ckeditor5 1.23.4 → 1.24.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0d99c9fa1e8761c6520144f71741d0159c4e9509f524082e59b38a489635a37a
-  data.tar.gz: 951dacff990b009ba778901a4603a30315e5d95215c6b03f6837cba89a08e2e5
+  metadata.gz: 0ee1985934d17921821b5d298275a64b71154309e0492f8da8aaae33c7dab2bd
+  data.tar.gz: 880ec9989cd23462c889b35e68c7b49bdc9842c826b19326095d6380550220b8
 SHA512:
-  metadata.gz: cbc115e51be9f39716846ee4037a37d67deb81d7894b1eb460b7b4775e10a240a949c176033512fa44fd71bc4ec8f5f15feadc36bddfdb15ca0ab06016f7c345
-  data.tar.gz: 735541e4c765dfb8fe86537ee0261066be0fe18f9fec3b706da3c6e3d23b188cff772671e892fca55b9f3f1c4323ba9f5f2703bac35da54ac97aded3bbbb2113
+  metadata.gz: d7b01be500143a77b4457b50115daea67bc64351cb58b37e7f8cfe50f2c28cd0b8007633b85697ca90878a09b0c3a37df00fcae4d3927aff7bad57e27d21ca92
+  data.tar.gz: 202ed9359e0b7b57d260f391c46bcd6a985eda11fb91df409bc345470c879a587487f8f7a23382d440b5963a797411dc6c58a60ddfe43e2ab24dc70b642a7fb0

data/README.md

@@ -177,6 +177,7 @@ For extending CKEditor's functionality, refer to the [plugins directory](https:/
     - [Integration with Turbolinks 🚀](#integration-with-turbolinks-)
     - [Custom Styling 🎨](#custom-styling-)
     - [Custom plugins 🧩](#custom-plugins-)
+    - [Content Security Policy (CSP) 🛡️](#content-security-policy-csp-️)
   - [Events fired by the editor 🔊](#events-fired-by-the-editor-)
     - [`editor-ready` event](#editor-ready-event)
     - [`editor-error` event](#editor-error-event)
@@ -847,9 +848,9 @@ CKEditor5::Rails.configure do
   # ... other configuration
 
   inline_plugin :MyCustomPlugin, <<~JS
-    import { Plugin } from 'ckeditor5';
+    const { Plugin } = await import( 'ckeditor5' );
 
-    export default class MyCustomPlugin extends Plugin {
+    return class extends Plugin {
       static get pluginName() {
         return 'MyCustomPlugin';
       }
@@ -1845,9 +1846,9 @@ CKEditor5::Rails.configure do
 
   # 4. Or even define it inline:
   # inline_plugin :MyCustomPlugin,  <<~JS
-  #    import { Plugin } from 'ckeditor5';
+  #    const { Plugin } = await import( 'ckeditor5' );
   #
-  #    export default class MyCustomPlugin extends Plugin {
+  #    return class MyCustomPlugin extends Plugin {
   #      // ...
   #    }
   # JS
@@ -1866,7 +1867,7 @@ end
 // app/javascript/custom_plugins/highlight.js
 import { Plugin, Command, ButtonView } from 'ckeditor5';
 
-export default class MyCustomPlugin extends Plugin {
+return class MyCustomPlugin extends Plugin {
   static get pluginName() {
     return 'MyCustomPlugin';
   }
@@ -1973,6 +1974,31 @@ class HighlightCommand extends Command {
 
 </details>
 
+### Content Security Policy (CSP) 🛡️
+
+If you're using a Content Security Policy (CSP) in your Rails application, you may need to adjust it to allow CKEditor 5 to work correctly. CKEditor 5 uses inline scripts and styles to render the editor, so you need to allow them in your CSP configuration. The example below shows how to configure the CSP to allow CKEditor 5 to work correctly:
+
+```rb
+# config/initializers/content_security_policy.rb
+
+Rails.application.configure do
+  config.content_security_policy do |policy|
+    policy.default_src :self, :https
+    policy.font_src :self, :https, :data
+    policy.img_src :self, :https, :data
+    policy.object_src :none
+    policy.script_src "'strict-dynamic'"
+    policy.style_src :self, :https
+    policy.style_src_elem :self, :https, :unsafe_inline
+    policy.style_src_attr :self, :https, :unsafe_inline
+    policy.base_uri :self
+  end
+
+  config.content_security_policy_nonce_generator = ->(_request) { SecureRandom.base64(16) }
+  config.content_security_policy_nonce_directives = %w[script-src style-src]
+end
+```
+
 ## Events fired by the editor 🔊
 
 CKEditor 5 provides a set of events that you can listen to in order to react to changes in the editor. You can listen to these events using the `addEventListener` method or by defining event handlers directly in the view.

data/lib/ckeditor5/rails/assets/assets_bundle_html_serializer.rb

@@ -19,13 +19,24 @@ module CKEditor5::Rails::Assets
       @lazy = lazy
     end
 
-    def to_html
+    def to_html(nonce: nil)
       tags = [
-        WebComponentBundle.instance.to_html
+        WebComponentBundle.instance.to_html(nonce: nonce)
       ]
 
