chats 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: baea21fb7f7a5ce0c50ec662b84fbef24adaa4ceb0c12a876de29891f88a2419
-  data.tar.gz: c199fc0c645bd667b7672e1ca0ea7257eb0e9cf05179c576f606fcf784b9feb0
+  metadata.gz: '001542179fe490a6f8743099b6b31a2d9cff7cf43a28b982c0cac932b8c06bd1'
+  data.tar.gz: 29720d94ecd7302ae2adcb17f9a81b6fbc6f0365d900e5773655250e14ea9bb9
 SHA512:
-  metadata.gz: 7739f616cf9e555ea1ed2e6321937bc6698d9e08733ee6c496d95ed41e2331694b5340ab5be641ac2e73875a17c4a4859bfa09e01cb0b3984a5b4fa340dcceb1
-  data.tar.gz: 712ac6d49724af1505807c3aaadd4f10fd52c8fec9653efbb9d4a89843be6fa0b2ec680873e240cc4c2bc139048cb5796b1165fced263992dc13d1499d2da0fc
+  metadata.gz: 3d9f25316a4832204fb285ea6547fe34a5c7f938c148307bef311a3311ed770401329b60e020031d7468b200ecf1170294cb7edce6dfbebb5d8c386052aa1adf
+  data.tar.gz: d7f28cf57770b2ad517299f56d431ea11fcc6f33b1886c36a815cce6de81dec983082cd16eb74dfd3528bb966af8feb277cb6ff286d7c89d395f934a12737d3c

data/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to this project are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.1] - 2026-10-17
+
+### Fixed
+- **An action's strings are frozen copies.** `Data` freezes the action but
+  not the strings it was handed, so `action.url.replace("javascript:…")`,
+  or the caller mutating the string they passed in, could rewrite a
+  validated action in memory before the bubble rendered it. `Chats::Action`
+  now keeps a frozen copy of both members: what the validator saw is what
+  renders.
+- **An empty port suffix is refused.** `https://host:/x` parses as the
+  default port and slipped past the 1..65535 rule; a named port must have
+  digits.
+- **An action's label is a plain String.** A label handed over as an
+  html_safe string (a host's `t("…_html")`) kept the mark through the copy
+  and rendered unescaped in the button. The copy is now a plain `String`,
+  so the bubble escapes it like any other content.
+- **`config.inbox_scope` is one rule, applied once.** `Messager#chats` now
+  applies it, so the inbox relation, `unread_chats_count`, the inbox screen
+  and the live badge all agree. The badge broadcast used to count through
+  the raw `inbox_for` relation and could light up for a conversation the
+  inbox would never show (a host scoping game records out of the inbox saw
+  the badge count them). `Chats::Inbox` builds on `viewer.chats`, so a
+  host's own override of `chats` reaches the inbox screen too.
+- The README said the inbox preview still shows a soft-deleted message's
+  body; it reads "Message deleted", as for any tombstone.
+
 ## [0.4.0] - 2026-10-17
 
 Action buttons. A support desk writes "Your invoice is ready" and wants a

data/README.md

@@ -469,7 +469,7 @@ Chats::Action.new(label: "Pay now", url: "/pay")   # accepted anywhere a Hash is
 - `url`: at most 2048 characters, and EITHER an absolute `http://` / `https://` URL with a host (and, if it names one, a port from 1 to 65535), OR a path on your site that starts with a single `/`. Everything else is refused: `javascript:`, `data:`, `mailto:`, relative paths, and anything a browser would send to another site: `//elsewhere.example`, `///elsewhere.example`, `/\elsewhere.example`, `/<tab>/…`. URLs must be escaped, as Rails' url helpers already produce them.
 - The error is `errors.of_kind?(:action, :invalid)`, with a readable message in `en` and `es`.
 
-Body rules don't change: an action goes with a message, it is never a message by itself. Both text and system messages can carry one. `edit!` keeps the action. **A tombstone shows neither the body nor the button**: soft deletion clears the action, and so does a moderator's `remove_reported_field!`, because it goes through the same tombstone. The inbox preview still shows the body.
+Body rules don't change: an action goes with a message, it is never a message by itself. Both text and system messages can carry one. `edit!` keeps the action. **A tombstone shows neither the body nor the button**: soft deletion clears the action, and so does a moderator's `remove_reported_field!`, because it goes through the same tombstone. The inbox preview reads “Message deleted”, as for any tombstone.
 
