivityMailer < ApplicationMailer
+  attr_reader :user
+  SUBJECT = "[ACTION REQUIRED] Your FarmBot account " \
+  "will be deleted due to inactivity unless you login"
+  ORDER = { 1 => "First", 2 => "Second", 3 => "Final" }
+
+  def send_warning(user)
+    @user = user
+    mail to: user.email, subject: SUBJECT
+  end
+end

app/mailers/user_mailer.rb

@@ -1,35 +1,44 @@
 class UserMailer < ApplicationMailer
-  RESET_PATH         = "http:%s/verify/%s"
   NOTHING_TO_CONFIRM = "FAILED EMAIL CHANGE"
+  URI_KLASS = ENV["FORCE_SSL"] ? URI::HTTPS : URI::HTTP
+
   # Make sure the user gave us a valid email.
   def welcome_email(user)
-    @user      = user
+    @user = user
     @user_name = user.name
-    @the_url   = UserMailer.reset_url(user)
-    mail(to: @user.email, subject: 'Welcome to The FarmBot Web App!')
+    @the_url = UserMailer.reset_url(user)
+    mail(to: @user.email, subject: "Welcome to The FarmBot Web App!")
   end
 
   def password_reset(user, raw_token)
-    @user  = user
-    @token = raw_token
-    @host  = $API_URL
-    mail(to: @user.email, subject: 'FarmBot Password Reset Instructions')
+    @user = user
+    url = UserMailer.url_object
+    url.path = "/password_reset/#{raw_token}"
+    @password_reset_url = url.to_s
+    mail(to: @user.email, subject: "FarmBot Password Reset Instructions")
   end
 
   # Much like welcome_email, it is used to check email validity.
   # Triggered after the user tries update the `email` attr in Users#update.
   def email_update(user)
     raise NOTHING_TO_CONFIRM unless user.unconfirmed_email.present?
-    @user    = user
+    @user = user
     @the_url = UserMailer.reset_url(user)
 
-    mail(to:      @user.unconfirmed_email,
-         subject: 'FarmBot Email Update Instructions')
+    mail(to: @user.unconfirmed_email,
+         subject: "FarmBot Email Update Instructions")
   end
 
   def self.reset_url(user)
-    x = URI(RESET_PATH % [$API_URL, user.confirmation_token])
-    (x.port = nil) if (x.port === 443) # Sendgrid does not like :443 in URLs.
+    x = UserMailer.url_object
+    x.path = "/verify/#{user.confirmation_token}"
     x.to_s
   end
+
+  def self.url_object(host = ENV.fetch("API_HOST"), port = ENV.fetch("API_PORT"))
+    output = {}
+    output[:host] = host
+    output[:port] = port unless [nil, "443", "80"].include?(port)
+    URI_KLASS.build(output)
+  end
 end

app/models/alert.rb

@@ -0,0 +1,15 @@
+class Alert < ApplicationRecord
+  belongs_to :device
+  DEFAULTS = [
+    SEED_DATA = { problem_tag: "api.seed_data.missing", priority: 400 },
+    DOCUMENTATION = { problem_tag: "api.documentation.unread", priority: 300 },
+    TOUR = { problem_tag: "api.tour.not_taken", priority: 200 },
+    USER = { problem_tag: "api.user.not_welcomed", priority: 100 },
+    BULLETIN = { problem_tag: "api.bulletin.unread", priority: 100 },
+    DEMO = { problem_tag: "api.demo_account.in_use", priority: 100 },
+  ]
+
+  PROBLEM_TAGS = DEFAULTS.map { |x| x.fetch(:problem_tag) }
+
+  validates_inclusion_of :problem_tag, in: PROBLEM_TAGS
+end

app/models/application_record.rb

@@ -1,18 +1,24 @@
 class ApplicationRecord < ActiveRecord::Base
   self.abstract_class = true
-  after_save    :maybe_broadcast, on: [:create, :update]
+  after_create  :maybe_broadcast
+  after_update  :maybe_broadcast
   after_destroy :maybe_broadcast
 
-  DONT_BROADCAST = [ "created_at",
-                     "last_saw_api",
-                     "last_saw_mq",
-                     "last_sign_in_at",
-                     "last_sign_in_ip",
-                     "sign_in_count",
-                     "updated_at",
-                     "current_sign_in_ip",
-                     "current_sign_in_at",
-                     "fbos_version" ]
+  class << self
+    attr_reader :auto_sync_paused
+  end
+
+  DONT_BROADCAST = ["created_at",
+                    "last_saw_api",
+                    "last_saw_mq",
+                    "last_sign_in_at",
+                    "last_sign_in_ip",
+                    "sign_in_count",
+                    "updated_at",
+                    "current_sign_in_ip",
+                    "current_sign_in_at",
+                    "fbos_version"]
+
   def gone?
     destroyed? || self.try(:discarded?)
   end
@@ -27,8 +33,22 @@ class ApplicationRecord < ActiveRecord::Base
     !the_changes.empty?
   end
 
+  # Perform table operations without triggering
+  # echo-ey auto_syncs.
+  def self.auto_sync_debounce
+    @auto_sync_paused = true
+    result = yield
+    result.update!(updated_at: Time.now)
+    @auto_sync_paused = false
+    result.broadcast!
+    result
+  end
+
   def broadcast?
-    current_device && (gone? || notable_changes?)
+    return false if self.class.auto_sync_paused
+    return false unless current_device
+    return false unless (gone? || notable_changes?)
+    return true
   end
 
   def maybe_broadcast
@@ -70,5 +90,13 @@ class ApplicationRecord < ActiveRecord::Base
                               current_device.id,
                               chan_name,
                               Time.now.utc.to_i) if current_device
+    self
+  end
+
+  def manually_sync!
+    device && (device.auto_sync_transaction do
+      update!(updated_at: Time.now)
+    end)
+    self
   end
 end

app/models/arg_name.rb

@@ -1,20 +1,24 @@
 # Support class for Fragment. Please see fragment.rb for documentation.
 class ArgName < ApplicationRecord
   EXPIRY = Rails.env.test? ? 1.second : 2.hours
-  KEY    = "arg_names/%s"
+  KEY = "arg_names:%s"
 
   validates_uniqueness_of :value
 
   has_many :primitive_pairs, autosave: true
-  has_many :standard_pairs,  autosave: true
+  has_many :standard_pairs, autosave: true
 
   def self.cached_by_value(v)
     key = KEY % v
-    Rails.cache.fetch(key, expires_in: EXPIRY) { find_or_create_by(value: v) }
+    Rails.cache.fetch(key, expires_in: EXPIRY) do
+      find_or_create_by!(value: v)
+    end
   end
 
   def self.cached_by_id(id)
-    Rails.cache.fetch(KEY % id, expires_in: EXPIRY) { find(id) }
+    Rails.cache.fetch(KEY % id, expires_in: EXPIRY) do
+      find(id)
+    end
   end
 
   def broadcast?

