baldur 0.1.1 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c530dc1592f68c70aea978df00320e2b5c60c3bdf1438fed868858b13808e19c
-  data.tar.gz: '0827b0d90a5520b0af7fcc92fc4d6cae262274d54a7bfe6c8ba92c8beacc1d45'
+  metadata.gz: 91618f676806f1de454dd46fca5f426a13f4b5504bf7f2e1c91816325784f740
+  data.tar.gz: f91cc858789b87d5eacf92f0e9835ec614b288f045d4333dc2e19c2889850209
 SHA512:
-  metadata.gz: aeeda062066859904828caecb85e2dc4599274138b6d2aeaa3172a9edfd358c673579b1e32b4864e19422b306811e7f774d7e0c2208c6817d8f94438b2998bb0
-  data.tar.gz: 21f0c38a4047ab20ae7bd75c2001f8a4e1f013f27ddb930852c915cf39627017e318399cd204038b77e538686c05bce2323fdbd82652cda316056c5b06400bc3
+  metadata.gz: dbcd1175ac464c6dc6c730f5a39c154ec91371a4ea0214b8f0db0b0fc5e595ab0ffc7abaf0a8196cb065c43ce422305a509d799962b76b99746b3ab9a5449b28
+  data.tar.gz: f706bf4fadfeb7dfdd5919c8e93c968e402e65a3dcb69a9dae2a2e8ac909649c1ddc06895f0e05985663d5f34a938ee8d06a44f592f605949e96bb201e06b774

data/README.md

@@ -12,10 +12,10 @@ Baldur is a reusable Rails UI engine for apps using the same frontend stack as t
 
 1. Add Baldur to the target app `Gemfile`:
 
-Baldur now declares `tailwindcss-rails` as a gem dependency, so hosts do not need to add that gem separately unless they want to pin a specific version.
+Baldur now declares `tailwindcss-rails >= 4.4.0` as a gem dependency, so hosts do not need to add that gem separately unless they want to enforce their own minimum version.
 
 ```ruby
-gem "baldur"
+gem "baldur", ">= 0.1.3"
 ```
 
 2. Run:
@@ -45,6 +45,18 @@ bundle exec rails generate baldur:install_google_auth
 
 Default install behavior keeps Geist loaded through the host `fonts.css` scaffold. If a host app wants a different stack, it should update `fonts.css` and then map the loaded families in `theme.css`.
 
+## Security
+
+- New Baldur releases require MFA for RubyGems owners via gem metadata starting with `0.1.2`.
+- Release artifacts should be installed from RubyGems or GitHub releases and can be verified with the published `.sha512` checksum file.
+- Report vulnerabilities privately through GitHub Security Advisories.
+
+To verify a release artifact manually:
+
+```sh
+sha512sum -c baldur-0.1.3.gem.sha512
+```
+
 ## Styling Ownership
 
 Tailwind provides the utility/base layer. Baldur is the source of truth for shared design-system primitives.

data/SECURITY.md

@@ -0,0 +1,29 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please do not report security issues through public GitHub issues or pull requests.
+
+Preferred reporting paths:
+
+1. Open a private GitHub Security Advisory draft for this repository.
+2. Use GitHub Security Advisories for private disclosure.
+
+Please include:
+
+- affected version(s)
+- a clear description of the issue
+- reproduction steps or proof of concept
+- impact assessment if known
+- any suggested remediation
+
+## Disclosure Process
+
+- I will acknowledge receipt of a report as quickly as practical.
+- I will investigate privately and prepare a fix before public disclosure.
+- Once a fix is available, I may publish a GitHub Security Advisory and request a CVE if the issue merits one.
+- Public disclosure should wait until affected users have a reasonable chance to upgrade.
+
+## Supported Versions
+
+Security fixes are best-effort and will normally target the latest released version of Baldur.

data/TODO.md

@@ -3,4 +3,3 @@
 - Add a dedicated dummy app in the extracted gem repo for visual smoke checks.
 - Add a component inventory/showcase page in that dummy app.
 - Add a few interaction-specific showcase pages for modal, sidebar, menu select, snackbar, and `panel_secondary`.
-- Add release automation in the extracted gem repo once publication workflow is defined.

data/app/assets/stylesheets/baldur/application/components/forms.css

@@ -145,6 +145,14 @@
     padding-right: calc(var(--space-4) + 40px);
   }
 
+  .date-field__native--hidden {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    opacity: 0;
+    pointer-events: none;
+  }
+
   .date-field__toggle {
     position: absolute;
     top: 50%;

data/app/helpers/baldur/ui_helper_forms.rb

@@ -97,7 +97,7 @@ module Baldur
       native_options[:disabled] = true if disabled
       native_options[:tabindex] ||= "-1"
       native_options[:autocomplete] ||= "off"
-      native_options[:style] ||= "position:absolute; inset:auto; width:1px; height:1px; opacity:0; pointer-events:none;"
+      native_options[:class] = [ native_options[:class], "date-field__native--hidden" ].compact.join(" ")
 
       if min_date.present?
         min_date_value = case min_date

data/app/views/baldur/components/_tooltip.html.erb

@@ -62,7 +62,6 @@ end %>
                   id: tooltip_id,
                   role: "tooltip",
                   class: bubble_classes,
-                  style: "text-align: left;",
                   data: {
                     tooltip_target: "bubble",
                     state: "closed"

