universo-platformo-ruby

This release delivers the guest landing page, the authenticated onboarding page, and a complete
Supabase authentication flow that runs entirely through the Rails backend.

How Supabase Integration Works

The frontend never talks to Supabase directly. All authentication calls go through the Rails backend:

Browser → Rails (SessionsController / Api::V1::AuthController) → Supabase Auth API

SupabaseAuthService

handles all communication with the Supabase REST API using Ruby's
built-in

Net::HTTP

. Credentials (

SUPABASE_URL

SUPABASE_KEY

) live only on the server.

Architecture

Package Structure

The

packages/

directory contains documentation for each feature module. Implementation code lives in the root

app/

following standard Rails conventions:

packages/
├── start-frt/base/   # Guest and authenticated start pages (docs)
└── auth-frt/base/    # Authentication UI — sign-in / sign-up (docs)

Application Layer (root `app/`)

Path	Purpose
`app/controllers/start_controller.rb`	Routes `/` to guest or authenticated page
`app/controllers/auth/sessions_controller.rb`	HTML form sign-in, sign-up, sign-out
`app/controllers/api/v1/auth_controller.rb`	JSON API for authentication
`app/services/supabase_auth_service.rb`	Supabase HTTP client (backend only)
`app/views/start/guest.html.erb`	Landing page for unauthenticated visitors
`app/views/start/authenticated.html.erb`	Onboarding wizard for signed-in users
`app/views/auth/sessions/new.html.erb`	Sign-in form
`app/views/auth/sessions/sign_up.html.erb`	Sign-up form

Pages

URL	Auth required	Description
`GET /`	No	Redirects to `/start/guest` or `/start/authenticated`
`GET /start/guest`	No	Hero section + 4 product cards + footer
`GET /start/authenticated`	Yes	Multi-step onboarding wizard
`GET /auth/sign-in`	No	Sign-in form
`GET /auth/sign-up`	No	Sign-up / registration form
`POST /auth/sign-in`	No	Process sign-in
`POST /auth/sign-up`	No	Process registration
`DELETE /auth/sign-out`	Yes	Sign-out
`GET /api/v1/auth/csrf`	No	CSRF token for JSON clients
`GET /api/v1/auth/me`	No	Current user info (JSON)

Technology Stack

Runtime: Ruby 3.2+
Framework: Ruby on Rails 7.1
Database: PostgreSQL (Supabase)
Authentication: Supabase Auth (via Net::HTTP, no SDK)
Frontend: Tailwind CSS, Turbo, Stimulus, Importmap
Testing: RSpec, WebMock, Shoulda Matchers
Code quality: RuboCop, Brakeman, Bundler Audit
i18n: English and Russian locales (config/locales/en.yml, ru.yml)

Quick Start

1. Clone the Repository

2. Install Dependencies

3. Configure Environment

Edit

.env

and fill in your Supabase project values:

4. Build CSS and Start the Server

Open

http://localhost:3000

in your browser.

Development

Running Tests

Code Quality

Security Notes

CSRF protection: protect_from_forgery with: :exception for all requests.
JSON clients must obtain a token via GET /api/v1/auth/csrf and send X-CSRF-Token.
Session fixation: reset_session is called before storing new credentials
on every successful sign-in or sign-up.
No secrets in browser: Supabase credentials and tokens exist only in server
environment variables and session storage — never rendered into HTML or JavaScript.
SSL verification: OpenSSL::SSL::VERIFY_PEER is enforced for Supabase calls.

Internationalization

UI text uses Rails I18n. Locale files are in

config/locales/

en.yml — English (default)
ru.yml — Russian

Contributing

Read the guidelines in .github/instructions/
Create an Issue using the provided templates
Create a feature branch from your Issue
Submit a Pull Request following the PR guidelines
Ensure all tests pass and code quality checks succeed

Reference Implementation

This project is inspired by Universo Platformo React
and replicates its architecture using pure Ruby on Rails best practices.

License

MIT License — see

LICENSE

file for details.