app/models/celery_script_settings_bag.rb

@@ -16,36 +16,37 @@ module CeleryScriptSettingsBag
   end
 
   PIN_TYPE_MAP = { "Peripheral" => Peripheral,
-                  "Sensor" => Sensor,
-                  "BoxLed3" => BoxLed,
-                  "BoxLed4" => BoxLed }
+                   "Sensor" => Sensor,
+                   "BoxLed3" => BoxLed,
+                   "BoxLed4" => BoxLed }
   ALLOWED_AXIS = %w(x y z all)
-  ALLOWED_CHAGES = %w(add remove update)
+  ALLOWED_ASSERTION_TYPES = %w(abort recover abort_recover continue)
+  ALLOWED_CHANGES = %w(add remove update)
   ALLOWED_CHANNEL_NAMES = %w(ticker toast email espeak)
   ALLOWED_LHS_STRINGS = [*(0..69)].map { |x| "pin#{x}" }.concat(%w(x y z))
   ALLOWED_LHS_TYPES = [String, :named_pin]
-  ALLOWED_MESSAGE_TYPES = %w(success busy warn error info fun debug)
+  ALLOWED_MESSAGE_TYPES = %w(assertion busy debug error fun info success warn)
   ALLOWED_OPS = %w(< > is not is_undefined)
   ALLOWED_PACKAGES = %w(farmbot_os arduino_firmware)
   ALLOWED_PIN_MODES = [DIGITAL = 0, ANALOG = 1]
   ALLOWED_PIN_TYPES = PIN_TYPE_MAP.keys
-  ALLOWED_POINTER_TYPE = %w(GenericPointer ToolSlot Plant)
-  ALLOWED_RESOURCE_TYPE = %w(Device FarmEvent Image Log Peripheral Plant Point
-                             Regimen Sequence Tool ToolSlot User GenericPointer)
-  ALLOWED_RPC_NODES = %w(calibrate change_ownership
-                         check_updates dump_info emergency_lock
+  ALLOWED_POINTER_TYPE = %w(GenericPointer ToolSlot Plant Weed)
+  ALLOWED_RESOURCE_TYPE = %w(Device Point Plant ToolSlot Weed GenericPointer)
+  ALLOWED_RPC_NODES = %w(assertion calibrate change_ownership
+                         check_updates emergency_lock
                          emergency_unlock execute execute_script
                          factory_reset find_home flash_firmware home
                          install_farmware install_first_party_farmware _if
                          move_absolute move_relative power_off read_pin
-                         read_status reboot remove_farmware resource_update
+                         read_status reboot remove_farmware update_resource
                          send_message set_servo_angle set_user_env sync
                          take_photo toggle_pin update_farmware wait
                          write_pin zero)
-  ALLOWED_SPEC_ACTION = %w(dump_info emergency_lock emergency_unlock power_off
+  ALLOWED_SPEC_ACTION = %w(emergency_lock emergency_unlock power_off
                            read_status reboot sync take_photo)
   ANY_VARIABLE = %i(tool coordinate point identifier)
   BAD_ALLOWED_PIN_MODES = '"%s" is not a valid pin_mode. Allowed values: %s'
+  BAD_ASSERTION_TYPE = '"%s" is not a valid assertion type. Try these instead: %s'
   BAD_AXIS = '"%s" is not a valid axis. Allowed values: %s'
   BAD_CHANNEL_NAME = '"%s" is not a valid channel_name. Allowed values: %s'
   BAD_LHS = 'Can not put "%s" into a left hand side (LHS)' \
@@ -59,6 +60,7 @@ module CeleryScriptSettingsBag
   BAD_PIN_TYPE = '"%s" is not a type of pin. Allowed values: %s'
   BAD_POINTER_ID = "Bad point ID: %s"
   BAD_POINTER_TYPE = '"%s" is not a type of point. Allowed values: %s'
+  BAD_POINT_GROUP_ID = "Can't find PointGroup with id of %s"
   BAD_REGIMEN = "Regimen #%s does not exist."
   BAD_RESOURCE_ID = "Can't find %s with id of %s"
   BAD_RESOURCE_TYPE = '"%s" is not a valid resource_type. Allowed values: %s'
@@ -67,16 +69,25 @@ module CeleryScriptSettingsBag
   BAD_TOOL_ID = "Tool #%s does not exist."
   CANT_ANALOG = "Analog modes are not supported for Box LEDs"
   NO_PIN_ID = "%s requires a valid pin number"
-  NO_SUB_SEQ = "missing a sequence selection for `execute` block."
+  NO_SUB_SEQ = "You must select a Sequence in the Execute step."
   ONLY_ONE_COORD = "Move Absolute does not accept a group of locations " \
   "as input. Please change your selection to a single" \
   " location."
-  PLANT_STAGES = %w(planned planted harvested sprouted)
-  RESOURCE_UPDATE_ARGS = [:resource_type, :resource_id, :label, :value]
+  PLANT_STAGES = %w(planned planted harvested sprouted removed)
   SCOPE_DECLARATIONS = [:variable_declaration, :parameter_declaration]
   MISC_ENUM_ERR = '"%s" is not valid. Allowed values: %s'
-
+  MAX_WAIT_MS = 1000 * 60 * 3 # Three Minutes
+  MAX_WAIT_MS_EXCEEDED =
+    "A single wait node cannot exceed #{MAX_WAIT_MS / 1000 / 60} minutes. " +
+    "Consider lowering the wait time or using multiple WAIT blocks."
   Corpus = CeleryScript::Corpus.new
+  THIS_IS_DEPRECATED = {
+    args: [:resource_type, :resource_id, :label, :value],
+    tags: [:function, :api_writer, :network_user],
+    blk: ->(n) do
+      n.invalidate!("Deprecated `mark_as` detected. Delete it and re-add")
+    end,
+  }
 
   CORPUS_VALUES = {
     boolean: [TrueClass, FalseClass],
@@ -92,9 +103,10 @@ module CeleryScriptSettingsBag
     ALLOWED_OPS: [ALLOWED_OPS, BAD_OP],
     ALLOWED_PACKAGES: [ALLOWED_PACKAGES, BAD_PACKAGE],
     ALLOWED_PIN_MODES: [ALLOWED_PIN_MODES, BAD_ALLOWED_PIN_MODES],
+    ALLOWED_ASSERTION_TYPES: [ALLOWED_ASSERTION_TYPES, BAD_ASSERTION_TYPE],
     AllowedPinTypes: [ALLOWED_PIN_TYPES, BAD_PIN_TYPE],
     Color: [Sequence::COLORS, MISC_ENUM_ERR],
-    DataChangeType: [ALLOWED_CHAGES, MISC_ENUM_ERR],
+    DataChangeType: [ALLOWED_CHANGES, MISC_ENUM_ERR],
     LegalSequenceKind: [ALLOWED_RPC_NODES.sort, MISC_ENUM_ERR],
     lhs: [ALLOWED_LHS_STRINGS, BAD_LHS],
     PlantStage: [PLANT_STAGES, MISC_ENUM_ERR],
@@ -125,7 +137,7 @@ module CeleryScriptSettingsBag
       defn: [n(:execute), n(:nothing)],
     },
     data_value: {
-      defn: ANY_VAR_TOKENIZED,
+      defn: ANY_VAR_TOKENIZED + [n(:point_group)],
     },
     default_value: {
       defn: ANY_VAR_TOKENIZED,
@@ -189,6 +201,13 @@ module CeleryScriptSettingsBag
         node.invalidate!(BAD_POINTER_ID % node.value) if bad_node
       end,
     },
+    point_group_id: {
+      defn: [v(:integer)],
+      blk: ->(node, device) do
+        bad_node = !PointGroup.where(id: node.value, device_id: device.id).exists?
+        node.invalidate!(BAD_POINT_GROUP_ID % node.value) if bad_node
+      end,
+    },
     pointer_type: {
       defn: [e(:PointType)],
     },
@@ -211,13 +230,14 @@ module CeleryScriptSettingsBag
       blk: ->(node) do
         x = [ALLOWED_LHS_STRINGS, node, BAD_LHS]
         # This would never have happened if we hadn't allowed
-        #  heterogenus args :(
+        #  heterogenous args :(
         manual_enum(*x) unless node.is_a?(CeleryScript::AstNode)
       end,
     },
     op: {
       defn: [e(:ALLOWED_OPS)],
     },
+    priority: { defn: [v(:integer)] },
     channel_name: {
       defn: [e(:ALLOWED_CHANNEL_NAMES)],
     },
@@ -258,6 +278,15 @@ module CeleryScriptSettingsBag
     resource_type: {
       defn: [e(:resource_type)],
     },
+    assertion_type: {
+      defn: [e(:ALLOWED_ASSERTION_TYPES)],
+    },
+    lua: {
+      defn: [v(:string)],
+    },
+    resource: {
+      defn: [n(:identifier), n(:resource)],
+    },
   }.map do |(name, conf)|
     blk = conf[:blk]
     defn = conf.fetch(:defn)
@@ -265,6 +294,10 @@ module CeleryScriptSettingsBag
   end
 