data/baldur.gemspec

@@ -4,11 +4,16 @@ Gem::Specification.new do |spec|
   spec.name        = "baldur"
   spec.version     = Baldur::VERSION
   spec.authors     = [ "Varun Murkar" ]
-  spec.email       = [ "hello@varunmurkar.com" ]
   spec.summary     = "Reusable Rails UI engine for same-stack application interfaces"
   spec.description = "Baldur packages reusable Rails view helpers, components, styles, and Stimulus controllers."
   spec.homepage    = "https://github.com/varunmurkar/baldur"
   spec.license     = "MIT"
+  spec.metadata = {
+    "source_code_uri" => "https://github.com/varunmurkar/baldur",
+    "bug_tracker_uri" => "https://github.com/varunmurkar/baldur/issues",
+    "changelog_uri" => "https://github.com/varunmurkar/baldur/releases",
+    "rubygems_mfa_required" => "true"
+  }
 
   spec.files = Dir.chdir(__dir__) do
     Dir[
@@ -16,6 +21,7 @@ Gem::Specification.new do |spec|
       "README.md",
       "TODO.md",
       "LICENSE",
+      "SECURITY.md",
       "baldur.gemspec",
       "Gemfile"
     ].select { |path| File.file?(path) }
@@ -26,5 +32,5 @@ Gem::Specification.new do |spec|
   spec.add_dependency "importmap-rails"
   spec.add_dependency "lucide-rails"
   spec.add_dependency "rails", ">= 8.1.0"
-  spec.add_dependency "tailwindcss-rails"
+  spec.add_dependency "tailwindcss-rails", ">= 4.4.0"
 end

data/lib/baldur/version.rb

@@ -1,3 +1,3 @@
 module Baldur
-  VERSION = "0.1.1".freeze
+  VERSION = "0.1.3".freeze
 end

data/test/csp_rendering_test.rb

@@ -0,0 +1,60 @@
+require_relative "test_helper"
+
+require "action_controller"
+
+class BaldurCspRenderingTest < Minitest::Test
+  class TestController < ActionController::Base
+    append_view_path File.expand_path("../app/views", __dir__)
+    helper Baldur::UiHelper
+    helper Baldur::UiHelperForms
+  end
+
+  def test_tooltip_renders_without_inline_style_attribute
+    html = TestController.render(
+      partial: "baldur/components/tooltip",
+      locals: {
+        text: "Info",
+        content: "Tooltip body",
+        show_icon: true,
+        icon: "circle-help",
+        variant: :link,
+        wrapper_class: nil,
+        trigger_class: nil,
+        bubble_class: nil,
+        inline: false
+      }
+    )
+
+    refute_includes html, 'style="text-align: left;"'
+    assert_includes html, 'role="tooltip"'
+  end
+
+  def test_date_field_renders_hidden_native_input_class_without_inline_style
+    html = TestController.render(
+      partial: "baldur/components/date_field",
+      locals: {
+        wrapper_classes: "field date-field",
+        label: "Due date",
+        supporting_text: nil,
+        display_input_options: {
+          id: "due-date-display",
+          class: "text-field__control date-field__display",
+          type: "text",
+          name: "due_date"
+        },
+        native_input_options: {
+          id: "due-date-native",
+          class: "date-field__native date-field__native--hidden",
+          type: "date",
+          tabindex: "-1"
+        },
+        toggle_label: "Open date picker",
+        icon_name: "calendar",
+        support_id: "due-date-support"
+      }
+    )
+
+    refute_includes html, 'style="position:absolute;'
+    assert_includes html, 'date-field__native--hidden'
+  end
+end

data/test/test_helper.rb

@@ -3,7 +3,13 @@ ENV["MT_NO_PLUGINS"] = "1"
 require "bundler/setup"
 require "minitest/autorun"
 require "rails/generators/test_case"
+require "rails"
+require "lucide-rails"
 
 require_relative "../lib/baldur"
 require_relative "../app/helpers/baldur/render_helper"
+require_relative "../app/helpers/baldur/ui_helper_feedback"
+require_relative "../app/helpers/baldur/ui_helper_unavailable"
+require_relative "../app/helpers/baldur/ui_helper_forms"
+require_relative "../app/helpers/baldur/ui_helper"
 require_relative "../app/helpers/baldur/marketing_helper"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: baldur
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.3
 platform: ruby
 authors:
 - Varun Murkar
@@ -57,18 +57,16 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 4.4.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 4.4.0
 description: Baldur packages reusable Rails view helpers, components, styles, and
   Stimulus controllers.
-email:
-- hello@varunmurkar.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -76,6 +74,7 @@ files:
 - Gemfile
 - LICENSE
 - README.md
+- SECURITY.md
 - TODO.md
 - app/assets/javascripts/baldur/controllers/accordion_controller.js
 - app/assets/javascripts/baldur/controllers/alert_controller.js
@@ -200,6 +199,7 @@ files:
 - lib/generators/baldur/install_panel_right/install_panel_right_generator.rb
 - lib/generators/baldur/install_panel_secondary/install_panel_secondary_generator.rb
 - script/verify_host_install
+- test/csp_rendering_test.rb
 - test/gemspec_test.rb
 - test/install_generator_test.rb
 - test/install_panel_secondary_generator_test.rb
@@ -238,7 +238,11 @@ files:
 homepage: https://github.com/varunmurkar/baldur
 licenses:
 - MIT
-metadata: {}
+metadata:
+  source_code_uri: https://github.com/varunmurkar/baldur
+  bug_tracker_uri: https://github.com/varunmurkar/baldur/issues
+  changelog_uri: https://github.com/varunmurkar/baldur/releases
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib