bp3-activestorage 0.1.5 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a0ea6328c63cb70ea785d2842dac2ef526f85681c14debc226c89c47175bc78
-  data.tar.gz: 6471cfc53197041d0643d4dbc64b79ea545d90e55fe17a9e5262d0e93f4d4a13
+  metadata.gz: c92e9ed2f063e2d3d1a777bdd9f3d3ddb23892a9ad70ef54796c4b4abf2e5f43
+  data.tar.gz: f6bcf3de5ed1ee85c69dcebab7281bbde03049f927b455e4535928d592d8ec58
 SHA512:
-  metadata.gz: d76a87d531729ccdb45a03f1a1cf57ea40681f744720f8fc80919924c3bd16709f136bca306da6e72ee9892547bc39b8bd7b039986382ce3c4e791c919910e67
-  data.tar.gz: 719c8989bece6050ab37625e9a7192bc88f867f446bad5f979c6efa5e65f08a1de764bc9dd5352f18b080f14e1629c8c3686b6a6e511a8355a9554b4c6e037e0
+  metadata.gz: a2fb3b472e8299d518b954a56b5a973a91601d23ad8dd7c9555b49b441423f4ddd44e0e6f166b2a33d34b2963c6d85c69b2ba33984dadf4cef2e16c07fabd990
+  data.tar.gz: 37c2134952350031e4d4a994468d4e38f8a566a83257e59ffcf0d310a904f639cc660d648818b307f5a2b124f699bc5f119092a40089a81f2caae3f6e217b003

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 ## [Unreleased]
 
+## [0.2.0] - 2026-10-30
+
+### Security
+
+- Refuse `ActiveStorage::Blob#key` to explore, as it locates the file in storage
+- Require bp3-core 0.4.0, for `unexplorable_columns`
+
 ## [0.1.5] - 2026-01-12
 
 - Update gems

data/CLAUDE.md

@@ -0,0 +1,56 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+bp3-activestorage adapts `activestorage` for BP3 (persuavis/black_phoebe_3), a multi-site multi-tenant
+Rails application. It makes ActiveStorage's records and controllers BP3-aware. There is nothing to
+configure: adding the gem is enough.
+
+## Commands
+
+The gems run on Ruby 3.4.6 (`.ruby-version`). Prefix commands with `~/.rvm/bin/rvm 3.4.6 do` when the
+shell is not already on it; a missing `rspec` means the wrong Ruby, not a missing bundle.
+
+- `bundle exec rake` - specs and RuboCop (the default task)
+- `bundle exec rspec spec/path/to/file_spec.rb[:LINE]` - one file or example
+- `bundle exec rubocop` / `bundle exec rubocop -a`
+- `bin/setup`, `bin/console`, `rake install`
+
+## Architecture
+
+`lib/bp3/activestorage/railtie.rb` reopens five classes in an `after_initialize` block. The Railtie is
+only defined when `Rails.env` is.
+
+**Models**: `ActiveStorage::Attachment`, `Blob` and `VariantRecord`
+- include `Bp3::Core::Rqid`, `Sqnr` and `Ransackable` (Blob also `Displayable`), call
+  `use_sqnr_for_ordering` and `has_paper_trail`
+- declare optional `belongs_to :sites_site` (aliased `site`) and `belongs_to :tenant` by hand
+- define `table_name_basis`, the table name without its `public.` schema prefix
+- **Do not include `Bp3::Core::Tenantable`.** Its callbacks set site and tenant behind the scenes and its
+  default scope then hides blobs that a later lookup needs to find
+- Blob's `version_filter_mask` is `'[FILTERED][AB]'`
+
+**Controllers**: `ActiveStorage::BaseController` and `ActiveStorage::Representations::ProxyController`
+include `Bp3::Core::Actions`, `Settings`, `FeatureFlags` and `Cookies`, so file requests get the same site,
+tenant and request tracking as the rest of the application. They do not authenticate;
+`authenticate_root!` breaks the proxy controller.
+
+## Testing
+
+The spec only checks the version; the Railtie needs a Rails application with a database to exercise. Try a
+change against the application (black_phoebe_3) by putting this repo's `lib` ahead of the bundled gem.
+
+## Code Style
+
+- RuboCop (`.rubocop.yml`): target Ruby 3.2.2, NewCops, rubocop-rake and rubocop-rspec; AbcSize 26,
+  MethodLength 15, BlockLength 66, ModuleLength 150; `Lint/ConstantDefinitionInBlock` and `Lint/Void`
+  are off for `lib/bp3/**/railtie.rb`, where classes are reopened inside a block
+- Every file starts with `# frozen_string_literal: true`
+- American English; no trailing whitespace on any added or modified line
+
+## Release
+
+Bump `lib/bp3/activestorage/version.rb` and add a `CHANGELOG.md` entry. `rake release` tags, pushes and
+publishes to rubygems.org; leave releasing and committing to the user.

data/Gemfile.lock

@@ -1,17 +1,17 @@
 PATH
   remote: .
   specs:
-    bp3-activestorage (0.1.5)
+    bp3-activestorage (0.2.0)
       activestorage (~> 8.1)
-      bp3-core (>= 0.1.0)
+      bp3-core (>= 0.4.0)
       paper_trail (>= 15.1)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    actionpack (8.1.2)
-      actionview (= 8.1.2)
-      activesupport (= 8.1.2)
+    actionpack (8.1.4)
+      actionview (= 8.1.4)
+      activesupport (= 8.1.4)
       nokogiri (>= 1.8.5)
       rack (>= 2.2.4)
       rack-session (>= 1.0.1)
@@ -19,28 +19,28 @@ GEM
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
-    actionview (8.1.2)
-      activesupport (= 8.1.2)
+    actionview (8.1.4)
+      activesupport (= 8.1.4)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (8.1.2)
-      activesupport (= 8.1.2)
+    activejob (8.1.4)
+      activesupport (= 8.1.4)
       globalid (>= 0.3.6)
-    activemodel (8.1.2)
-      activesupport (= 8.1.2)
-    activerecord (8.1.2)
-      activemodel (= 8.1.2)
-      activesupport (= 8.1.2)
+    activemodel (8.1.4)
+      activesupport (= 8.1.4)
+    activerecord (8.1.4)
+      activemodel (= 8.1.4)
+      activesupport (= 8.1.4)
       timeout (>= 0.4.0)
-    activestorage (8.1.2)
-      actionpack (= 8.1.2)
-      activejob (= 8.1.2)
-      activerecord (= 8.1.2)
-      activesupport (= 8.1.2)
+    activestorage (8.1.4)
+      actionpack (= 8.1.4)
+      activejob (= 8.1.4)
+      activerecord (= 8.1.4)
+      activesupport (= 8.1.4)
       marcel (~> 1.0)
-    activesupport (8.1.2)
+    activesupport (8.1.4)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -55,8 +55,8 @@ GEM
       uri (>= 0.13.1)
     ast (2.4.3)
     base64 (0.3.0)
-    bigdecimal (4.0.1)
-    bp3-core (0.2.0)
+    bigdecimal (4.1.3)
+    bp3-core (0.4.0)
       actionview (~> 8.1)
       activesupport (~> 8.1)
       bp3-request_state (~> 0.1)
@@ -65,54 +65,59 @@ GEM
       activesupport (~> 8.1)
       request_store (>= 1.5.1)
     builder (3.3.0)
-    byebug (12.0.0)
-    concurrent-ruby (1.3.6)
+    byebug (13.0.0)
+      reline (>= 0.6.0)
+    concurrent-ruby (1.3.8)
     connection_pool (3.0.2)
-    crass (1.0.6)
+    crass (1.0.8)
     diff-lcs (1.6.2)
     drb (2.2.3)
     erubi (1.13.1)
-    globalid (1.3.0)
+    globalid (1.4.0)
       activesupport (>= 6.1)
-    i18n (1.14.8)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
-    json (2.18.0)
-    language_server-protocol (3.17.0.5)
+    io-console (0.9.5)
+    json (3.1.0)
+    language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
     logger (1.7.0)
-    loofah (2.25.0)
+    loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    marcel (1.1.0)
-    minitest (6.0.1)
+    marcel (1.2.1)
+    minitest (6.0.6)
+      drb (~> 2.0)
       prism (~> 1.5)
-    nokogiri (1.19.0-x86_64-darwin)
+    nokogiri (1.19.4-x86_64-darwin)
       racc (~> 1.4)
     paper_trail (17.0.0)
       activerecord (>= 7.1)
       request_store (~> 1.4)
-    parallel (1.27.0)
-    parser (3.3.10.0)
+    parallel (2.3.0)
+    parser (3.3.13.0)
       ast (~> 2.4.1)
       racc
-    prism (1.7.0)
+    prism (1.9.0)
     racc (1.8.1)
-    rack (3.2.4)
-    rack-session (2.1.1)
+    rack (3.2.8)
+    rack-session (2.1.2)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
-    rack-test (2.2.0)
+    rack-test (2.3.0)
       rack (>= 1.3)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.2)
-      loofah (~> 2.21)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     rainbow (3.1.1)
-    rake (13.3.1)
-    regexp_parser (2.11.3)
+    rake (13.4.2)
+    regexp_parser (2.13.1)
+    reline (0.7.0)
+      io-console (~> 0.5)
     request_store (1.7.0)
       rack (>= 1.4)
     rspec (3.13.2)
@@ -124,39 +129,40 @@ GEM
     rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.7)
+    rspec-mocks (3.13.8)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-support (3.13.6)
-    rubocop (1.82.1)
-      json (~> 2.3)
+    rspec-support (3.13.7)
+    rubocop (1.92.2)
+      json (>= 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
-      parallel (~> 1.10)
+      parallel (>= 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.48.0, < 2.0)
+      regexp_parser (>= 2.11.3, < 3.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.0)
+    rubocop-ast (1.50.0)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     rubocop-rake (0.7.1)
       lint_roller (~> 1.1)
       rubocop (>= 1.72.1)
-    rubocop-rspec (3.9.0)
+    rubocop-rspec (3.10.2)
       lint_roller (~> 1.1)
-      rubocop (~> 1.81)
+      regexp_parser (>= 2.0)
+      rubocop (~> 1.86, >= 1.86.2)
     ruby-progressbar (1.13.0)
     securerandom (0.4.1)
-    timeout (0.6.0)
+    timeout (0.6.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    unicode-display_width (3.2.0)
-      unicode-emoji (~> 4.1)
-    unicode-emoji (4.2.0)
-    uri (1.1.1)
+    unicode-display_width (3.3.0)
+      unicode-emoji (~> 4.3)
+    unicode-emoji (4.3.0)
+    uri (1.1.2)
     useragent (0.16.11)
 
 PLATFORMS

data/bp3-activestorage.gemspec

@@ -32,7 +32,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   spec.add_dependency 'activestorage', '~> 8.1'
-  spec.add_dependency 'bp3-core', '>= 0.1.0'
+  spec.add_dependency 'bp3-core', '>= 0.4.0'
   spec.add_dependency 'paper_trail', '>= 15.1'
 
   spec.add_development_dependency 'byebug'

data/lib/bp3/activestorage/railtie.rb

@@ -2,7 +2,7 @@
 
 # require 'rails/railtie'
 
-# rubocop:disable Metrics/BlockLength
+# rubocop:disable-next Metrics/BlockLength
 module Bp3
   module Activestorage
     if defined?(Rails.env)
@@ -41,6 +41,9 @@ module Bp3
                 include Bp3::Core::Displayable
                 include Bp3::Core::Ransackable
 
+                # The key locates the file in storage, so it is not to be guessed at one character at a time
+                self.unexplorable_columns = %w[key]
+
                 use_sqnr_for_ordering
                 has_paper_trail
 
@@ -107,4 +110,3 @@ module Bp3
     end
   end
 end
-# rubocop:enable Metrics/BlockLength

data/lib/bp3/activestorage/version.rb

@@ -2,6 +2,6 @@
 
 module Bp3
   module Activestorage
-    VERSION = '0.1.5'
+    VERSION = '0.2.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bp3-activestorage
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.2.0
 platform: ruby
 authors:
 - Wim den Braven
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.4.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.4.0
 - !ruby/object:Gem::Dependency
   name: paper_trail
   requirement: !ruby/object:Gem::Requirement
@@ -145,6 +145,7 @@ files:
 - ".rubocop.yml"
 - ".yardopts"
 - CHANGELOG.md
+- CLAUDE.md
 - Gemfile
 - Gemfile.lock
 - LICENSE.txt
@@ -179,7 +180,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.4
 specification_version: 4
 summary: bp3-activestorage adapts activestorage for BP3 (persuavis/black_phoebe_3).
 test_files: []