   CORPUS_NODES = {
+    assertion: {
+      args: [:assertion_type, :_then, :lua],
+      tags: [:*],
+    },
     _if: {
       args: [:lhs, :op, :rhs, :_then, :_else],
       body: [:pair],
@@ -293,10 +326,6 @@ module CeleryScriptSettingsBag
       args: [:x, :y, :z],
       tags: [:data, :location_like],
     },
-    dump_info: {
-      tags: [:function, :network_user, :disk_user, :api_writer],
-      docs: "Sends an info dump to server administrators for troubleshooting.",
-    },
     emergency_lock: {
       tags: [:function, :firmware_user, :control_flow],
     },
@@ -402,7 +431,7 @@ module CeleryScriptSettingsBag
       tags: [:data],
     },
     rpc_request: {
-      args: [:label],
+      args: [:label, :priority],
       body: ALLOWED_RPC_NODES,
       tags: [:*],
     },
@@ -453,6 +482,11 @@ module CeleryScriptSettingsBag
     wait: {
       args: [:milliseconds],
       tags: [:function],
+      blk: ->(node) do
+        ms_arg = node.args[:milliseconds]
+        ms = (ms_arg && ms_arg.value) || 0
+        node.invalidate!(MAX_WAIT_MS_EXCEEDED) if ms > MAX_WAIT_MS
+      end,
     },
     zero: {
       args: [:axis],
@@ -484,13 +518,28 @@ module CeleryScriptSettingsBag
       tags: [:function, :firmware_user, :rpi_user],
       blk: ->(n) { no_rpi_analog(n) },
     },
-    resource_update: {
-      args: RESOURCE_UPDATE_ARGS,
+    # DEPRECATED- Get rid of this node ASAP -RC 15 APR 2020
+    resource_update: THIS_IS_DEPRECATED,
+    resource: {
+      args: [:resource_type, :resource_id],
+      tags: [:network_user],
+      blk: ->(n) do
+        resource_type = n.args.fetch(:resource_type).value
+        resource_id = n.args.fetch(:resource_id).value
+        check_resource_type(n, resource_type, resource_id, Device.current)
+      end,
+    },
+    update_resource: {
+      args: [:resource],
+      body: [:pair],
       tags: [:function, :api_writer, :network_user],
-      blk: ->(x) do
-        resource_type = x.args.fetch(:resource_type).value
-        resource_id = x.args.fetch(:resource_id).value
-        check_resource_type(x, resource_type, resource_id)
+    },
+    point_group: {
+      args: [:point_group_id],
+      tags: [:data, :list_like],
+      blk: ->(n) do
+        resource_id = n.args.fetch(:point_group_id).value
+        check_resource_type(n, "PointGroup", resource_id, Device.current)
       end,
     },
   }.map { |(name, list)| Corpus.node(name, **list) }
@@ -506,13 +555,16 @@ module CeleryScriptSettingsBag
     node.invalidate!(BAD_RESOURCE_ID % [klass.name, resource_id])
   end
 
-  def self.check_resource_type(node, resource_type, resource_id)
+  def self.check_resource_type(node, resource_type, resource_id, owner)
+    raise "OPPS!" unless owner
     case resource_type # <= Security critical code (for const_get'ing)
     when "Device"
       # When "resource_type" is "Device", resource_id always refers to
       # the current_device.
       # For convenience, we try to set it here, defaulting to 0
-      node.args[:resource_id].instance_variable_set("@value", 0)
+      node.args[:resource_id].instance_variable_set("@value", owner.id)
+    when "PointGroup"
+      no_resource(node, PointGroup, resource_id) unless PointGroup.exists?(resource_id)
     when *ALLOWED_RESOURCE_TYPE.without("Device")
       klass = Kernel.const_get(resource_type)
       resource_ok = klass.exists?(resource_id)

app/models/device.rb

@@ -1,50 +1,50 @@
 # Farmbot Device models all data related to an actual FarmBot in the real world.
 class Device < ApplicationRecord
-  DEFAULT_MAX_CONFIGS = 100
+  DEFAULT_MAX_CONFIGS = 300
   DEFAULT_MAX_IMAGES = 100
   DEFAULT_MAX_LOGS = 1000
 
   TIMEZONES = TZInfo::Timezone.all_identifiers
   BAD_TZ = "%{value} is not a valid timezone"
+  BAD_OTA_HOUR = "must be a value from 0 to 23."
   THROTTLE_ON = "Device is sending too many logs (%s). " \
                 "Suspending log storage and display until %s."
   THROTTLE_OFF = "Cooldown period has ended. " \
                  "Resuming log storage."
-  CACHE_KEY = "devices.%s"
 
-  has_many :farmware_envs, dependent: :destroy
-  has_many :farm_events, dependent: :destroy
-  has_many :farmware_installations, dependent: :destroy
-  has_many :images, dependent: :destroy
-  has_many :logs, dependent: :destroy
-  has_many :peripherals, dependent: :destroy
-  has_many :pin_bindings, dependent: :destroy
-  has_many :plant_templates, dependent: :destroy
-  has_many :points, dependent: :destroy
-  has_many :regimens, dependent: :destroy
-  has_many :saved_gardens, dependent: :destroy
-  has_many :sensor_readings, dependent: :destroy
-  has_many :sensors, dependent: :destroy
-  has_many :sequences, dependent: :destroy
-  has_many :token_issuances, dependent: :destroy
-  has_many :tools, dependent: :destroy
-  has_many :webcam_feeds, dependent: :destroy
-  has_many :diagnostic_dumps, dependent: :destroy
-  has_many :fragments, dependent: :destroy
-  has_one :fbos_config, dependent: :destroy
-  has_many :in_use_tools
-  has_many :in_use_points
-  has_many :users
+  PLURAL_RESOURCES = %i(alerts farmware_envs farm_events farmware_installations
+                        images logs peripherals pin_bindings plant_templates
+                        points point_groups regimens saved_gardens
+                        sensor_readings sensors sequences token_issuances tools
+                        webcam_feeds fragments)
 
