Staging

.gitignore

@@ -36,3 +36,5 @@ public/sitemaps
 /config/credentials/production.key
 
 /config/credentials/development.key
+
+.env

Gemfile

@@ -53,6 +53,7 @@ gem 'tzinfo-data'
 
 # Exception tracking
 gem 'sentry-raven', group: [:production]
+gem 'countries', '= 6.0.1'
 
 group :development, :test do
   gem 'pry-rails'

Gemfile.lock

@@ -88,6 +88,8 @@ GEM
     coderay (1.1.3)
     concurrent-ruby (1.1.10)
     connection_pool (2.3.0)
+    countries (6.0.1)
+      unaccent (~> 0.3)
     crass (1.0.6)
     dead_end (3.1.1)
     derailed_benchmarks (2.1.1)
@@ -370,6 +372,7 @@ GEM
       concurrent-ruby (~> 1.0)
     tzinfo-data (1.2022.1)
       tzinfo (>= 1.0.0)
+    unaccent (0.4.0)
     unicode-display_width (2.1.0)
     uniform_notifier (1.16.0)
     webrick (1.7.0)
@@ -389,7 +392,7 @@ DEPENDENCIES
   benchmark-ips
   bullet
   byebug
-  cld3 (= 3.4.3)
+  countries (= 6.0.1)
   derailed_benchmarks
   elastic-transport
   elasticsearch-model

app/controllers/api/qdc/chapter_metadata_controller.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Api::Qdc
+  class ChapterMetadataController < ApiController
+    before_action :init_presenter
+
+    def metadata
+      render
+    end
+
+    protected
+
+    def init_presenter
+      @presenter = Qdc::ChapterMetadataPresenter.new(params)
+    end
+  end
+end

app/controllers/api/qdc/quran_controller.rb

@@ -2,5 +2,18 @@
 
 module Api::Qdc
   class QuranController < Api::V4::QuranController
+    def tafsir
+      @presenter = Qdc::TafsirsPresenter.new(params)
+      filters = resource_filters(@resource)
+      @filter_names = humanize_filter_names(filters)
+
+      @tafsirs = if (@resource = fetch_tafsir_resource)
+                   Tafsir.order('verse_id ASC').where(filters)
+                 else
+                   []
+                 end
+
+      render
+    end
   end
 end

app/controllers/api/qdc/recitations_controller.rb

@@ -2,5 +2,9 @@
 
 module Api::Qdc
   class RecitationsController < Api::V4::RecitationsController
+    protected
+    def init_presenter
+      @presenter = Qdc::RecitationsPresenter.new(params)
+    end
   end
 end