-      tags.prepend(preload_tags, styles_tags, window_scripts_tags) unless lazy
-      tags.prepend(AssetsImportMap.new(bundle).to_html) if importmap
+      unless lazy
+        tags.prepend(
+          preload_tags(nonce: nonce),
+          styles_tags(nonce: nonce),
+          window_scripts_tags(nonce: nonce)
+        )
+      end
+
+      if importmap
+        tags.prepend(
+          AssetsImportMap.new(bundle).to_html(nonce: nonce)
+        )
+      end
 
       safe_join(tags)
     end
@@ -40,34 +51,42 @@ module CKEditor5::Rails::Assets
 
     private
 
-    def window_scripts_tags
-      @window_scripts_tags ||= safe_join(bundle.scripts.filter_map do |script|
-        tag.script(src: script.url, nonce: true, crossorigin: 'anonymous') if script.window?
-      end)
+    def window_scripts_tags(nonce: nil)
+      scripts = bundle.scripts.filter_map do |script|
+        tag.script(src: script.url, nonce: nonce, crossorigin: 'anonymous') if script.window?
+      end
+
+      safe_join(scripts)
     end
 
-    def styles_tags
-      @styles_tags ||= safe_join(bundle.stylesheets.map do |url|
-        tag.link(href: url, rel: 'stylesheet', crossorigin: 'anonymous')
-      end)
+    def styles_tags(nonce: nil)
+      styles = bundle.stylesheets.map do |url|
+        tag.link(href: url, nonce: nonce, rel: 'stylesheet', crossorigin: 'anonymous')
+      end
+
+      safe_join(styles)
     end
 
-    def preload_tags
-      @preload_tags ||= safe_join(bundle.preloads.map do |preload|
+    def preload_tags(nonce: nil)
+      preloads = bundle.preloads.map do |preload|
         if preload.is_a?(Hash) && preload[:as] && preload[:href]
           tag.link(
             **preload,
+            nonce: nonce,
             crossorigin: 'anonymous'
           )
         else
           tag.link(
             href: preload,
             rel: 'preload',
+            nonce: nonce,
             as: self.class.url_resource_preload_type(preload),
             crossorigin: 'anonymous'
           )
         end
-      end)
+      end
+
+      safe_join(preloads)
     end
   end
 
@@ -90,11 +109,11 @@ module CKEditor5::Rails::Assets
       { imports: import_map }.to_json
     end
 
-    def to_html
+    def to_html(nonce: nil)
       tag.script(
         to_json.html_safe,
         type: 'importmap',
-        nonce: true
+        nonce: nonce
       )
     end
 

data/lib/ckeditor5/rails/assets/webcomponent_bundle.rb

@@ -21,8 +21,8 @@ module CKEditor5::Rails::Assets
       @source ||= compress_source(raw_source)
     end
 
-    def to_html
-      @to_html ||= tag.script(source, type: 'module', nonce: true)
+    def to_html(nonce: nil)
+      tag.script(source, type: 'module', nonce: nonce)
     end
 
     private

data/lib/ckeditor5/rails/assets/webcomponents/components/context.mjs

@@ -66,10 +66,20 @@ class CKEditorContextComponent extends HTMLElement {
       this.instance = null;
     }
 
+    // Broadcast context initialization event
+    window.dispatchEvent(
+      new CustomEvent('ckeditor:context:attach:before', { detail: { element: this } })
+    );
+
     const { Context, ContextWatchdog } = await import('ckeditor5');
     const plugins = await this.#getPlugins();
     const config = this.#getConfig();
 
+    // Broadcast context mounting event with configuration
+    window.dispatchEvent(
+      new CustomEvent('ckeditor:context:attach', { detail: { config, element: this } })
+    );
+
     this.instance = new ContextWatchdog(Context, {
       crashNumberLimit: 10
     });

data/lib/ckeditor5/rails/assets/webcomponents/components/editor.mjs

@@ -245,12 +245,6 @@ class CKEditorComponent extends HTMLElement {
       this.#ensureWindowScriptsInjected(),
     ]);
 
-    const Editor = await this.#getEditorConstructor();
-    const [plugins, translations] = await Promise.all([
-      this.#getPlugins(),
-      this.#getTranslations()
-    ]);
-
     // Depending on the type of the editor the content supplied on the first
     // argument is different. For ClassicEditor it's a element or string, for MultiRootEditor
     // it's an object with editables, for DecoupledEditor it's string.
@@ -262,6 +256,24 @@ class CKEditorComponent extends HTMLElement {
       content = editablesOrContent.main;
     }
 