-  validates_presence_of :name
-  validates :timezone,
-    inclusion: { in: TIMEZONES, message: BAD_TZ, allow_nil: true }
-  [FbosConfig, FirmwareConfig, WebAppConfig].map do |klass|
-    name = klass.table_name.singularize.to_sym
+  PLURAL_RESOURCES.map { |resources| has_many resources, dependent: :destroy }
+
+  SINGULAR_RESOURCES = {
+    fbos_config: FbosConfig,
+    firmware_config: FirmwareConfig,
+    web_app_config: WebAppConfig,
+  }
+
+  SINGULAR_RESOURCES.map do |(name, klass)|
     has_one name, dependent: :destroy
     define_method(name) { super() || klass.create!(device: self) }
   end
 
+  has_many :in_use_tools
+  has_many :in_use_points
+  has_many :users
+  has_many :folders
+
+  validates_presence_of :name
+  validates :timezone, inclusion: {
+                         in: TIMEZONES,
+                         message: BAD_TZ,
+                         allow_nil: true,
+                       }
+  validates :ota_hour,
+    inclusion: { in: [*0..23], message: BAD_OTA_HOUR, allow_nil: true }
+
   # Give the user back the amount of logs they are allowed to view.
   def limited_log_list
     Log
@@ -67,7 +67,6 @@ class Device < ApplicationRecord
   def self.current=(dev)
     RequestStore.store[:device] = dev
   end
-
   # Sets Device.current to `self` and returns it to the previous value when
   #  finished running block. Usually this is unnecessary, but may be required in
   # background jobs. If you are not receiving auto_sync data on your client,
@@ -87,47 +86,31 @@ class Device < ApplicationRecord
     points.where(pointer_type: "Plant")
   end
 
-  TIMEOUT = 150.seconds
-
-  # Like Device.find, but with 150 seconds of caching to avoid DB calls.
-  def self.cached_find(id)
-    Rails
-      .cache
-      .fetch(CACHE_KEY % id, expires_in: TIMEOUT) { Device.find(id) }
+  def tool_slots
+    points.where(pointer_type: "ToolSlot")
   end
 
-  def refresh_cache
-    # Why? Device.new(self.as_json)???
-    #
-    # "Some objects cannot be dumped: if the objects to be dumped include
-    # bindings, procedure or method objects, instances of class IO, or singleton
-    # objects, a TypeError will be raised."
-    # https://ruby-doc.org/core-2.3.1/Marshal.html
-    # TODO: Someone plz send help! - RC
-    Rails.cache.write(CACHE_KEY % self.id, Device.new(self.as_json))
+  def generic_pointers
+    points.where(pointer_type: "GenericPointer")
   end
 
-  # Sets the `throttled_at` field, but only if it is unpopulated.
-  # Performs no-op if `throttled_at` was already set.
+  # Sets the `throttled_until` and `throttled_at` fields if unpopulated or
+  # the throttle time period increases. Notifies user of cooldown period.
   def maybe_throttle(violation)
+    end_t = violation.ends_at
     # Some log validation errors will result in until_time being `nil`.
-    if (violation && throttled_until.nil?)
-      et = violation.ends_at
-      reload.update_attributes!(throttled_until: et,
-                                throttled_at: Time.now)
-      refresh_cache
-      cooldown = et.in_time_zone(self.timezone || "UTC").strftime("%I:%M%p")
+    if (throttled_until.nil? || (end_t > throttled_until))
+      reload.update!(throttled_until: end_t, throttled_at: Time.now)
+      cooldown = end_t.in_time_zone(self.timezone || "UTC").strftime("%I:%M%p")
       info = [violation.explanation, cooldown]
-      cooldown_notice(THROTTLE_ON % info, et, "warn")
+      cooldown_notice(THROTTLE_ON % info, end_t, "warn")
     end
   end
 
   def maybe_unthrottle
     if throttled_until.present?
       old_time = throttled_until
-      reload # <= WHY!?! TODO: Find out why it crashes without this.
-        .update_attributes!(throttled_until: nil, throttled_at: nil)
-      refresh_cache
+      update!(throttled_until: nil, throttled_at: nil)
       cooldown_notice(THROTTLE_OFF, old_time, "info")
     end
   end
@@ -181,13 +164,26 @@ class Device < ApplicationRecord
 
   # Helper method to create an auth token.
   # Used by sys admins to debug problems without performing a password reset.
-  def create_token
-    # If something manages to call this method, I'd like to be alerted of it.
+  def help_customer
     Rollbar.error("Someone is creating a debug user token", { device: self.id })
-    fbos_version = Api::AbstractController::EXPECTED_VER
-    SessionToken
-      .as_json(users.first, "SUPER", fbos_version)
-      .fetch(:token)
-      .encoded
+    token = SessionToken.as_json(users.first, "staff", fbos_version).to_json
+    return "localStorage['session'] = JSON.stringify(#{token});"
+  end
+
+  TOO_MANY_CONNECTIONS =
+    "Your device is reconnecting to the server too often. " +
+    "This may be a sign of local network issues. " +
+    "Please review the documentation provided at " +
+    "https://software.farm.bot/docs/connecting-farmbot-to-the-internet"
+  def self.connection_warning(username)
+    device_id = username.split("_").last.to_i || 0
+    device = self.find_by(id: device_id)
+    return unless device
+
+    last_sent_at = device.mqtt_rate_limit_email_sent_at || 4.years.ago
+    if last_sent_at < 1.day.ago
+      device.update!(mqtt_rate_limit_email_sent_at: Time.now)
+      device.tell(TOO_MANY_CONNECTIONS, ["fatal_email"])
+    end
   end
 end

app/models/diagnostic_dump.rb

@@ -1,3 +0,0 @@
-class DiagnosticDump < ApplicationRecord
-  belongs_to :device
-end

app/models/farmware_env.rb

@@ -1,16 +1,5 @@
 # User definable key/value pairs, usually used for Farmware authorship.
 class FarmwareEnv < ApplicationRecord
   belongs_to :device
-  serialize  :value
-  validate   :primitives_only
-
-  PRIMITIVES_ONLY = "`value` must be a string, number or boolean"
-
-  def primitives_only
-    errors.add(:value, PRIMITIVES_ONLY) unless is_primitve
-  end
-
-  def is_primitve
-    [String, Integer, Float, TrueClass, FalseClass].include?(value.class)
-  end
+  serialize :value
 end

app/models/farmware_installation.rb

@@ -40,7 +40,7 @@ class FarmwareInstallation < ApplicationRecord
     known_error = KNOWN_PROBLEMS[error.class]
     description = \
        known_error || (OTHER_PROBLEM % error.class)
-    update_attributes!(package_error: description,
+    update!(package_error: description,
                        package:       nil)
     unless known_error.present?
       raise error
@@ -54,7 +54,7 @@ class FarmwareInstallation < ApplicationRecord
     string    = string_io.read(MAX_JSON_SIZE)
     json      = JSON.parse(string)
     pkg_name  = json.fetch("package")
-    update_attributes!(package: pkg_name, package_error: nil)
+    update!(package: pkg_name, package_error: nil)
   rescue => error
     maybe_recover_from_fetch_error(error)
   end

app/models/fbos_config.rb

@@ -3,7 +3,18 @@ class FbosConfig < ApplicationRecord
   class MissingSerial < StandardError; end
 
   belongs_to :device
-  after_save :maybe_sync_nerves, on: [:create, :update]
+  after_create :maybe_sync_nerves
+  after_update :maybe_sync_nerves
+
+  FIRMWARE_HARDWARE = [
+    NOT_SET = nil,
+    NONE = "none",
+    ARDUINO = "arduino",
+    FARMDUINO = "farmduino",
+    FARMDUINO_K14 = "farmduino_k14",
+    FARMDUINO_K15 = "farmduino_k15",
+    EXPRESS_K10 = "express_k10",
+  ]
 
