activeadmin-command_palette 0.1.8 → 0.1.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3801c8198b67b942accb14aa27744358b7991e66bf36de38de9fa94a796c89b4
-  data.tar.gz: 9e103a701673046e5203ef0878484c17047ebcf61fc83cc91e2cff94bef49723
+  metadata.gz: 761e971bf2eb65439610f528638603ba826aabf467d368fd33dd64b036b71bdd
+  data.tar.gz: 954b5c0eaae03a6d77bfc928dc7d3fe3b33264254d5c2deb958920bdd2e5c402
 SHA512:
-  metadata.gz: 12c57eb1fa8b2682c53f4c2616806de2a8bc1449949d3850bff5deef2d10f687c5ebcb7fd861126ed0dafdc64a68b4c15b7186c09438bcb0eab4e5fb9cef670c
-  data.tar.gz: bd79f196c0e4a3330191b4bee534d2fce4010faa3199cbdcd46c19531b25a8dce41e7367476bbc691d6053f3264823df198c3f08c4a7e25cab7f80324d5ba96a
+  metadata.gz: 02d020e34c042e0e4932009b19993cb5a94da75ce1014e13456fb4cd51c73b1244b89a255fc9e86329f939049d7581f2b418a0914349d53828b8ad52c0555257
+  data.tar.gz: f8004fd341df11671cfaa26c5d1048c234009f9e2956517988baf04940597d9bc9e78cc50178c3f5c227582f7a9854ee7a1118e51c858a7456ae1b4dfbd6c5b0

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 # CHANGELOG
 
-## Unreleased
+## 0.1.9 (2026-11-03)
+
+- Keep navigation working when browser storage is unavailable.
+- Fail closed when release confirmation input reaches EOF.
+- Enforce CSRF protection on the options endpoint itself.
+- Treat a nil host finder payload as an empty result list.
+- Prefer `new_admin_user_session_path` before `new_user_session_path` for the sign-in recovery link.
+- Navigate only through resolved `http`/`https` URLs after same-origin checks.
+- Document host finder authorization, POST preference, and options rate limits in the install README.
+- Use ASCII punctuation in palette copy, breadcrumbs, and help strings.
+- Mark RFC 0007 and RFC 0008 Stable after their feedback windows closed.
 
 ## 0.1.8
 

data/README.md

@@ -58,7 +58,7 @@ ActiveAdmin.register User do
     find_by :email, :nickname, :name
     order :name
     actions :view, :create, :edit, :destroy
-    create help: "Create user — optional email=", params: [
+    create help: "Create user - optional email=", params: [
       {name: "email", required: false, query_key: "user[email]"}
     ]
     member "Open in chat",
@@ -88,7 +88,7 @@ end
 
 `reload!` (run from ActiveAdmin `after_load`) merges resource DSL actions/finders with the global `actions` list.
 
-Action fields: `scope` (`global` / `collection` / `member`), `when` (`any` / `index` / `show` / `new` / `edit`), `resource`, `verb` (`view` / `create` / `edit` / `destroy` / …), `params`, `help`, `finder_kind`, `query`, `if` (boolean or callable evaluated in the view on each request), optional `detail` / `keywords`. The layout emits a page `context` value used to gate member and collection actions.
+Action fields: `scope` (`global` / `collection` / `member`), `when` (`any` / `index` / `show` / `new` / `edit`), `resource`, `verb` (`view` / `create` / `edit` / `destroy` / ...), `params`, `help`, `finder_kind`, `query`, `if` (boolean or callable evaluated in the view on each request), optional `detail` / `keywords`. The layout emits a page `context` value used to gate member and collection actions.
 
 Finder rows may include optional `detail` (second line under the label; `subtitle` is accepted as an alias) and `keywords` (extra client match strings). Longer registered prefixes win when several share a start (for example `@team` before `@`).
 
@@ -96,7 +96,13 @@ Finder rows may include optional `detail` (second line under the label; `subtitl
 
 Apply host authorization before returning rows. Prefer this match order when building SQL: exact primary key, then exact unique columns from `find_by`, then prefix match, then `ILIKE` / `LIKE`, then `limit`. Put a stable person-facing name in `label` and email, identifier, or id in `detail` when that helps operators disambiguate.
 
-Mount the engine inside your authenticated admin boundary and set `authorize_with` so the JSON options endpoint stays closed to unsigned or unauthorized callers.
+Host checklist before production:
+
+1. Mount the engine inside the authenticated admin boundary.
+2. Set `authorize_with` so unsigned or unauthorized callers cannot hit the JSON options endpoint.
+3. Scope every finder with the same record policy as the ActiveAdmin resource (`accessible_by`, `policy_scope`, or equivalent). Do not copy a bare `.all` finder into a multi-role or multi-tenant app.
+4. Prefer the CSRF-protected `POST` client path. Treat `GET .../options` as a legacy integration surface: `q` can appear in access logs, proxies, and history.
+5. Rate-limit `/admin/command_palette/options` at the host (the gem caps rows per request, not request volume).
 