 **Only your Ruby code sets an action.** The composer can't: `Chats::MessagesController` permits `body` and `files` only, the same as with `author:`. Restyle the button with `.chats-message__action` (eject `chats/messages/_action.html.erb` to change its markup). It uses your `--chats-accent` / `--chats-accent-contrast` colours: accent-filled under someone else's message or a system note, reversed inside your own accent-coloured bubble.
 

data/lib/chats/action.rb

@@ -40,8 +40,23 @@ module Chats
     # URI, a symbol label — all read back as the String the column holds.
     # nil stays nil so a missing one is a validation error, not a "" that
     # looks present.
+    #
+    # Each is a frozen, PLAIN String copy. `Data` freezes the action, not the
+    # strings it was handed, so without the copy `action.url.replace(
+    # "javascript:…")` would rewrite a validated action in place — and so
+    # would the caller mutating the string they passed in. Plain, because
+    # `String.new` drops an html_safe mark: a label that arrived as a
+    # SafeBuffer (a host's `t("…_html")`) would otherwise render unescaped
+    # in the button. An action is a value: what the validator saw is what
+    # the bubble renders, and the bubble escapes it like any other content.
     def initialize(label:, url:)
-      super(label: label&.to_s, url: url&.to_s)
+      super(label: plain(label), url: plain(url))
+    end
+
+    private
+
+    def plain(value)
+      String.new(value.to_s).freeze unless value.nil?
     end
   end
 

data/lib/chats/broadcasts.rb

@@ -120,10 +120,10 @@ module Chats
           target: "chats_unread_badge",
           partial: BADGE_PARTIAL,
           # Counted at broadcast-enqueue time: the badge is advisory UI; a
-          # count that's seconds stale self-heals on the next event.
-          # reorder(nil): COUNT(DISTINCT) + the inbox's COALESCE order would
-          # error on PostgreSQL.
-          locals: { count: Chats::Conversation.inbox_for(messager).unread_by(messager).reorder(nil).distinct.count }
+          # count that's seconds stale self-heals on the next event. The
+          # SAME count the page renders (`chats_unread_badge`), so what the
+          # inbox scope hides never lights the badge.
+          locals: { count: messager.unread_chats_count }
         )
       end
 

data/lib/chats/inbox.rb

@@ -115,15 +115,12 @@ module Chats
       Chats.config.inbox_limit
     end
 
-    # Memoized so `config.inbox_scope` is consulted ONCE per inbox for the
-    # row query, however many legs it is split into (the stack aggregates
-    # apply it separately, to their own relation).
+    # The viewer's own inbox relation (`Messager#chats`: `inbox_for` with
+    # `config.inbox_scope` applied, and whatever the host's model adds on
+    # top), memoized so it is built ONCE per inbox however many legs the
+    # row query is split into (the stack aggregates build their own).
     def base_relation
-      @base_relation ||= begin
-        relation = Chats::Conversation.inbox_for(viewer)
-                                      .includes(:last_message, :subject, participants: :messager)
-        Chats.config.inbox_scope.call(relation, viewer) || relation
-      end
+      @base_relation ||= viewer.chats.includes(:last_message, :subject, participants: :messager)
     end
 
     # The polymorphic types worth splitting out. Empty when nothing stacks
@@ -244,12 +241,11 @@ module Chats
     # aggregates — independent of how deep the stack is, and of how much of
     # it we loaded.
     def stack_totals(messager)
-      scope = Chats::Conversation.inbox_for(viewer).reorder(nil).direct.where(
+      scope = viewer.chats.reorder(nil).direct.where(
         id: Chats::Participant.select(:conversation_id).where(
           messager_type: messager.class.polymorphic_name, messager_id: messager.id
         )
       )
-      scope = Chats.config.inbox_scope.call(scope, viewer) || scope
 
       {
         open: scope.distinct.count,

data/lib/chats/models/concerns/messager.rb

@@ -176,9 +176,17 @@ module Chats
     end
 
     # The inbox: every active conversation, blocked counterparts hidden,
-    # newest activity first. A relation — chain `.limit`, `.includes`, etc.
+    # `config.inbox_scope` applied, newest activity first. A relation —
+    # chain `.limit`, `.includes`, etc.
+    #
+    # THE one definition of "what is in this messager's inbox": the inbox
+    # screen, the unread count, the live badge and a host's own queries all
+    # read it, so a conversation the scope hides is hidden everywhere. Until
+    # 0.4.1 the badge counted through the raw `inbox_for` relation and could
+    # light up for a conversation the inbox would never show.
     def chats
-      Chats::Conversation.inbox_for(self)
+      relation = Chats::Conversation.inbox_for(self)
+      Chats.config.inbox_scope.call(relation, self) || relation
     end
 
     # Number of conversations with unread messages (the WhatsApp-style nav

data/lib/chats/models/message.rb

@@ -40,6 +40,8 @@ module Chats
     ACTION_LABEL_LIMIT = 80
     ACTION_URL_LIMIT = 2048
     ACTION_URL_SCHEMES = %w[http https].freeze
+    # An authority ending in ":" with nothing after it ("https://host:/x").
+    EMPTY_PORT = %r{\A[a-z][a-z0-9+.-]*://[^/?#]*:(?:[/?#]|\z)}i
     ACTION_URL_PORTS = (1..65_535)
 
     belongs_to :conversation,
@@ -382,6 +384,9 @@ module Chats
       url = action.url
       return false if url.blank? || url.length > ACTION_URL_LIMIT
       return false if url.start_with?("//", "/\\")
+      # `https://host:` parses as the default port, so an empty port suffix
+      # would pass the range check below; a named port must have digits.
+      return false if url.match?(EMPTY_PORT)
 
       uri = URI.parse(url)
       if uri.scheme

data/lib/chats/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Chats
-  VERSION = "0.4.0"
+  VERSION = "0.4.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: chats
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - rameerez