Wilbert Ribeiro - Fullstack-Developer

[wilbert]

User Management App — Rails 8.1 + Inertia/React submission

Implements the full challenge: a responsive user-management app on Ruby 4.0.6 / Rails 8.1, with React 19 + Inertia.js via Vite Rails, Tailwind CSS 4, and the native Rails 8 stack — built-in authentication, Solid Queue for background imports, Solid Cable for live updates, Solid Cache. No Redis, no Devise.

Branch: wilbert-ribeiro-dev → master. Built across six feature PRs (feat/front, feat/react-files, feat/admin-dashboard, feat/spreadsheet-import, feat/layout, feat/deployment); this PR merges the result.

Use cases delivered

Admin

• Redirected to the admin dashboard after login.
• Dashboard shows total users and users grouped by role, pushed over Action Cable — no polling, no reload.
• Full CRUD over users, with search, role filter, sorting, and pagination (Pagy).
• Toggle a user's role from the list or the detail page.
• Upload a .csv / .xlsx spreadsheet; users are created by a background job.
• Live per-row progress, status, and error report while the import runs.

User

• Redirected to their own profile after login; can view, edit, and delete only their own account.

Visitor

• Self-registration as a regular member, rate-limited.

Architecture

Domain logic is kept out of controllers, which stay thin and only render Inertia responses.

Layer	Location	Responsibility
Queries	app/queries/	UserSearch (filter/sort/paginate), Dashboard::Stats
Serializers	app/serializers/	Explicit prop shapes for React — no model leakage
Policies	app/policies/	ApplicationPolicy / UserPolicy, plain objects, no gem
Import pipeline	app/imports/	RowSet → CsvRowSet / SpreadsheetRowSet, UserRow, UserImporter, ProgressBroadcaster
Broadcasters	app/broadcasters/	Dashboard::Broadcaster, with a suppression switch for bulk writes
Jobs	app/jobs/	ProcessImportJob, Dashboard::BroadcastJob

Notable choices:

• Import format is abstracted behind RowSet. CSV and XLSX both yield normalised hashes, so UserImporter never knows which it got. Adding a format is one subclass.
• Broadcast suppression. A bulk import would otherwise fire one dashboard broadcast per created user; DashboardBroadcasts.suppressed? silences the per-record callbacks and the job broadcasts once at the end.
• Last-admin protection is enforced in the model (before_destroy + an update validation), not only in the UI, so it holds for imports and the console too.
• email_address is encrypted with Active Record deterministic encryption, keeping uniqueness and lookups working.
• Strict validation on both sides: model validations plus a shared client-side rule set (app/javascript/lib/validation.ts + useLiveValidation) that gives interactive feedback without duplicating server truth.

Frontend

• React 19 + TypeScript, tsc -b in CI, no any escape hatches in the page tree.
• Tailwind CSS 4 via the Vite plugin, responsive down to mobile, with a PWA manifest and icons.
• useDashboardStream and the import page subscribe to Action Cable channels for real-time state.
• useLocaleFormat / useHydrated keep server- and client-rendered timestamps consistent so SSR does not mismatch on hydration.

SSR (extra credit). Inertia SSR is wired end to end: bin/vite dev answers Rails on /__inertia_ssr in development, and assets:precompile emits public/vite-ssr/ssr.js, kept alive in production by the inertia_ssr Puma plugin. It degrades to client rendering if neither is present, and is off in the test env by default. Covered by spec/system/server_side_rendering_spec.rb.

Testing

• 54 spec files, RSpec, run in parallel with parallel_tests.
• Unit (models, queries, policies, serializers, importers, jobs, channels), request specs for every controller, and system specs driven by Capybara + Playwright.
• SimpleCov enforces 90% line / 80% branch minimum, with per-worker result sets merged across parallel runs.
• CI (.github/workflows/ci.yml) runs RuboCop (rubocop-rails-omakase + rubocop-rspec), Brakeman, bundler-audit, tsc, Prettier, and the parallel suite against Postgres 17, then uploads the coverage report. CodeQL runs separately.

Deployment

• Multi-stage Dockerfile serving through Thruster.
• docker-compose.yml for local development — docker compose build && docker compose up is the whole setup; the Solid Queue worker runs inside Puma so imports work with no extra process. Full walkthrough in DEVELOPMENT_SETUP.md.
• Kamal 2 config (config/deploy.yml) with web and job roles, kamal-proxy + Let's Encrypt, a postgres:17 accessory, and secrets mapped through .kamal/secrets with no values committed.

⚠️ The Kamal deploy was not verified against a real server. I had no VPS available, and the local Multipass rehearsal did not fit in the ~20 GB free on my machine. KAMAL_DISCLOUSURE.md documents exactly what is configured, what is unverified, and the remaining steps (placeholders to replace, RAILS_ENV: production, DNS, secrets).

Ruby 4 JIT profiling

bin/jit-profile benchmarks this app's own hot paths (serialization, import parsing, row validation, a full page render) under the interpreter, YJIT, and Ruby 4's new ZJIT, each in a fresh process. Findings: YJIT is 1.53×–2.12× faster than the interpreter, ZJIT 1.07×–1.20×, so production runs YJIT — switchable with one env var (RUBY_JIT). Method and numbers in PERFORMANCE.md.

AI disclosure

Per the AI policy: GitHub Copilot for inline completion and Claude Opus 5 for planning, debugging, documentation, and PR reviews. Scope detailed in AI_DISCLOSURE.md.

Reviewing locally

# Create .env with RAILS_MASTER_KEY, SECRET_KEY_BASE, RAILS_ENV, RACK_ENV
# (exact contents in DEVELOPMENT_SETUP.md §3)
docker compose build
docker compose up
docker compose exec web bin/rails db:seed

App at http://localhost:3000 — admin admin@umanni.test / password123, plus 25 seeded members.

🤖 Generated with Claude Code