giacope

Stripe-Style Public IDs for Rails + Inertia.js

A complete guide to implementing Stripe-style public IDs (po_a8Kx3mNp2qR1) in a Rails application. Public IDs replace raw database IDs in URLs, APIs, and frontend code — preventing enumeration attacks and leaking internal state.

Why Public IDs?

• Security: Sequential integer IDs leak record counts and are trivially enumerable
• Portability: Prefixed IDs (us_, po_, ch_) are self-describing across logs, support tickets, and APIs
• Decoupling: Frontend and API consumers never depend on internal database IDs

giacope

CLAUDE.md

Setup

mise install   # Install Ruby + Node versions from mise.toml
bin/setup      # Bundler, pnpm install, js:routes, db:prepare, clear tmp

Running

giacope

PostgreSQL Row Level Security (RLS) in Rails

A production-tested guide to implementing PostgreSQL RLS in a multi-tenant Rails application. Extracted from a real SaaS codebase serving thousands of workspaces.

Data is isolated at two levels:

• Organization (billing, memberships, API keys)
• Workspace (all operational data — posts, comments, files, etc.)

Adapt these to your tenancy model. Single-tenant apps can drop the organization layer entirely and use just tenant_id.

giacope

# Ignore artifacts:
build
coverage

app/frontend/routes
app/frontend/types/serializers

giacope

require:
  - ./lib/rubocop/cop/custom

inherit_from: .rubocop_todo.yml
inherit_mode:
  merge:
    - Exclude

# Omakase Ruby styling for Rails
inherit_gem: { rubocop-rails-omakase: rubocop.yml }

giacope

class ApplicationRecord < ActiveRecord::Base
  around_save :uniq_validation

  def uniq_validation
    yield
  rescue ActiveRecord::RecordNotUnique => e
    columns = e.message[/Key \((.+)\)=/, 1]&.split(", ") || [:base]
    columns.each { |column| errors.add(column, "must be unique") }
  end
end

giacope

module ApplicationHelper
  def auto_link(text)
    sanitize(text.gsub(URI::DEFAULT_PARSER.make_regexp(%w[http https])) do |url|
      link_to(url, url, target: "_blank", rel: "noopener noreferrer")
    end, attributes: %w[href target rel])
  end
end

giacope

class ApplicationController < ActionController::Base
  after_action  :skip_cookies

  def skip_cookies
    request.session_options[:skip] = true
  end
end

giacope

event_1 = 'Landed on product page'
event_2 = 'Added product to card'
event_3 = 'Went to checkout'

ActiveRecord::Base.connection.exec_query(
  Ahoy::Event.with(
    event_1: Ahoy::Event.select(:visit_id, 'MIN(time) AS step_time')
                        .where(name: event_1)
                        .group(1),
    event_2: Ahoy::Event.select(:visit_id, 'MIN(time) AS step_time')