   NERVES_FIELD = "update_channel"
 

app/models/folder.rb

@@ -0,0 +1,8 @@
+class Folder < ApplicationRecord
+  belongs_to :device
+
+  has_many :sub_folders, class_name: "Folder",
+                          foreign_key: "parent_id"
+
+  belongs_to :parent, class_name: "Folder", optional: true
+end

app/models/fragment.rb

@@ -53,11 +53,8 @@
 class Fragment < ApplicationRecord
   # Avoid N+1s: Fragment.includes(Fragment::EVERYTHING)
   EVERYTHING = { nodes: Node::EVERYTHING }
-  SERIALIZER = "serialized"
   belongs_to :device
-  belongs_to :owner,
-    polymorphic: true,
-    inverse_of:  :fragment
+  belongs_to :owner, polymorphic: true, inverse_of: :fragment
   has_many :primitives, dependent: :destroy
   has_many :nodes
   has_many :primitive_pairs
@@ -76,18 +73,22 @@ class Fragment < ApplicationRecord
   end
 
   def json_cache_key
-    [cache_key_with_version, SERIALIZER].join("/")
+    ["fragments", id, updated_at.to_i].join(":")
   end
 
   def self.from_celery(device:, kind:, args:, body:, owner:)
-    p        = { device: device, kind: kind, args: args, body: body }
-    flat_ast = Fragments::Preprocessor.run!(p)
-    Fragments::Create.run!(device:   device,
+    p = { device: device, kind: kind, args: args, body: body }
+    flat_ast = Fragments::Preprocessor.run!(**p)
+    Fragments::Create.run!(device: device,
                            flat_ast: flat_ast,
-                           owner:    owner)
+                           owner: owner)
   end
 
   def broadcast?
     false
   end
+
+  def self.remove_old_fragments_for_device(dev)
+    dev.fragments.select { |x| x.owner == nil }.map { |x| x.destroy! }
+  end
 end

app/models/global_bulletin.rb

@@ -0,0 +1,5 @@
+class GlobalBulletin < ActiveRecord::Base
+  self.inheritance_column = "none"
+  validates_uniqueness_of :slug
+  validates_presence_of :content, :slug, :type
+end

app/models/global_config.rb

@@ -5,14 +5,14 @@
 #    4. Are not security sensitive (If not, use ENV vars or secrets mgmt)
 class GlobalConfig < ApplicationRecord
   validates_uniqueness_of :key
-  validates_presence_of   :key
+  validates_presence_of :key
 
   # Bootstrap these values, but NEVER clobber pre-existing ones:
   {
     "FBOS_END_OF_LIFE_VERSION" => "6.4.11",
-    "MINIMUM_FBOS_VERSION"     => "6.3.0",
-    "TOS_URL"                  => ENV.fetch("TOS_URL", ""),
-    "PRIV_URL"                 => ENV.fetch("PRIV_URL", "")
+    "MINIMUM_FBOS_VERSION" => "6.3.0",
+    "TOS_URL" => ENV.fetch("TOS_URL", ""),
+    "PRIV_URL" => ENV.fetch("PRIV_URL", ""),
   }.map do |(key, value)|
     x = self.find_by(key: key)
     self.create!(key: key, value: value) unless x
@@ -21,11 +21,14 @@ class GlobalConfig < ApplicationRecord
   LONG_REVISION = ENV["BUILT_AT"] || ENV["HEROKU_SLUG_COMMIT"] || "NONE"
   # Bootstrap these values, and ALWAYS clobber pre-existing ones:
   {
-    "NODE_ENV"                 => Rails.env || "development",
-    "LONG_REVISION"            => LONG_REVISION,
-    "SHORT_REVISION"           => LONG_REVISION.first(8),
+    "NODE_ENV" => Rails.env || "development",
+    "LONG_REVISION" => LONG_REVISION,
+    "SHORT_REVISION" => LONG_REVISION.first(8),
+    # We only need this for the demo tour.
+    # Remove it if the demo tour does not require it.
+    "MQTT_WS" => SessionToken::MQTT_WS,
   }.map do |(key, value)|
-    self.find_or_create_by(key: key).update_attributes(key: key, value: value)
+    self.find_or_create_by(key: key).update(key: key, value: value)
   end
 
   # Memoized version of every GlobalConfig, with key/values layed out in a hash.

app/models/image.rb

@@ -2,8 +2,8 @@ require "open-uri"
 # A set of image URLs (thumbs) + Associated meta data.
 class Image < ApplicationRecord
   belongs_to :device
-  validates  :device, presence: true
-  serialize  :meta
+  validates :device, presence: true
+  serialize :meta
 
   # http://stackoverflow.com/a/5127684/1064917
   after_initialize :set_defaults
@@ -12,37 +12,38 @@ class Image < ApplicationRecord
     self.meta ||= {}
   end
 
-  PROTO       = ENV["FORCE_SSL"] ? "https:" : "http:"
   PLACEHOLDER = "/placeholder_farmbot.jpg\?text=Processing..."
-  CONFIG = {
-    default_url: "#{PROTO}#{$API_URL}#{PLACEHOLDER}",
-    styles: { x1280: "1280x1280>",
-              x640:  "640x640>",
-              x320:  "320x320>",
-              x160:  "160x160>",
-              x80:   "80x80>" },
-    size: { in: 0..7.megabytes } # Worst case scenario for 1280x1280 BMP.
+  PROTO = ENV["FORCE_SSL"] ? "https:" : "http:"
+  DEFAULT_URL = "#{PROTO}#{$API_URL}#{PLACEHOLDER}"
+  RMAGICK_STYLES = {
+    x1280: "1280x1280>",
+    x640: "640x640>",
+    x320: "320x320>",
+    x160: "160x160>",
+    x80: "80x80>",
   }
+  MAX_IMAGE_SIZE = 7.megabytes
+  CONFIG = { default_url: DEFAULT_URL,
+            styles: RMAGICK_STYLES,
+            size: { in: 0..MAX_IMAGE_SIZE } }
+  BUCKET = ENV["GCS_BUCKET"]
 
-  bucket = ENV["GCS_BUCKET"]
-  CONFIG.merge!({
-    storage:         :fog,
-    fog_host:        "http://#{bucket}.storage.googleapis.com",
-    fog_directory:   bucket,
-    fog_credentials: { provider:                         "Google",
-                        google_storage_access_key_id:     ENV.fetch("GCS_KEY"),
-                        google_storage_secret_access_key: ENV.fetch("GCS_ID")}
-  }) if bucket
+  ROOT_PATH = BUCKET ?
+    "https://#{BUCKET}.storage.googleapis.com" : "/system"
+  IMAGE_URL_TPL =
+    ROOT_PATH + "/images/attachments/%{chunks}/%{size}/%{filename}?%{timestamp}"
 