app/controllers/api/qdc/resources_controller.rb

@@ -116,6 +116,113 @@ def languages
       render
     end
 
+    def country_language_preference
+      user_device_language = request.query_parameters[:user_device_language].presence
+      country = request.query_parameters[:country].presence&.upcase
+
+      # Require a valid user_device_language always
+      if user_device_language.blank?
+        return render_bad_request('user_device_language is required')
+      end
+
+      unless Language.exists?(iso_code: user_device_language)
+        return render_bad_request('Invalid user_device_language')
+      end
+
+      # Validate country only if provided
+      if country.present?
+        valid_countries = ISO3166::Country.all.map(&:alpha2)
+        unless valid_countries.include?(country)
+          return render_bad_request('Invalid country code')
+        end
+      end
+
+      if country.present?
+        # First try to find country-specific preference
+        preferences = CountryLanguagePreference.with_includes
+                        .where(user_device_language: user_device_language, country: country)
+        @preference = preferences.first
+
+        # If no country-specific preference found, try global preference
+        unless @preference
+          @preference = CountryLanguagePreference.with_includes
+                          .find_by(user_device_language: user_device_language, country: nil)
+        end
+      else
+        # No country provided: search by user_device_language only
+        # Prefer global (country: nil), then fall back to any match for that language
+        @preference = CountryLanguagePreference.with_includes
+                          .find_by(user_device_language: user_device_language, country: nil)
+
+        unless @preference
+          @preference = CountryLanguagePreference.with_includes
+                            .where(user_device_language: user_device_language)
+                            .first
+        end
+      end
+
+      if @preference
+        # Filter out unapproved resources when building the response
+        @data = build_preference_data(@preference)
+        render
+      else
+        render_404("No matching country language preference found")
+      end
+    end
+
+    private
+
+    def build_preference_data(preference)
+      # Sanitize CSV IDs for default translations
+      ids = if preference.default_translation_ids.present?
+              preference.default_translation_ids
+                .split(',')
+                .map(&:strip)
+                .reject(&:blank?)
+                .map(&:to_i)
+            else
+              []
+            end
+
+      # QR specific default translations ids
+      qr_ids = if preference.qr_default_translations_ids.present?
+                 preference.qr_default_translations_ids
+                   .split(',')
+                   .map(&:strip)
+                   .reject(&:blank?)
+                   .map(&:to_i)
+               else
+                 []
+               end
+
+      # QR default arabic fonts
+      qr_font_ids = if preference.qr_default_arabic_fonts.present?
+                      preference.qr_default_arabic_fonts
+                        .split(',')
+                        .map(&:strip)
+                        .reject(&:blank?)
+                        .map(&:to_i)
+                    else
+                      []
+                    end
+
+      {
+        preference: preference,
+        default_mushaf: preference.mushaf&.enabled ? preference.mushaf : nil,
+        default_translations: ids.any? ?
+          ResourceContent.where(id: ids).approved.includes(:translated_name) : [],
+        qr_default_translations: qr_ids.any? ?
+          ResourceContent.where(id: qr_ids).approved.includes(:translated_name) : [],
+        default_tafsir: preference.tafsir&.approved? ? preference.tafsir : nil,
+        default_wbw_language: preference.wbw_language,
+        default_reciter: preference.reciter,
+        ayah_reflections_languages: Language.where(iso_code: preference.ayah_reflections_languages&.split(',') || []),
+        qr_reflection_languages: Language.where(iso_code: preference.qr_reflection_languages&.split(',') || []),
+        learning_plan_languages: Language.where(iso_code: preference.learning_plan_languages&.split(',') || []),
+        qr_default_arabic_fonts: qr_font_ids
+      }
+    end
+
     protected
 
     def load_translations

app/controllers/api/qdc/tafsirs_controller.rb

@@ -2,5 +2,9 @@
 
 module Api::Qdc
   class TafsirsController < Api::V4::TafsirsController
+    protected
+    def init_presenter
+      @presenter = Qdc::TafsirsPresenter.new(params)
+    end
   end
 end

app/controllers/api/qdc/translations_controller.rb

@@ -7,7 +7,7 @@ class TranslationsController < Api::V4::TranslationsController
 
     protected
     def init_presenter
-      @presenter = TranslationsPresenter.new(params)
+      @presenter = Qdc::TranslationsPresenter.new(params)
     end
 
     def load_translations

app/controllers/api/v3/options_controller.rb

@@ -22,6 +22,7 @@ def translations
                .one_verse
                .translations
                .approved
+               .allowed_to_share
                .order('priority ASC')
 
       @translations = eager_load_translated_name(list)
@@ -47,6 +48,7 @@ def chapter_info
                .chapter_info
                .one_chapter
                .approved
+               .allowed_to_share
 
       @chapter_infos = eager_load_translated_name(list)
       render
@@ -58,6 +60,7 @@ def tafsirs
                .eager_load(:translated_name)
                .tafsirs
                .approved
+               .allowed_to_share
                .order('priority ASC')
 
