Commit iniziale di eminuxCRM: CRM Rails con pipeline, campagne email e Docker.

Include autenticazione, progetti isolati, mail marketing HTML con SMTP, test A/B e editor WYSIWYG.

Co-authored-by: Cursor <cursoragent@cursor.com>

config/initializers/active_record_encryption.rb

@@ -0,0 +1,25 @@
+# Chiavi derivate da SECRET_KEY_BASE così le password SMTP restano cifrate
+# anche senza rails credentials:edit (Docker / deploy).
+#
+# In Rails 8 il getter di ActiveRecord::Encryption.config.primary_key solleva
+# se la chiave manca: non usare ||= su quell'oggetto.
+require "digest"
+
+secret = Rails.application.secret_key_base.to_s
+keys = {
+  primary_key: Digest::SHA256.hexdigest("#{secret}/ar-enc-primary"),
+  deterministic_key: Digest::SHA256.hexdigest("#{secret}/ar-enc-deterministic"),
+  key_derivation_salt: Digest::SHA256.hexdigest("#{secret}/ar-enc-salt")
+}
+
+cfg = Rails.application.config.active_record.encryption
+keys.each { |name, value| cfg[name] = value }
+cfg.support_unencrypted_data = true
+
+Rails.application.config.after_initialize do
+  enc = ActiveRecord::Encryption.config
+  enc.primary_key = keys[:primary_key]
+  enc.deterministic_key = keys[:deterministic_key]
+  enc.key_derivation_salt = keys[:key_derivation_salt]
+  enc.support_unencrypted_data = true
+end

config/initializers/assets.rb

@@ -0,0 +1,7 @@
+# Be sure to restart your server when you modify this file.
+
+# Version of your assets, change this if you want to expire all your assets.
+Rails.application.config.assets.version = "1.0"
+
+# Add additional assets to the asset load path.
+# Rails.application.config.assets.paths << Emoji.images_path

config/initializers/content_security_policy.rb

@@ -0,0 +1,29 @@
+# Be sure to restart your server when you modify this file.
+
+# Define an application-wide content security policy.
+# See the Securing Rails Applications Guide for more information:
+# https://guides.rubyonrails.org/security.html#content-security-policy-header
+
+# Rails.application.configure do
+#   config.content_security_policy do |policy|
+#     policy.default_src :self, :https
+#     policy.font_src    :self, :https, :data
+#     policy.img_src     :self, :https, :data
+#     policy.object_src  :none
+#     policy.script_src  :self, :https
+#     policy.style_src   :self, :https
+#     # Specify URI for violation reports
+#     # policy.report_uri "/csp-violation-report-endpoint"
+#   end
+#
+#   # Generate session nonces for permitted importmap, inline scripts, and inline styles.
+#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+#   config.content_security_policy_nonce_directives = %w(script-src style-src)
+#
+#   # Automatically add `nonce` to `javascript_tag`, `javascript_include_tag`, and `stylesheet_link_tag`
+#   # if the corresponding directives are specified in `content_security_policy_nonce_directives`.
+#   # config.content_security_policy_nonce_auto = true
+#
+#   # Report violations without enforcing the policy.
+#   # config.content_security_policy_report_only = true
+# end

config/initializers/filter_parameter_logging.rb

@@ -0,0 +1,8 @@
+# Be sure to restart your server when you modify this file.
+
+# Configure parameters to be partially matched (e.g. passw matches password) and filtered from the log file.
+# Use this to limit dissemination of sensitive information.
+# See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
+Rails.application.config.filter_parameters += [
+  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc
+]

config/initializers/inflections.rb

@@ -0,0 +1,16 @@
+# Be sure to restart your server when you modify this file.
+
+# Add new inflection rules using the following format. Inflections
+# are locale specific, and you may define rules for as many different
+# locales as you wish. All of these examples are active by default:
+# ActiveSupport::Inflector.inflections(:en) do |inflect|
+#   inflect.plural /^(ox)$/i, "\\1en"
+#   inflect.singular /^(ox)en/i, "\\1"
+#   inflect.irregular "person", "people"
+#   inflect.uncountable %w( fish sheep )
+# end
+
+# These inflection rules are supported but not enabled by default:
+# ActiveSupport::Inflector.inflections(:en) do |inflect|
+#   inflect.acronym "RESTful"
+# end

config/initializers/pagy.rb

@@ -0,0 +1,5 @@
+require "pagy"
+require "pagy/extras/overflow"
+
+Pagy::DEFAULT[:limit] = 25
+Pagy::DEFAULT[:overflow] = :empty_page

config/initializers/session_store.rb

@@ -0,0 +1,12 @@
+# Be sure to restart your server when you modify this file.
+#
+# Cookie Secure solo con FORCE_SSL/SESSION_COOKIE_SECURE.
+# Dietro NPM→Caddy→Rails (HTTP interno) request.ssl? è false: con secure:true
+# Rails non emette _simplecrm_session → CSRF 422 al login su HTTPS.
+secure_cookie = ENV["FORCE_SSL"] == "true" || ENV["SESSION_COOKIE_SECURE"] == "true"
+
+Rails.application.config.session_store :cookie_store,
+                                       key: "_simplecrm_session",
+                                       secure: secure_cookie,
+                                       httponly: true,
+                                       same_site: :lax