-  has_attached_file :attachment, CONFIG
+  CONTENT_TYPES = ["image/jpg", "image/jpeg", "image/png", "image/gif"]
+  GCS_ACCESS_KEY_ID = ENV.fetch("GCS_KEY") { puts "Not using Google Cloud" }
+  GCS_HOST = "http://#{BUCKET}.storage.googleapis.com"
+  GCS_SECRET_ACCESS_KEY = ENV.fetch("GCS_ID") { puts "Not using Google Cloud" }
+  # Worst case scenario for 1280x1280 BMP.
+  GCS_BUCKET_NAME = ENV["GCS_BUCKET"]
 
-  validates_attachment_content_type :attachment,
-    content_type: ["image/jpg", "image/jpeg", "image/png", "image/gif"]
+  has_one_attached :attachment
 
   def set_attachment_by_url(url)
-    # File
-    # URI::HTTPS
-    self.attachment = open(url)
+    attachment.attach(io: URI.open(url), filename: "image_#{self.id}")
     self.attachment_processed_at = Time.now
     self
   end
@@ -59,4 +60,47 @@ class Image < ApplicationRecord
     image = find_by(id: id)
     image.destroy! if image
   end
+
+  def legacy_image?
+    !!self.attachment_file_size # This is a now-unused legacy field.
+  end
+
+  def regular_image?
+    attachment && attachment.attached?
+  end
+
+  def regular_url
+    if BUCKET
+      # Not sure why. TODO: Investigate why Rails URL helpers don't work here.
+      "https://storage.googleapis.com/#{BUCKET}/#{attachment.key}"
+    else
+      Rails
+        .application
+        .routes
+        .url_helpers
+        .rails_blob_url(attachment)
+    end
+  end
+
+  def legacy_url(size)
+    url = IMAGE_URL_TPL % {
+      chunks: id.to_s.rjust(9, "0").scan(/.{3}/).join("/"),
+      filename: attachment_file_name,
+      size: size,
+      timestamp: attachment_updated_at.to_i,
+    }
+    return ENV["GCS_KEY"].present? ? url.gsub("http://", "https://") : url
+  end
+
+  def attachment_url(size = "x640")
+    # Detect legacy attachments by way of
+    # superceded PaperClip-related field.
+    # If it has an `attachment_file_size`,
+    # it was made with paperclip.
+    return regular_url if regular_image?
+
+    return legacy_url(size) if legacy_image?
+
+    return DEFAULT_URL
+  end
 end

app/models/in_use_point.rb

@@ -4,10 +4,11 @@ class InUsePoint < ApplicationRecord
   belongs_to :device
 
   DEFAULT_NAME = "point"
-  FANCY_NAMES  = {
+  FANCY_NAMES = {
     GenericPointer.name => DEFAULT_NAME,
-    ToolSlot.name       => "tool slot",
-    Plant.name          => "plant",
+    ToolSlot.name => "slot",
+    Plant.name => "plant",
+    Weed.name => "weed"
   }
 
   def readonly?
@@ -15,6 +16,6 @@ class InUsePoint < ApplicationRecord
   end
 
   def fancy_name
-    "#{FANCY_NAMES[pointer_type] || DEFAULT_NAME} at (#{x}, #{y}, #{z})"
+    "#{InUsePoint::FANCY_NAMES[pointer_type] || DEFAULT_NAME} at (#{x}, #{y}, #{z})"
   end
 end

app/models/kind.rb

@@ -1,7 +1,7 @@
 # Support class for Fragment. Please see fragment.rb for documentation.
 class Kind < ApplicationRecord
   EXPIRY = Rails.env.test? ? 1.second : 2.hours
-  KEY    = "kinds/%s"
+  KEY = "kinds:%s"
   has_many :nodes
 
   def self.cached_by_value(v)

app/models/log.rb

@@ -23,8 +23,6 @@ class Log < ApplicationRecord
 
   validates :device, presence: true
   validates :type, presence: true
-  serialize :meta
-  validates :meta, presence: true
   # http://stackoverflow.com/a/5127684/1064917
   before_validation :set_defaults
 
@@ -32,27 +30,6 @@ class Log < ApplicationRecord
     self.channels ||= []
   end
 
-  # Legacy shims ===============================================================
-  #  TODO: Remove these once FBOS stops using the `meta` field (FBOS < v6.4.0).
-  def meta
-    {
-      type: self.type,
-      major_version: self.major_version,
-      minor_version: self.minor_version,
-      verbosity: self.verbosity,
-      x: self.x,
-      y: self.y,
-      z: self.z,
-    }
-  end
-
-  def meta=(hash)
-    hash.map { |(key, value)| self.send("#{key}=", value) }
-    self.meta
-  end
-
-  # End Legacy shims ===========================================================
-
   def broadcast? # Logs get their own special channel. Don't echo twice!
     false
   end

app/models/log_delivery_stuff.rb

@@ -3,10 +3,12 @@
 # Also helps group "fast" messages into a digest.
 module LogDeliveryStuff
   class RateLimitError < StandardError; end
+
   module ClassMethods
     # If this method grows, create a mutation.
-    def deliver(device, log)
-      send_fatal_emails(log, device)
+    def deliver(log_id)
+      log = Log.find_by(id: log_id)
+      send_fatal_emails(log, log.device) if log
     end
 
     def send_fatal_emails(log, device)

app/models/pin_binding.rb

@@ -1,18 +1,18 @@
 class PinBinding < ApplicationRecord
-  OFF_LIMITS  = [ 6, 12, 13, 17, 21, 23, 24, 25, 27 ]
-  BAD_PIN_NUM = \
-    "The following pin numbers cannot be used: %s" % OFF_LIMITS.join(", ")
+  OFF_LIMITS = [
+    2, 3, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 17, 19, 21, 23, 24, 25, 27,
+  ]
+  BAD_PIN_NUM = "The following pin numbers cannot be used: %s" % OFF_LIMITS.join(", ")
 
   belongs_to :device
   belongs_to :sequence
-  enum special_action: { dump_info:        "dump_info",
-                         emergency_lock:   "emergency_lock",
+  enum special_action: { emergency_lock: "emergency_lock",
                          emergency_unlock: "emergency_unlock",
-                         power_off:        "power_off",
-                         read_status:      "read_status",
-                         reboot:           "reboot",
-                         sync:             "sync",
-                         take_photo:       "take_photo" }
+                         power_off: "power_off",
+                         read_status: "read_status",
+                         reboot: "reboot",
+                         sync: "sync",
+                         take_photo: "take_photo" }
   validates :pin_num, uniqueness: { scope: :device }
 
   def fancy_name
@@ -20,7 +20,7 @@ class PinBinding < ApplicationRecord
   end
 
   def random_pin_num
-    [*(0..69)]
+    [*(0..27)]
       .without(*OFF_LIMITS)
       .without(*device.pin_bindings.pluck(:pin_num))
       .sample

app/models/plant.rb

@@ -1,4 +1,14 @@
 # A single organism living in the ground.
 class Plant < Point
   DEFAULT_ICON = "/app-resources/img/icons/generic-plant.svg"
+  ATTRS = %w(meta
+             name
+             openfarm_slug
+             plant_stage
+             planted_at
+             pointer_type
+             radius
+             x
+             y
+             z)
 end