+    // Broadcast editor initialization event. It's good time to load add inline window plugins.
+    const beforeInitEventDetails = {
+      ...content instanceof HTMLElement && { element: content },
+      ...content instanceof String && { data: content },
+      ...content instanceof Object && { editables: content }
+    };
+
+    window.dispatchEvent(
+      new CustomEvent('ckeditor:attach:before', { detail: beforeInitEventDetails})
+    );
+
+    // Start fetching constructor.
+    const Editor = await this.#getEditorConstructor();
+    const [plugins, translations] = await Promise.all([
+      this.#getPlugins(),
+      this.#getTranslations()
+    ]);
+
     const config = {
       ...this.#getConfig(),
       ...translations.length && {
@@ -270,6 +282,11 @@ class CKEditorComponent extends HTMLElement {
       plugins,
     };
 
+    // Broadcast editor mounting event. It's good time to map configuration.
+    window.dispatchEvent(
+      new CustomEvent('ckeditor:attach', { detail: { config, ...beforeInitEventDetails } })
+    );
+
     console.warn('Initializing CKEditor with:', { config, watchdog: this.hasWatchdog(), context: this.#context });
 
     // Initialize watchdog if needed

data/lib/ckeditor5/rails/assets/webcomponents/utils.mjs

@@ -34,16 +34,6 @@ function execIfDOMReady(callback) {
  * @throws {Error} When plugin loading fails
  */
 function loadAsyncImports(imports = []) {
-  const loadInlinePlugin = async ({ name, code }) => {
-    const module = await import(`data:text/javascript,${encodeURIComponent(code)}`);
-
-    if (!module.default) {
-      throw new Error(`Inline plugin "${name}" must export a default class/function!`);
-    }
-
-    return module.default;
-  };
-
   const loadExternalPlugin = async ({ url, import_name, import_as, window_name, stylesheets }) => {
     if (stylesheets?.length) {
       await loadAsyncCSS(stylesheets);
@@ -58,6 +48,12 @@ function loadAsyncImports(imports = []) {
         await injectScript(url);
       }
 
+      if (!isScriptPresent()) {
+        window.dispatchEvent(
+          new CustomEvent(`ckeditor:request-cjs-plugin:${window_name}`)
+        );
+      }
+
       if (!isScriptPresent()) {
         throw new Error(
           `Plugin window['${window_name}'] not found in global scope. ` +
@@ -82,16 +78,7 @@ function loadAsyncImports(imports = []) {
     return imported;
   };
 
-  return Promise.all(imports.map(item => {
-    switch(item.type) {
-      case 'inline':
-        return loadInlinePlugin(item);
-
-      case 'external':
-      default:
-        return loadExternalPlugin(item);
-    }
-  }));
+  return Promise.all(imports.map(loadExternalPlugin));
 }
 
 /**

data/lib/ckeditor5/rails/cdn/concerns/inline_plugins_tags_builder.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module CKEditor5::Rails
+  module Cdn::Concerns
+    module InlinePluginsTagsBuilder
+      # Includes JavaScript code for inline plugins that use CommonJS module format.
+      # This helper generates script tags that initialize plugins before CKEditor loads.
+      #
+      # @param preset [PresetBuilder, nil] Optional preset to filter plugins from.
+      #   If nil, includes plugins from all registered presets.
+      # @return [ActiveSupport::SafeBuffer] HTML script tags with plugin initializers
+      # @example Including CJS plugins for specific preset
+      #   <%= ckeditor5_inline_plugins_tags(@my_preset) %>
+      # @example Including CJS plugins from all presets
+      #   <%= ckeditor5_inline_plugins_tags %>
+      def ckeditor5_inline_plugins_tags(preset = nil)
+        plugins = if preset
+                    preset.plugins.items
+                  else
+                    Engine.presets.to_h.values.flat_map { |p| p.plugins.items }
+                  end
+
+        initializers = plugins.filter_map do |plugin|
+          next unless plugin.is_a?(Editor::PropsInlinePlugin)
+
+          Editor::InlinePluginWindowInitializer.new(plugin).to_html(
+            nonce: content_security_policy_nonce
+          )
+        end
+
+        safe_join(initializers)
+      end
+    end
+  end
+end

data/lib/ckeditor5/rails/cdn/helpers.rb

@@ -9,13 +9,17 @@ require_relative '../assets/assets_bundle_html_serializer'
 require_relative 'url_generator'
 require_relative 'ckeditor_bundle'
 require_relative 'ckbox_bundle'
+
 require_relative 'concerns/bundle_builder'
+require_relative 'concerns/inline_plugins_tags_builder'
 
 module CKEditor5::Rails
   module Cdn::Helpers
-    include Cdn::Concerns::BundleBuilder
     include ActionView::Helpers::TagHelper
 
+    include Cdn::Concerns::BundleBuilder
+    include Cdn::Concerns::InlinePluginsTagsBuilder
+
     class ImportmapAlreadyRenderedError < ArgumentError; end
 
     # The `ckeditor5_assets` helper includes CKEditor 5 assets in your application.
@@ -80,7 +84,7 @@ module CKEditor5::Rails
         preset: mapped_preset
       }
 
-      build_assets_html_tags(bundle, importmap: importmap, lazy: lazy)
+      build_assets_html_tags(bundle, mapped_preset, importmap: importmap, lazy: lazy)
     end
 
     # Helper for dynamically loading CKEditor assets when working with Turbo/Stimulus.
@@ -97,18 +101,22 @@ module CKEditor5::Rails
     def ckeditor5_lazy_javascript_tags
       ensure_importmap_not_rendered!
 
+      tags = [
+        Assets::WebComponentBundle.instance.to_html(nonce: content_security_policy_nonce),
+        ckeditor5_inline_plugins_tags
+      ]
+
       if importmap_available?
         @__ckeditor_context = {
           bundle: combined_bundle
         }
-
-        return Assets::WebComponentBundle.instance.to_html
+      else
+        tags.prepend(
+          Assets::AssetsImportMap.new(combined_bundle).to_html(nonce: content_security_policy_nonce)
+        )
       end
 
-      safe_join([
-                  Assets::AssetsImportMap.new(combined_bundle).to_html,
-                  Assets::WebComponentBundle.instance.to_html
-                ])
+      safe_join(tags)
     end
 
     # Dynamically generates helper methods for each third-party CDN provider.
@@ -131,6 +139,10 @@ module CKEditor5::Rails
 
     private
 
+    # Combines all preset bundles into a single bundle for lazy loading.
+    # This is useful when dynamically loading editors with unknown preset configurations.
+    #
+    # @return [AssetsBundle] Combined bundle containing all preset assets
     def combined_bundle
       acc = Assets::AssetsBundle.new(scripts: [], stylesheets: [])
 
@@ -141,6 +153,14 @@ module CKEditor5::Rails
       acc
     end
 
+    # Merges user-provided configuration with the editor preset.
+    # Sets default language if not specified and validates required parameters.
+    #
+    # @param preset [Symbol, PresetBuilder] Base preset to merge with
+    # @param language [Symbol, nil] UI language code
+    # @param kwargs [Hash] Additional configuration options
+    # @return [PresetBuilder] New preset instance with merged configuration
+    # @raise [ArgumentError] If required parameters are missing
     def merge_with_editor_preset(preset, language: nil, **kwargs)
       found_preset = Engine.find_preset!(preset)
       new_preset = found_preset.clone.merge_with_hash!(**kwargs)
@@ -152,21 +172,21 @@ module CKEditor5::Rails
         new_preset.language(I18n.locale)
       end
 
-      %i[version type].each do |key|
-        next if new_preset.public_send(key).present?
-
-        raise ArgumentError,
-              "Poor thing. You forgot to define #{key}. Make sure you passed `#{key}:` parameter to " \
-              "`ckeditor5_assets` or defined default one in your `#{preset}` preset!"
-      end
+      validate_required_preset_params!(new_preset, preset)
 
       new_preset
     end
 
+    # Checks if importmap support is available in the current context.
+    #
+    # @return [Boolean] true if importmap is supported
     def importmap_available?
       respond_to?(:importmap_rendered?)
     end
 
+    # Ensures that importmap hasn't been rendered yet to prevent conflicts.
+    #
+    # @raise [ImportmapAlreadyRenderedError] If importmap was already rendered
     def ensure_importmap_not_rendered!
       return unless importmap_available? && importmap_rendered?
 
@@ -175,14 +195,24 @@ module CKEditor5::Rails
             'Please move ckeditor5_assets helper before javascript_importmap_tags in your layout.'
     end
 
-    def build_assets_html_tags(bundle, importmap:, lazy: nil)
+    # Builds HTML tags for CKEditor assets with proper configuration.
+    #
+    # @param bundle [AssetsBundle] Bundle containing assets to include
+    # @param preset [PresetBuilder] Preset configuration
+    # @param importmap [Boolean] Whether to use importmap for dependencies
+    # @param lazy [Boolean] Whether to enable lazy loading
+    # @return [String, nil] HTML tags string or nil if using importmap
+    def build_assets_html_tags(bundle, preset, importmap:, lazy: nil)
       serializer = Assets::AssetsBundleHtmlSerializer.new(
         bundle,
         importmap: importmap && !importmap_available?,
         lazy: lazy
       )
 
-      html = serializer.to_html
+      html = safe_join([
+                         serializer.to_html(nonce: content_security_policy_nonce),
+                         ckeditor5_inline_plugins_tags(preset)
+                       ])
 
       if importmap_available?
         @__ckeditor_context[:html_tags] = html
@@ -191,5 +221,20 @@ module CKEditor5::Rails
         html
       end
     end
+
+    # Validates that required parameters are present in the preset configuration.
+    #
+    # @param preset [PresetBuilder] Preset to validate
+    # @param preset_name [Symbol] Name of the preset for error messages
+    # @raise [ArgumentError] If version or type is missing
+    def validate_required_preset_params!(preset, preset_name)
+      %i[version type].each do |key|
+        next if preset.public_send(key).present?
+
+        raise ArgumentError,
+              "Poor thing. You forgot to define #{key}. Make sure you passed `#{key}:` parameter to " \
+              "`ckeditor5_assets` or defined default one in your `#{preset_name}` preset!"
+      end
+    end
   end
 end