       @tafsirs = eager_load_translated_name(list)

app/controllers/api/v3/search_controller.rb

@@ -27,6 +27,7 @@ def translations
 
         approved_translations = ResourceContent
                                   .approved
+                                  .allowed_to_share
                                   .translations
                                   .one_verse
 

app/controllers/api/v3/tafsirs_controller.rb

@@ -20,7 +20,10 @@ def verse
     end
 
     def tafisr_id
-      approved_tafsir = ResourceContent.tafsirs.approved
+      approved_tafsir = ResourceContent
+                        .tafsirs
+                        .approved
+                        .allowed_to_share
 
       tafsir = approved_tafsir.where(id: params[:tafsir])
                               .or(approved_tafsir.where(slug: params[:tafsir]))

app/controllers/api/v4/api_controller.rb

@@ -10,6 +10,7 @@ def fetch_translation_resource
                    .translations
                    .one_verse
                    .approved
+                   .allowed_to_share
 
       find_resource(approved, params[:translation_id], true)
     end
@@ -20,6 +21,7 @@ def fetch_tafsir_resource
                    .tafsirs
                    .one_verse
                    .approved
+                   .allowed_to_share
 
       find_resource(approved, params[:tafsir_id], true)
     end

app/controllers/api/v4/resources_controller.rb

@@ -13,6 +13,7 @@ def translations
                .eager_load(:translated_name)
                .one_verse
                .translations
+               .allowed_to_share
                .approved
                .order('priority ASC')
 
@@ -31,7 +32,7 @@ def translation_info
     end
 
     def word_by_word_translations
-      list = ResourceContent.eager_load(:translated_name).approved.one_word.translations_only.order('priority ASC')
+      list = ResourceContent.eager_load(:translated_name).approved.allowed_to_share.one_word.translations_only.order('priority ASC')
 
       @word_by_word_translations = eager_load_translated_name(list)
 
@@ -43,6 +44,7 @@ def tafsirs
                .eager_load(:translated_name)
                .tafsirs
                .approved
+               .allowed_to_share
                .order('priority ASC')
 
       @presenter = ResourcePresenter.new(params)
@@ -62,6 +64,8 @@ def tafsir_info
     def recitations
       list = Recitation
                .eager_load(reciter: :translated_name)
+               .joins(:resource_content)
+               .where.not(resource_contents: { permission_to_share: :rejected })
                .approved
                .order('translated_names.language_priority desc')
 
@@ -93,6 +97,7 @@ def chapter_infos
                .chapter_info
                .one_chapter
                .approved
+               .allowed_to_share
 
       @chapter_infos = eager_load_translated_name(list)
 
@@ -103,8 +108,9 @@ def verse_media
       @media = ResourceContent
                  .includes(:language)
                  .media
-                 .one_verse.approved
-
+                 .one_verse
+                 .approved
+                 .allowed_to_share
       render
     end
 
@@ -121,6 +127,7 @@ def changes
               .change_log(after: time)
               .filter_subtype(params[:type])
               .approved
+              .allowed_to_share
 
          render
       else

app/controllers/api/v4/search_controller.rb

@@ -29,6 +29,7 @@ def translations
                                   .approved
                                   .translations
                                   .one_verse
+                                  .allowed_to_share
 
         params[:translations] = approved_translations
                                   .where(id: translation)

app/controllers/application_controller.rb

@@ -39,12 +39,14 @@ def fetch_locale
   end
 
   def set_cache_headers
-    if action_name != 'random'
-      expires_in 7.day, public: true
-      # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
-      headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains; preload'
-    end
+    headers['Cache-Control'] = 'no-store, no-cache, max-age=0, private, must-revalidate'
+    headers['Pragma'] = 'no-cache'
+    headers['Expires'] = '0'
+
+    # Keep HSTS header
+    headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains; preload'
 
+    # Keep CORS header
     headers['Access-Control-Allow-Origin'] = '*'
   end
 

app/controllers/health_controller.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+class HealthController < ApplicationController
+  # Lightweight liveness endpoint: confirms app process & middleware stack respond.
+  def show
+    render json: { status: 'ok' }
+  end
+end

app/controllers/mobile/translations_controller.rb

@@ -3,7 +3,7 @@
 module Mobile
   class TranslationsController < ApplicationController
     def index
-      resources = ResourceContent.includes(:language).translations.one_verse.approved
+      resources = ResourceContent.includes(:language).translations.one_verse.approved.allowed_to_share
 
       render json: resources, root: :data, each_serializer: Mobile::TranslationSerializer
     end