app/models/point.rb

@@ -4,11 +4,12 @@ class Point < ApplicationRecord
                          # axis value > 21k right now - RC
   # Using real constants instead of strings results
   # in circular dep. errors.
-  POINTER_KINDS           = ["GenericPointer", "Plant", "ToolSlot"]
+  POINTER_KINDS = ["GenericPointer", "Plant", "ToolSlot", "Weed"]
   self.inheritance_column = "pointer_type"
 
   belongs_to :device
   validates_presence_of :device
+  has_many :point_group_items, dependent: :destroy
 
   after_discard :maybe_broadcast
 
@@ -19,4 +20,10 @@ class Point < ApplicationRecord
   def name_used_when_syncing
     "Point"
   end
+
+  def fancy_name
+    n = InUsePoint::FANCY_NAMES[pointer_type] ||
+        InUsePoint::DEFAULT_NAME
+    "#{n} at (#{x}, #{y}, #{z})"
+  end
 end

app/models/point_group.rb

@@ -0,0 +1,19 @@
+class PointGroup < ApplicationRecord
+  SORT_TYPES =
+    %w(xy_ascending xy_descending yx_ascending yx_descending random).sort
+  BAD_SORT = "%{value} is not valid. Valid options are: " +
+             SORT_TYPES.map(&:inspect).join(", ")
+  DEFAULT_CRITERIA = {
+    day: { op: "<", days_ago: 0 },
+    string_eq: {},
+    number_eq: {},
+    number_lt: {},
+    number_gt: {},
+  }
+
+  belongs_to :device
+  has_many :point_group_items, dependent: :destroy
+  validates_inclusion_of :sort_type, in: SORT_TYPES,
+                                     message: BAD_SORT
+  serialize :criteria
+end

app/models/point_group_item.rb

@@ -0,0 +1,8 @@
+class PointGroupItem < ApplicationRecord
+  belongs_to :point_group
+  belongs_to :point
+
+  def broadcast?
+    false
+  end
+end

app/models/primary_node.rb

@@ -6,23 +6,23 @@
 # CeleryScript is a tree of PrimaryNode objects in the center and primitive
 # "EdgeNode" types on the edge of the tree.
 class PrimaryNode < ApplicationRecord
-  belongs_to            :sequence
+  belongs_to :sequence
   validates_presence_of :sequence
-  has_many   :edge_nodes
+  has_many :edge_nodes
   BAD_KIND = "`kind` must be one of: " +
-              CeleryScriptSettingsBag::ANY_NODE_NAME.join(", ")
+             CeleryScriptSettingsBag::ANY_NODE_NAME.join(", ")
   validates :kind, inclusion: { in: CeleryScriptSettingsBag::ANY_NODE_NAME,
                                 message: BAD_KIND,
                                 allow_nil: false }
   validates :parent_arg_name,
-    inclusion: {in:        CeleryScriptSettingsBag::ANY_ARG_NAME,
-                message:   BAD_KIND,
-                allow_nil: true}
+            inclusion: { in: CeleryScriptSettingsBag::ANY_ARG_NAME,
+                         message: BAD_KIND,
+                         allow_nil: true }
 
   before_save :next_must_be_body_node
 
   def next_must_be_body_node
-    raise "NO!" if(next_id && self.class.find(next_id).parent_arg_name)
+    raise "NO!" if (next_id && self.class.find(next_id).parent_arg_name)
   end
 
   def parent

app/models/resource_update_step.rb

@@ -0,0 +1,21 @@
+# If you create a "Mark As.." (resource_update) step
+# and accidentally delete the resource that it modifies,
+# referential integrity issues will emerge.
+#
+# The Model below is a SQL VIEW.
+# It is NOT A TABLE.
+#
+# It simplifies the process of finding Points that
+# are in use by the `resource_update` step.
+class ResourceUpdateStep < ApplicationRecord
+  belongs_to :point
+
+  def readonly?
+    true
+  end
+
+  # Make sure you preload `self.point` before calling this.
+  def fancy_name
+    @fancy_name ||= point.fancy_name
+  end
+end

app/models/sequence.rb

@@ -6,34 +6,37 @@ class Sequence < ApplicationRecord
   # This number (YYYYMMDD) helps us prepare for the future by keeping things
   # versioned. We can use it as a means of identifying legacy sequences when
   # breaking changes happen.
-  LATEST_VERSION    = 20180209
-  NOTHING           = { kind: "nothing", args: {} }
+  LATEST_VERSION = 20180209
+  NOTHING = { kind: "nothing", args: {} }
   SCOPE_DECLARATION = { kind: "scope_declaration", args: {} }
-  DEFAULT_ARGS      = { locals:      SCOPE_DECLARATION,
-                        version:     LATEST_VERSION }
+  DEFAULT_ARGS = { locals: SCOPE_DECLARATION,
+                  version: LATEST_VERSION }
 
   COLORS = %w(blue green yellow orange purple pink gray red)
   include CeleryScriptSettingsBag
 
   belongs_to :device
-  has_one    :sequence_usage_report
-  has_many   :farm_events, as: :executable
-  has_many   :regimen_items
-  has_many   :primary_nodes,         dependent: :destroy
-  has_many   :edge_nodes,            dependent: :destroy
+  belongs_to :folder
+  belongs_to :fbos_config, foreign_key: :boot_sequence_id
+  has_one :sequence_usage_report
+  has_many :farm_events, as: :executable
+  has_many :regimen_items
+  has_many :primary_nodes, dependent: :destroy
+  has_many :edge_nodes, dependent: :destroy
 
   # allowable label colors for the frontend.
-  [ :name, :kind ].each { |n| validates n, presence: true }
+  [:name, :kind].each { |n| validates n, presence: true }
   validates :color, inclusion: { in: COLORS }
   validates :name, uniqueness: { scope: :device }
-  validates  :device, presence: true
+  validates :device, presence: true
 
   # http://stackoverflow.com/a/5127684/1064917
   before_validation :set_defaults
   around_destroy :delete_nodes_too
+
   def set_defaults
     self.color ||= "gray"
-    self.kind  ||= "sequence"
+    self.kind ||= "sequence"
   end
 
   def delete_nodes_too
@@ -46,21 +49,14 @@ class Sequence < ApplicationRecord
 
   def self.if_still_using(pin)
     # TODO: Perform SQL UNION query here for teh performance
-    pins  = EdgeNode.where(kind: "pin_id", value: pin.id).pluck(:primary_node_id)
+    pins = EdgeNode.where(kind: "pin_id", value: pin.id).pluck(:primary_node_id)
     types = EdgeNode.where(kind: "pin_type", value: pin.class.name).pluck(:primary_node_id)
     union = pins & types # DO NOT USE &&, I ACTUALLY MEANT TO `&` not `&&`!
-    all   = PrimaryNode.includes(:sequence).where(id: union).pluck(:sequence_id)
+    all = PrimaryNode.includes(:sequence).where(id: union).pluck(:sequence_id)
     sequences = Sequence.where(id: all)
     yield(sequences) if sequences.count > 0
   end
 
-  def manually_sync!
-    device.auto_sync_transaction do
-      update_attributes!(updated_at: Time.now)
-      broadcast!
-    end if device
-  end
-
   # THIS IS AN OVERRIDE - See Sequence#body_as_json
   # Use `#manually_sync!` for most use cases.
   def broadcast?