data/lib/ckeditor5/rails/context/helpers.rb

@@ -1,10 +1,14 @@
 # frozen_string_literal: true
 
+require_relative '../cdn/concerns/inline_plugins_tags_builder'
+
 require_relative 'preset_builder'
 require_relative 'preset_serializer'
 
 module CKEditor5::Rails::Context
   module Helpers
+    include CKEditor5::Rails::Cdn::Concerns::InlinePluginsTagsBuilder
+
     # Creates a CKEditor context component that can be shared between multiple editors.
     # This allows you to define common plugins that will be available to all editors
     # within the context.
@@ -25,7 +29,11 @@ module CKEditor5::Rails::Context
       preset ||= PresetBuilder.new
       context_props = PresetSerializer.new(preset)
 
-      tag.public_send(:'ckeditor-context-component', **context_props.to_attributes, &block)
+      tags = []
+      tags << ckeditor5_inline_plugins_tags(preset)
+      tags << tag.public_send(:'ckeditor-context-component', **context_props.to_attributes, &block)
+
+      safe_join(tags)
     end
 
     # Creates a new preset builder object for use with ckeditor5_context.

data/lib/ckeditor5/rails/editor/helpers/editor_helpers.rb

@@ -132,12 +132,24 @@ module CKEditor5::Rails
 
     private
 
+    # Validates that initial_data and block are not provided simultaneously
+    #
+    # @param initial_data [String] Initial content for the editor
+    # @param block [Proc] Block containing nested components
+    # @raise [ArgumentError] If both initial_data and block are provided
     def validate_editor_input!(initial_data, block)
       return unless initial_data && block
 
       raise ArgumentError, 'Cannot pass initial data and block at the same time.'
     end
 
+    # Builds the complete editor configuration by merging preset, custom and extra configs
+    #
+    # @param preset [PresetBuilder] The preset configuration object
+    # @param config [Hash] Custom configuration that overrides preset config
+    # @param extra_config [Hash] Additional configuration to merge
+    # @param initial_data [String] Initial content for the editor
+    # @return [Hash] The merged configuration hash
     def build_editor_config(preset, config, extra_config, initial_data)
       editor_config = config || preset.config
       editor_config = editor_config.deep_merge(extra_config)
@@ -151,6 +163,10 @@ module CKEditor5::Rails
       editor_config
     end
 
+    # Retrieves or creates a context for the editor initialization
+    #
+    # @param preset [Symbol, PresetBuilder] The preset name or object
+    # @return [Hash] Context hash containing bundle and preset information
     def ckeditor5_context_or_fallback(preset)
       return @__ckeditor_context if @__ckeditor_context.present?
 

data/lib/ckeditor5/rails/editor/props_inline_plugin.rb

@@ -15,9 +15,8 @@ module CKEditor5::Rails::Editor
 
     def to_h
       {
-        type: :inline,
-        name: name,
-        code: code
+        type: :external,
+        window_name: name
       }
     end
 
@@ -25,11 +24,30 @@ module CKEditor5::Rails::Editor
 
     def validate_code!
       raise ArgumentError, 'Code must be a String' unless code.is_a?(String)
+    end
+  end
+
+  class InlinePluginWindowInitializer
+    include ActionView::Helpers::TagHelper
+
+    def initialize(plugin)
+      @plugin = plugin
+    end
 
-      return if code.include?('export default')
+    def to_html(nonce: nil)
+      code = wrap_with_handlers(@plugin.code)
+
+      tag.script(code.html_safe, nonce: nonce)
+    end
+
+    private
 
-      raise ArgumentError,
-            'Code must include `export default` that exports plugin definition!'
+    def wrap_with_handlers(code)
+      <<~JS
+        window.addEventListener('ckeditor:request-cjs-plugin:#{@plugin.name}', () => {
+          window['#{@plugin.name}'] = #{code.html_safe};
+        });
+      JS
     end
   end
 end

data/lib/ckeditor5/rails/hooks/importmap.rb

@@ -47,6 +47,7 @@ module CKEditor5::Rails::Hooks
       def merge_import_maps_json(a_json, b_json)
         a = JSON.parse(a_json)
         b = JSON.parse(b_json)
+
         a['imports'].merge!(b['imports'])
         a.to_json
       rescue JSON::ParserError => e

data/lib/ckeditor5/rails/plugins/simple_upload_adapter.rb

@@ -5,7 +5,7 @@ module CKEditor5::Rails::Plugins
     PLUGIN_CODE = <<~JS
       import { Plugin, FileRepository } from 'ckeditor5';
 
-      export default class SimpleUploadAdapter extends Plugin {
+      return class SimpleUploadAdapter extends Plugin {
         static get requires() {
           return [FileRepository];
         }

data/lib/ckeditor5/rails/presets/concerns/plugin_methods.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'active_support'
+require 'terser'
 
 module CKEditor5::Rails
   module Presets
@@ -8,7 +9,9 @@ module CKEditor5::Rails
       module PluginMethods
         extend ActiveSupport::Concern
 