 ### Related surfaces
 
@@ -135,7 +141,7 @@ make release
 
 ## Design RFCs
 
-Numbered design documents for the public contract live in [`rfcs/`](rfcs/README.md). Shipped features are specified in RFC 0003 through RFC 0006. Finder detail and bounded POST search are proposed in RFC 0007 and RFC 0008. Process rules are RFC 0001.
+Numbered design documents for the public contract live in [`rfcs/`](rfcs/README.md). Shipped features are specified in RFC 0003 through RFC 0008. Process rules are RFC 0001.
 
 ## Links
 

data/activeadmin-command_palette.gemspec

@@ -59,7 +59,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rubocop-rails", "~> 2.34"
   spec.add_development_dependency "rubocop-rspec", "~> 3.8"
   spec.add_development_dependency "rubocop-thread_safety", "~> 0.7"
-  spec.add_development_dependency "sqlite3", ">= 2.9.6"
+  spec.add_development_dependency "sqlite3", ">= 2.10.2"
   spec.add_development_dependency "standard", "~> 1.52"
   spec.add_development_dependency "standard-custom", "~> 1.0"
   spec.add_development_dependency "standard-performance", "~> 1.8"

data/app/assets/controllers/activeadmin_command_palette/command_palette_controller.js

@@ -21,7 +21,7 @@ export default class extends Controller {
     minQueryLength: { type: Number, default: 2 },
     requestTimeout: { type: Number, default: REQUEST_TIMEOUT_MS },
     empty: { type: String, default: "No matches" },
-    loading: { type: String, default: "Searching…" },
+    loading: { type: String, default: "Searching..." },
     error: { type: String, default: "Search failed. Try again." },
     unauthorized: {
       type: String,
@@ -489,7 +489,11 @@ export default class extends Controller {
       0,
       RECENT_LIMIT
     );
-    sessionStorage.setItem(RECENT_KEY, JSON.stringify(next));
+    try {
+      sessionStorage.setItem(RECENT_KEY, JSON.stringify(next));
+    } catch (_error) {
+      // Navigation must remain available when browser storage is disabled.
+    }
   }
 
   render() {
@@ -716,7 +720,7 @@ export default class extends Controller {
       rows.push({
         id: `${action.id}-param-${param.name}`,
         kind: "help",
-        label: `${param.name}= (${required})${param.help ? ` — ${param.help}` : ""}`,
+        label: `${param.name}= (${required})${param.help ? ` - ${param.help}` : ""}`,
         url: null,
       });
     });
@@ -785,7 +789,7 @@ export default class extends Controller {
       const resolved = new URL(url, window.location.href);
       if (resolved.protocol !== "http:" && resolved.protocol !== "https:") return null;
       if (sameOrigin && resolved.origin !== window.location.origin) return null;
-      return url;
+      return resolved.href;
     } catch (_error) {
       return null;
     }

data/app/controllers/active_admin/command_palette/options_controller.rb

@@ -3,6 +3,8 @@
 module ActiveAdmin
   module CommandPalette
     class OptionsController < ::ApplicationController
+      protect_from_forgery with: :exception
+
       before_action :prevent_command_palette_caching
       before_action :authenticate_command_palette_user!
 

data/config/locales/activeadmin_command_palette.en.yml

@@ -5,17 +5,17 @@ en:
       open: Open command palette
       open_short: Search
       query_label: Search commands
-      placeholder: "Go to…  > actions  ? help"
-      footer: "↑↓ navigate  ↵ open  esc close"
+      placeholder: "Go to...  > actions  ? help"
+      footer: "Up/Down navigate  Enter open  Esc close"
       empty: No matches
-      loading: Searching…
+      loading: Searching...
       error: Search failed. Try again.
       unauthorized: Session expired. Sign in again to keep searching.
       forbidden: You do not have permission to search these records.
       required: required
       optional: optional
       help:
-        go: "Go / Find — type to jump pages and records"
-        actions: "> Actions — run registered commands"
-        resource: "> View / Create — search or open new; Edit / Delete on a record page"
-        modes: "? Help — show these mode tips"
+        go: "Go / Find - type to jump pages and records"
+        actions: "> Actions - run registered commands"
+        resource: "> View / Create - search or open new; Edit / Delete on a record page"
+        modes: "? Help - show these mode tips"