app/models/token_issuance.rb

@@ -4,6 +4,7 @@ class TokenIssuance < ApplicationRecord
   belongs_to :device
   # Number of ms Rails will wait for the API.
   API_TIMEOUT = Rails.env.test? ? 0.01 : 2.5
+  after_create :reset_inactivity_timer
 
   def broadcast?
     false
@@ -40,4 +41,8 @@ class TokenIssuance < ApplicationRecord
   def self.clean_old_tokens
     expired.destroy_all
   end
+
+  def reset_inactivity_timer
+    device.users.map(&:reset_inactivity_tracking!)
+  end
 end

app/models/tool_slot.rb

@@ -11,7 +11,9 @@ class ToolSlot < Point
   MIN_PULLOUT = PULLOUT_DIRECTIONS.min
   PULLOUT_ERR = "must be a value between #{MIN_PULLOUT} and #{MAX_PULLOUT}. "\
                 "%{value} is not valid."
-  IN_USE      = "already in use by another tool slot"
+  IN_USE      = "already in use by another slot. "\
+                "Please un-assign the tool from its current slot"\
+                " before reassigning."
 
   belongs_to :tool
   validates_uniqueness_of :tool,

app/models/transport.rb

@@ -3,11 +3,12 @@ require "bunny"
 # A wrapper around AMQP to stay DRY. Will make life easier if we ever need to
 # change protocols
 class Transport
-  OPTS = { read_timeout: 10, heartbeat: 10, log_level: "info" }
+  OPTS = { read_timeout: 10, heartbeat: 10, log_level: "warn" }
+  RESOURCE_ROUTING_KEY = "bot.*.resources_v0.*.*.*.*"
 
   def self.amqp_url
-    @amqp_url ||= ENV['CLOUDAMQP_URL'] ||
-                  ENV['RABBITMQ_URL']  ||
+    @amqp_url ||= ENV["CLOUDAMQP_URL"] ||
+                  ENV["RABBITMQ_URL"] ||
                   "amqp://admin:#{ENV.fetch("ADMIN_PASSWORD")}@mqtt:5672"
   end
 
@@ -31,7 +32,7 @@ class Transport
 
   def connection
     @connection ||= Transport
-                    .default_amqp_adapter.new(Transport.amqp_url, OPTS).start
+      .default_amqp_adapter.new(Transport.amqp_url, OPTS).start
   end
 
   def log_channel
@@ -41,18 +42,36 @@ class Transport
                          .bind("amq.topic", routing_key: "bot.*.logs")
   end
 
+  def telemetry_channel
+    @telemetry_channel ||= self
+      .connection
+      .create_channel
+      .queue("api_telemetry_workers")
+      .bind("amq.topic", routing_key: "bot.*.telemetry")
+  end
+
   def resource_channel
-    @resource_channel ||= self.connection
-                         .create_channel
-                         .queue("resource_workers")
-                         .bind("amq.topic", routing_key: "bot.*.resources_v0.#")
+    @resource_channel ||= self
+      .connection
+      .create_channel
+      .queue("resource_workers")
+      .bind("amq.topic", routing_key: RESOURCE_ROUTING_KEY)
   end
 
   def amqp_topic
     @amqp_topic ||= self
-                  .connection
-                  .create_channel
-                  .topic("amq.topic", auto_delete: true)
+      .connection
+      .create_channel
+      .topic("amq.topic", auto_delete: true)
+  end
+
+  def send_demo_token_to(user, secret)
+    fbos_version = Api::AbstractController::EXPECTED_VER
+    routing_key =
+      [Api::RmqUtilsController::DEMO_REGISTRY_ROOT, secret].join(".")
+    payload =
+      SessionToken.as_json(user, "GUEST", fbos_version).to_json
+    raw_amqp_send(payload, routing_key)
   end
 
   def amqp_send(message, id, channel)
@@ -88,10 +107,10 @@ class Transport
     end
 
     def self.api_url
-      uri        = URI(Transport.amqp_url)
+      uri = URI(Transport.amqp_url)
       uri.scheme = ENV["FORCE_SSL"] ? "https" : "http"
-      uri.user   = nil
-      uri.port   = 15672
+      uri.user = nil
+      uri.port = 15672
       uri.to_s
     end
 

app/models/user.rb

@@ -45,10 +45,43 @@ class User < ApplicationRecord
   end
 
   def self.refresh_everyones_ui
-    Rollbar.error("Global UI refresh triggered")
+    msg = {
+      "type" => "reload",
+      "commit" => (ENV["HEROKU_SLUG_COMMIT"] || "NONE").first(8),
+    }
 
     Transport
       .current
-      .raw_amqp_send("X", Api::RmqUtilsController::PUBLIC_BROADCAST)
+      .raw_amqp_send(msg.to_json, Api::RmqUtilsController::PUBLIC_BROADCAST)
+  end
+
+  # The web app deletes account that go inactive for long periods.
+  # It is called when the user logs in to the app.
+  def reset_inactivity_tracking!
+    update!(inactivity_warning_sent_at: nil)
+  end
+
+  def send_inactivity_warning
+    User.transaction do
+      update!(inactivity_warning_sent_at: Time.now)
+      InactivityMailer.send_warning(self).deliver_later
+      puts "INACTIVITY WARNING FOR #{email}" unless Rails.env.test?
+    end
+  end
+
+  def deactivate_account
+    User.transaction do
+      email = self.email
+      if reload.last_sign_in_at > 3.months.ago
+        puts "CANCEL DEACTIVATION FOR #{email}" unless Rails.env.test?
+        update!(inactivity_warning_sent_at: nil)
+        return # <== DON'T DELETE THIS LINE!!!
+      else
+        # Prevent double deletion / race conditions.
+        update!(last_sign_in_at: Time.now, inactivity_warning_sent_at: nil)
+        delay.destroy!
+        puts "INACTIVITY DELETION FOR #{email}" unless Rails.env.test?
+      end
+    end
   end
 end

app/models/web_app_config.rb

@@ -2,16 +2,6 @@
 class WebAppConfig < ApplicationRecord
   belongs_to :device
 
-  def internal_use=(data)
-    unless [nil, "null"].include?(data)
-      Rollbar.error("Internal data update use", {
-        self_id: self.id,
-        device_id: self.device_id,
-      })
-    end
-    super(data)
-  end
-
   def broadcast?
     false
   end

app/models/weed.rb

@@ -0,0 +1,2 @@
+class Weed < Point
+end

app/mutations/alerts/create.rb

@@ -0,0 +1,17 @@
+module Alerts
+  class Create < Mutations::Command
+    required do
+      model :device
+      string :problem_tag, in: Alert::PROBLEM_TAGS
+    end
+
+    optional do
+      string :slug # Default is `SecureRandom.uuid`
+      integer :priority, default: 99
+    end
+
+    def execute
+      Alert.create!({ slug: slug || SecureRandom.uuid }.merge(inputs))
+    end
+  end
+end

app/mutations/alerts/destroy.rb

@@ -0,0 +1,11 @@
+module Alerts
+  class Destroy < Mutations::Command
+    required do
+      model :alert
+    end
+
+    def execute
+      alert.destroy!
+    end
+  end
+end