-        class DisallowedInlinePlugin < ArgumentError; end
+        class DisallowedInlinePluginError < ArgumentError; end
+        class MissingInlinePluginError < StandardError; end
+        class UnsupportedESModuleError < StandardError; end
 
         included do
           attr_reader :disallow_inline_plugins
@@ -34,9 +37,9 @@ module CKEditor5::Rails
         # @param code [String] JavaScript code defining the plugin
         # @example Define custom highlight plugin
         #   inline_plugin :MyCustomPlugin, <<~JS
-        #     import { Plugin } from 'ckeditor5';
+        #     const { Plugin } = await import( 'ckeditor5' );
         #
-        #     export default class MyCustomPlugin extends Plugin {
+        #     return class MyCustomPlugin extends Plugin {
         #       static get pluginName() {
         #         return 'MyCustomPlugin';
         #       }
@@ -47,7 +50,21 @@ module CKEditor5::Rails
         #     }
         #   JS
         def inline_plugin(name, code)
-          register_plugin(Editor::PropsInlinePlugin.new(name, code))
+          if code.match?(/export default/)
+            raise UnsupportedESModuleError,
+                  'Inline plugins must not use ES module syntax!' \
+                  'Use async async imports instead!'
+          end
+
+          unless code.match?(/return class(\s+\w+)?\s+extends\s+Plugin/)
+            raise MissingInlinePluginError,
+                  'Plugin code must return a class that extends Plugin!'
+          end
+
+          wrapped_code = "(async () => { #{code} })();"
+          minified_code = Terser.new(compress: false, mangle: true).compile(wrapped_code)
+
+          register_plugin(Editor::PropsInlinePlugin.new(name, minified_code))
         end
 
         # Register a single plugin by name
@@ -89,8 +106,11 @@ module CKEditor5::Rails
 
         private
 
+        # Check if the plugin looks like an inline plugin
+        # @param plugin [Editor::PropsBasePlugin] Plugin instance
+        # @return [Boolean] True if the plugin is an inline plugin
         def looks_like_inline_plugin?(plugin)
-          plugin.to_h[:type] == :inline
+          plugin.respond_to?(:code) && plugin.code.present?
         end
 
         # Register a plugin in the editor configuration.
@@ -103,9 +123,10 @@ module CKEditor5::Rails
         # @return [Editor::PropsBasePlugin] The registered plugin
         def register_plugin(plugin_obj)
           if disallow_inline_plugins && looks_like_inline_plugin?(plugin_obj)
-            raise DisallowedInlinePlugin, 'Inline plugins are not allowed here.'
+            raise DisallowedInlinePluginError, 'Inline plugins are not allowed here.'
           end
 
+          config[:plugins] ||= []
           config[:plugins] << plugin_obj
           plugin_obj
         end

data/lib/ckeditor5/rails/version.rb

@@ -2,7 +2,7 @@
 
 module CKEditor5
   module Rails
-    VERSION = '1.23.4'
+    VERSION = '1.24.0'
 
     DEFAULT_CKEDITOR_VERSION = '44.1.0'
   end

data/spec/e2e/features/context_spec.rb

@@ -11,7 +11,7 @@ RSpec.describe 'CKEditor5 Context Integration', type: :feature, js: true do
 
   it 'initializes the magic context plugin' do
     eventually do
-      plugin_exists = page.evaluate_script('window.MagicContextPlugin !== undefined')
+      plugin_exists = page.evaluate_script('window.__magicPluginInitialized !== undefined')
       expect(plugin_exists).to be true
     end
   end

data/spec/e2e/features/editor_types_spec.rb

@@ -87,6 +87,15 @@ RSpec.describe 'CKEditor5 Types Integration', type: :feature, js: true do
   describe 'Classic Editor' do
     it_behaves_like 'an editor', 'classic'
     it_behaves_like 'an editor that fires change event with main payload', 'classic'
+
+    it 'initializes the inline plugin' do
+      visit 'classic'
+
+      eventually do
+        plugin_exists = page.evaluate_script('window.__customPlugin !== undefined')
+        expect(plugin_exists).to be true
+      end
+    end
   end
 
   describe 'Decoupled Editor' do

data/spec/e2e/features/lazy_assets_spec.rb

@@ -38,6 +38,13 @@ RSpec.describe 'Lazy Assets', type: :feature do
       expect(editor).to have_text('Test content')
     end
 
