app/services/pdf_generation/html_template_service.rb (1)

29-34: Consider edge cases in URL processing.

The regex-based URL rewriting is functional but could be more robust. Consider edge cases like:

• URLs with query parameters or fragments
• Escaped quotes in attribute values
• URLs spanning multiple lines

def process_urls_in_html(html)
- html.gsub(/(?:src|href)=["']\/([^"']+)["']/) do |match|
-   path = Regexp.last_match(1)
-   match.sub("/#{path}", "#{root_url}/#{path}")
- end
+ html.gsub(/(?:src|href)=(['"])\/([^'"\s>]+)\1/) do |match|
+   quote = Regexp.last_match(1)
+   path = Regexp.last_match(2)
+   "#{match.split('=')[0]}=#{quote}#{root_url}/#{path}#{quote}"
+ end
end

app/services/pdf_generation/invoice_service.rb (1)

59-71: Consider making PDF options configurable.

While the current defaults look reasonable, consider making these options configurable either through initializer parameters or environment variables for different deployment environments.

def invoice_pdf_options
  {
    format: Rails.application.config.invoice_pdf_format || "A4",
    margin: Rails.application.config.invoice_pdf_margin || {
      top: 18,
      bottom: 18,
      left: 18,
      right: 18
    },
    print_background: Rails.application.config.invoice_pdf_print_background || true,
    prefer_css_page_size: Rails.application.config.invoice_pdf_prefer_css_page_size || false
  }
end

app/services/pdf_generation/base_service.rb (1)

58-63: Potential encoding issue with special characters.

The URL encoding approach should work for most cases, but consider potential issues with complex HTML content containing special characters.

def load_html_in_browser(browser)
- # Create a data URL from the HTML content
- html_data_url = "data:text/html;charset=utf-8," + ERB::Util.url_encode(html_content)
- browser.go_to(html_data_url)
- browser.network.wait_for_idle
+ # Create a base64 data URL to handle complex HTML content
+ require "base64"
+ encoded_html = Base64.strict_encode64(html_content)
+ html_data_url = "data:text/html;base64,#{encoded_html}"
+ browser.go_to(html_data_url)
+ browser.network.wait_for_idle
end

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

app/javascript/src/components/Invoices/common/utils.js (1)

109-123: Toast timing + blob cleanup

Show success after the download is triggered, and always revoke the object URL/remove the link to avoid leaks.

 export const handleDownloadInvoice = async invoice => {
-  try {
-    Toastr.success("Download request sent");
-    const res = await invoicesApi.downloadInvoice(invoice.id);
-    const url = window.URL.createObjectURL(new Blob([res.data]));
-    const link = document.createElement("a");
+  let url;
+  let link;
+  try {
+    const res = await invoicesApi.downloadInvoice(invoice.id);
+    url = window.URL.createObjectURL(new Blob([res.data]));
+    link = document.createElement("a");
     link.href = url;
     const filename = invoice?.invoiceNumber || invoice?.invoice_number;
     link.setAttribute("download", `${filename}.pdf`);
     document.body.appendChild(link);
     link.click();
+    Toastr.success("Download started");
   } catch {
     Toastr.error("Something went wrong");
+  } finally {
+    if (link) link.remove();
+    if (url) window.URL.revokeObjectURL(url);
   }
 };

deployment/fly/Dockerfile (1)

73-85: Harden Chrome APT repo setup; add fonts for PDF; remove duplicate gnupg

• Use a keyring with signed-by to scope trust.
• Include Noto fonts to prevent tofu/missing glyphs in PDFs.
• Drop duplicate gnupg (already in PROD_PACKAGES) and add ca-certificates.

 ENV DOCKER_BUILD=1

 RUN --mount=type=cache,id=prod-apt-cache,sharing=locked,target=/var/cache/apt \
     --mount=type=cache,id=prod-apt-lib,sharing=locked,target=/var/lib/apt \
     apt-get update -qq && \
-    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-    ${PROD_PACKAGES} gnupg wget && \
-    wget --quiet --output-document=- https://dl-ssl.google.com/linux/linux_signing_key.pub | gpg --dearmor > /etc/apt/trusted.gpg.d/google-archive.gpg && \
-    sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' && \
-    apt-get update && \
-    apt-get install google-chrome-stable -y --no-install-recommends \
-    && rm -rf /var/lib/apt/lists/*
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      ${PROD_PACKAGES} wget ca-certificates && \
+    install -m 0755 -d /etc/apt/keyrings && \
+    wget -qO- https://dl.google.com/linux/linux_signing_key.pub | gpg --dearmor > /etc/apt/keyrings/google-linux.gpg && \
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/google-linux.gpg] http://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list && \
+    apt-get update -qq && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      google-chrome-stable fonts-noto fonts-noto-cjk fonts-noto-color-emoji && \
+    rm -rf /var/lib/apt/lists/*

config/initializers/ferrum_pdf.rb (1)

12-25: Browser flags sanity-check

Consider ensuring “new” headless mode and common flags; confirm current defaults in your Ferrum version.