data/config/locales/activeadmin_command_palette.fi.yml

@@ -5,17 +5,17 @@ fi:
       open: Avaa komentovalikko
       open_short: Haku
       query_label: Hae komentoja
-      placeholder: "Siirry…  > toiminnot  ? ohje"
-      footer: "↑↓ siirry  ↵ avaa  esc sulje"
+      placeholder: "Siirry...  > toiminnot  ? ohje"
+      footer: "Ylös/Alas siirry  Enter avaa  Esc sulje"
       empty: Ei osumia
-      loading: Haetaan…
+      loading: Haetaan...
       error: Haku epäonnistui. Yritä uudelleen.
       unauthorized: Istunto päättyi. Kirjaudu uudelleen jatkaaksesi hakua.
       forbidden: Sinulla ei ole oikeutta hakea näitä tietueita.
       required: pakollinen
       optional: valinnainen
       help:
-        go: "Siirry / Haku — kirjoita sivuille ja tietueisiin"
-        actions: "> Toiminnot — suorita rekisteröityjä komentoja"
-        resource: "> Näytä / Luo — hae tai avaa uusi; Muokkaa / Poista tietuesivulla"
-        modes: "? Ohje — näytä nämä tilavihjeet"
+        go: "Siirry / Haku - kirjoita sivuille ja tietueisiin"
+        actions: "> Toiminnot - suorita rekisteröityjä komentoja"
+        resource: "> Näytä / Luo - hae tai avaa uusi; Muokkaa / Poista tietuesivulla"
+        modes: "? Ohje - näytä nämä tilavihjeet"

data/config/locales/activeadmin_command_palette.sv.yml

@@ -5,17 +5,17 @@ sv:
       open: Öppna kommandopaletten
       open_short: Sök
       query_label: Sök kommandon
-      placeholder: "Gå till…  > åtgärder  ? hjälp"
-      footer: "↑↓ navigera  ↵ öppna  esc stäng"
+      placeholder: "Gå till...  > åtgärder  ? hjälp"
+      footer: "Upp/Ner navigera  Enter öppna  Esc stäng"
       empty: Inga träffar
-      loading: Söker…
+      loading: Söker...
       error: Sökningen misslyckades. Försök igen.
       unauthorized: Sessionen har gått ut. Logga in igen för att fortsätta söka.
       forbidden: Du har inte behörighet att söka efter dessa poster.
       required: obligatorisk
       optional: valfri
       help:
-        go: "Gå / Sök — skriv för att hoppa till sidor och poster"
-        actions: "> Åtgärder — kör registrerade kommandon"
-        resource: "> Visa / Skapa — sök eller öppna ny; Redigera / Ta bort på postsida"
-        modes: "? Hjälp — visa dessa tipslägen"
+        go: "Gå / Sök - skriv för att hoppa till sidor och poster"
+        actions: "> Åtgärder - kör registrerade kommandon"
+        resource: "> Visa / Skapa - sök eller öppna ny; Redigera / Ta bort på postsida"
+        modes: "? Hjälp - visa dessa tipslägen"

data/lib/activeadmin/command_palette/catalog.rb

@@ -167,7 +167,7 @@ module ActiveAdmin
               entry = {
                 id: "nav-#{item.id}",
                 kind: "navigate",
-                label: crumbs.join(" › "),
+                label: crumbs.join(" > "),
                 url: url,
                 method: "get"
               }

data/lib/activeadmin/command_palette/compiler.rb

@@ -83,7 +83,7 @@ module ActiveAdmin
               finder_kind: kind,
               scope: "global",
               when: "any",
-              help: "View #{noun} — type a search term"
+              help: "View #{noun} - type a search term"
             }
           end
 

data/lib/activeadmin/command_palette/finder.rb

@@ -65,6 +65,8 @@ module ActiveAdmin
         end
 
         def normalize_results(results, kind:, limit:)
+          return [] if results.nil?
+
           results.take(limit).map { |item| normalize(item, kind) }
         end
 

data/lib/activeadmin/command_palette/helper.rb

@@ -70,11 +70,11 @@ module ActiveAdmin
       end
 
       def command_palette_sign_in_path
-        if respond_to?(:new_user_session_path)
-          new_user_session_path
-        else
-          "/user/sign_in"
+        %i[new_admin_user_session_path new_user_session_path].each do |helper_name|
+          return public_send(helper_name) if respond_to?(helper_name)
         end
+
+        "/user/sign_in"
       end
 
       def command_palette_help_items

data/lib/activeadmin/command_palette/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module CommandPalette
-    VERSION = "0.1.8"
+    VERSION = "0.1.9"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-command_palette
 version: !ruby/object:Gem::Version
-  version: 0.1.8
+  version: 0.1.9
 platform: ruby
 authors:
 - Andrei Makarov
@@ -245,14 +245,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.9.6
+        version: 2.10.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.9.6
+        version: 2.10.2
 - !ruby/object:Gem::Dependency
   name: standard
   requirement: !ruby/object:Gem::Requirement