+    it 'initializes the inline plugin' do
+      eventually do
+        plugin_exists = page.evaluate_script('window.__customPlugin !== undefined')
+        expect(plugin_exists).to be true
+      end
+    end
+
     it 'supports multiple editor instances' do
       visit 'classic_lazy_assets?multiple=true'
 

data/spec/lib/ckeditor5/rails/assets/assets_bundle_hml_serializer_spec.rb

@@ -32,7 +32,7 @@ RSpec.describe CKEditor5::Rails::Assets::AssetsBundleHtmlSerializer do
   end
 
   describe '#to_html' do
-    subject(:html) { serializer.to_html }
+    subject(:html) { serializer.to_html(nonce: 'true') }
 
     it 'includes window script tags' do
       expect(html).to have_tag('script', with: {
@@ -240,7 +240,7 @@ RSpec.describe CKEditor5::Rails::Assets::AssetsImportMap do
 
   describe '#to_html' do
     it 'generates script tag with import map' do
-      html = import_map.to_html
+      html = import_map.to_html(nonce: 'true')
       expect(html).to have_tag('script', with: { type: 'importmap', nonce: 'true' }) do
         with_text('{"imports":{"@ckeditor/module":"https://cdn.com/script2.js"}}')
       end

data/spec/lib/ckeditor5/rails/cdn/helpers_spec.rb

@@ -10,6 +10,10 @@ RSpec.describe CKEditor5::Rails::Cdn::Helpers do
       def importmap_rendered?
         false
       end
+
+      def content_security_policy_nonce
+        'test-nonce'
+      end
     end
   end
 
@@ -29,7 +33,7 @@ RSpec.describe CKEditor5::Rails::Cdn::Helpers do
     helper.instance_variable_get(:@__ckeditor_context)
   end
 
-  let(:bundle_html) { '<script src="test.js"></script>' }
+  let(:bundle_html) { '<script src="test.js"></script>'.html_safe }
   let(:serializer) do
     instance_double(CKEditor5::Rails::Assets::AssetsBundleHtmlSerializer, to_html: bundle_html)
   end
@@ -303,6 +307,14 @@ RSpec.describe CKEditor5::Rails::Cdn::Helpers do
                                                      .and_return(CKEditor5::Rails::Assets::AssetsBundle.new(
                                                                    scripts: ['test2.js']
                                                                  ))
+
+      allow(test_preset1).to receive(:plugins).and_return(
+        instance_double('PluginsBuilder', items: [])
+      )
+
+      allow(test_preset2).to receive(:plugins).and_return(
+        instance_double('PluginsBuilder', items: [])
+      )
     end
 
     context 'when importmap is available' do
@@ -312,8 +324,7 @@ RSpec.describe CKEditor5::Rails::Cdn::Helpers do
       end
 
       it 'stores bundle in context and returns web component script' do
-        result = helper.ckeditor5_lazy_javascript_tags
-
+        result = helper.ckeditor5_lazy_javascript_tags.html_safe
         expect(result).to have_tag('script', with: {
                                      type: 'module',
                                      src: 'web-component.js'
@@ -348,6 +359,100 @@ RSpec.describe CKEditor5::Rails::Cdn::Helpers do
     end
   end
 
+  describe '#ckeditor5_inline_plugins_tags' do
+    let(:preset) do
+      CKEditor5::Rails::Presets::PresetBuilder.new do
+        inline_plugin 'Plugin1', <<~JAVASCRIPT
+          const { Plugin } = await import( 'ckeditor5' );
+
+          return class Plugin1 extends Plugin {
+            init() {
+              window.Plugin1 = true;
+            }
+          }
+        JAVASCRIPT
+
+        inline_plugin 'Plugin2', <<~JAVASCRIPT
+          const { Plugin } = await import( 'ckeditor5' );
+
+          return class Plugin2 extends Plugin {
+            init() {
+              window.Plugin2 = true;
+            }
+          }
+        JAVASCRIPT
+      end
+    end
+
+    let(:another_preset) do
+      CKEditor5::Rails::Presets::PresetBuilder.new do
+        inline_plugin 'Plugin3', <<~JAVASCRIPT
+          const { Plugin } = await import( 'ckeditor5' );
+
+          return class Plugin3 extends Plugin {
+            init() {
+              window.Plugin3 = true;
+            }
+          }
+        JAVASCRIPT
+      end
+    end
+
+    before do
+      allow(CKEditor5::Rails::Engine).to receive(:presets).and_return(
+        double('PresetManager', to_h: { default: preset, another: another_preset })
+      )
+    end
+
+    it 'generates script tags for inline plugins from given preset' do
+      result = helper.ckeditor5_inline_plugins_tags(preset)
+
+      expect(result).to have_tag('script', count: 2)
+      expect(result).to include('window.Plugin1=true')
+      expect(result).to include('window.Plugin2=true')
+      expect(result).not_to include('window.Plugin3=true')
+    end
+
+    it 'generates script tags for inline plugins from all presets when no preset given' do
+      result = helper.ckeditor5_inline_plugins_tags
+
+      expect(result).to have_tag('script', count: 3)
+      expect(result).to include('window.Plugin1=true')
+      expect(result).to include('window.Plugin2=true')
+      expect(result).to include('window.Plugin3=true')
+    end
+
+    it 'adds nonce to script tags when available' do
+      result = helper.ckeditor5_inline_plugins_tags(preset)
+      expect(result).to have_tag('script', with: { nonce: 'test-nonce' })
+    end
+
+    context 'with preset having no inline plugins' do
+      let(:empty_preset) do
+        CKEditor5::Rails::Presets::PresetBuilder.new do
+          plugins :Bold, :Italic # Regular plugins, not inline
+        end
+      end
+
+      it 'returns empty safe buffer when no inline plugins are present' do
+        result = helper.ckeditor5_inline_plugins_tags(empty_preset)
+        expect(result).to be_html_safe
+        expect(result).to be_empty
+      end
+    end
+
+    context 'with nil preset' do
+      it 'includes plugins from all registered presets' do
+        result = helper.ckeditor5_inline_plugins_tags(nil)
+
+        expect(result).to have_tag('script', count: 3)
+        expect(result).to include('window.Plugin1=true')
+        expect(result).to include('window.Plugin2=true')
+        expect(result).to include('window.Plugin3=true')
+      end
+    end
+  end
+
   describe 'cdn helper methods' do
     it 'generates helper methods for third-party CDNs' do
       expect(helper).to respond_to(:ckeditor5_unpkg_assets)