Examples to consider:

• headless=new
• no-first-run
• no-default-browser-check
• window-size=1280,1696

Would you like me to propose flags once we confirm Ferrum’s current defaults?

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

.github/workflows/validations.yml (1)

28-34: Consider using the modern keyring approach and pinning Chrome version.

The apt-key add command used on line 30 is deprecated in favor of signed-by keyrings. Additionally, installing google-chrome-stable without version pinning may cause unexpected behavior if Chrome updates introduce breaking changes in the Chrome DevTools Protocol that Ferrum relies on.

Apply this diff to use the modern keyring approach:

       - name: Install Chrome for FerrumPdf
         run: |
-          wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
-          echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" | sudo tee /etc/apt/sources.list.d/google-chrome.list
+          wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
+          echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | sudo tee /etc/apt/sources.list.d/google-chrome.list
           sudo apt-get update
           sudo apt-get install -y google-chrome-stable
           google-chrome --version

Optionally, consider pinning to a specific Chrome version to ensure consistency:

sudo apt-get install -y google-chrome-stable=<version>

config/initializers/elasticsearch.rb (1)

17-23: LGTM! Consider documenting the 300-second timeout rationale.

The Elasticsearch configuration improvements are well-structured:

• ENV variable support with sensible default (line 17)
• Environment-specific index prefixing for namespace isolation (line 23)

The 300-second search timeout on line 20 is notably long. Consider adding a comment explaining why such an extended timeout is necessary for your use case, as typical search queries complete in seconds.

docs/docs/contributing-guide/setup/windows.md (1)

224-254: Documentation is comprehensive; consider modern keyring approach.

The Chrome/Chromium installation instructions are clear and provide good guidance. However, similar to the CI workflow, the apt-key add command on line 231 is deprecated.

For consistency with modern Debian/Ubuntu practices, consider updating to:

wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
sudo sh -c 'echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list'

Note: The bold text on lines 228 and 237 (**Option 1:...** and **Option 2:...**) is flagged by markdownlint as emphasis used instead of heading (MD036), but this is a stylistic choice that's acceptable in documentation.

docs/docs/contributing-guide/setup/ubuntu_debian.md (1)

122-152: Documentation is clear; consider modern keyring approach.

The Chrome/Chromium installation instructions match the Windows documentation structure and provide good guidance. However, the apt-key add command on line 129 is deprecated.

For consistency with modern Debian/Ubuntu practices, consider updating to:

$ wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
$ sudo sh -c 'echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list'

This change would align with the Ubuntu/Debian documentation's existing Elasticsearch installation pattern (lines 66-67) which already uses this modern approach.

bin/setup (1)

42-49: Add fallback for non-Linux in Elasticsearch status check

Detect if systemctl is available before using it in bin/setup (lines 42–49); on macOS or non-systemd containers, use an alternative check (e.g., brew services list) or document that this script requires systemd.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

.github/workflows/validations.yml (3)

13-13: Make the skip‑CI guard robust for both push and pull_request events

github.event.head_commit.message is null on pull_request events, so the current check won’t honor “skip ci” in PRs. Coalesce and also check PR title/body.

-    if: ${{ !contains(github.event.head_commit.message, 'skip ci') }}
+    if: ${{ 
+      !contains((github.event.head_commit.message || ''), 'skip ci') &&
+      !contains((github.event.pull_request.title  || ''), 'skip ci') &&
+      !contains((github.event.pull_request.body   || ''), 'skip ci')
+    }}

Please verify by opening a PR with “skip ci” in the title to ensure the job is skipped for PRs and still works for pushes.

---

27-27: Pin Elasticsearch to a specific 7.x version to avoid flaky CI

Using 7 floats to the latest 7.x on each runner image change, which can break mappings/tests unexpectedly. Pin an exact version (e.g., the one used in prod or previously in CI).

Options:

• Stick with the previously known‑good 7.13.3.
• Or use the last 7.x LTS you support (e.g., 7.17.13).

Confirm which version your app targets and pin it here for reproducibility.

---

28-34: Harden Chrome install: avoid deprecated apt‑key and use HTTPS + signed‑by keyring

apt-key is deprecated and the repo is added over HTTP. Prefer a keyring with signed‑by and an HTTPS source.

-      - name: Install Chrome for FerrumPdf
-        run: |
-          wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
-          echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" | sudo tee /etc/apt/sources.list.d/google-chrome.list
-          sudo apt-get update
-          sudo apt-get install -y google-chrome-stable
-          google-chrome --version
+      - name: Install Chrome for FerrumPdf
+        run: |
+          set -euo pipefail
+          sudo install -m 0755 -d /etc/apt/keyrings
+          curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /etc/apt/keyrings/google-linux-signing-keyring.gpg
+          sudo chmod a+r /etc/apt/keyrings/google-linux-signing-keyring.gpg
+          echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/google-linux-signing-keyring.gpg] https://dl.google.com/linux/chrome/deb/ stable main" | sudo tee /etc/apt/sources.list.d/google-chrome.list > /dev/null
+          sudo apt-get update
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y google-chrome-stable
+          google-chrome --version

Alternative: use a maintained action like browser-actions/setup-chrome for faster, cached installs.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.