data/spec/lib/ckeditor5/rails/context/helpers_spec.rb

@@ -8,6 +8,10 @@ RSpec.describe CKEditor5::Rails::Context::Helpers do
     Class.new do
       include ActionView::Helpers::TagHelper
       include CKEditor5::Rails::Context::Helpers
+
+      def content_security_policy_nonce
+        'test-nonce'
+      end
     end
   end
 
@@ -35,6 +39,14 @@ RSpec.describe CKEditor5::Rails::Context::Helpers do
       end
     end
 
+    it 'returns empty component when preset is nil' do
+      result = helper.ckeditor5_context(nil)
+
+      expect(result).to be_html_safe
+      expect(result).to have_tag('ckeditor-context-component', count: 1)
+      expect(result).not_to have_tag('script')
+    end
+
     it 'is optional to pass a preset' do
       expect(helper.ckeditor5_context).to have_tag(
         'ckeditor-context-component',
@@ -87,6 +99,26 @@ RSpec.describe CKEditor5::Rails::Context::Helpers do
       )
     end
 
+    it 'includes inline plugins script tags when preset has inline plugins' do
+      preset = CKEditor5::Rails::Context::PresetBuilder.new do
+        inline_plugin :CustomPlugin, <<~JS
+          const { Plugin } = await import('ckeditor5');
+
+          return class CustomPlugin extends Plugin {
+            static get pluginName() { return 'CustomPlugin'; }
+          }
+        JS
+      end
+
+      result = helper.ckeditor5_context(preset)
+
+      expect(result).to have_tag('script', with: { nonce: 'test-nonce' }) do
+        with_text(/CustomPlugin/)
+      end
+
+      expect(result).to have_tag('ckeditor-context-component')
+    end
+
     it 'accepts block content' do
       result = helper.ckeditor5_context(empty_preset) { 'Content' }
 

data/spec/lib/ckeditor5/rails/context/preset_builder_spec.rb

@@ -84,17 +84,27 @@ RSpec.describe CKEditor5::Rails::Context::PresetBuilder do
   end
 
   describe '#inline_plugin' do
+    let(:plugin_code) do
+      <<~JAVASCRIPT
+        const { Plugin } = await import( 'ckeditor5' );
+
+        return class Abc extends Plugin {}
+      JAVASCRIPT
+    end
+
     it 'adds inline plugin to config' do
-      plugin = builder.inline_plugin('Test', 'export default class Abc {}')
+      plugin = builder.inline_plugin('Test', plugin_code)
 
       expect(builder.config[:plugins]).to include(plugin)
       expect(plugin).to be_a(CKEditor5::Rails::Editor::PropsInlinePlugin)
     end
 
     it 'accepts plugin options' do
-      plugin = builder.inline_plugin('Test', 'export default class Abc {}')
+      plugin = builder.inline_plugin('Test', plugin_code)
 
-      expect(plugin.code).to eq('export default class Abc {}')
+      expect(plugin.code).to eq(
+        '(async()=>{const{Plugin:t}=await import("ckeditor5");return class n extends t{}})();'
+      )
     end
   end
 

data/spec/lib/ckeditor5/rails/context/preset_serializer_spec.rb

@@ -6,7 +6,11 @@ RSpec.describe CKEditor5::Rails::Context::PresetSerializer do
   let(:preset) do
     CKEditor5::Rails::Context::PresetBuilder.new do
       plugin 'Plugin1', import_name: '@ckeditor/plugin1'
-      inline_plugin 'plugin2', 'export default class Plugin2 {}'
+      inline_plugin 'plugin2', <<~JAVASCRIPT
+        const { Plugin } = await import( 'ckeditor5' );
+
+        return class Abc extends Plugin {}
+      JAVASCRIPT
 
       configure :toolbar, { items: %w[bold italic] }
       configure :language, 'en'
@@ -39,15 +43,15 @@ RSpec.describe CKEditor5::Rails::Context::PresetSerializer do
 
       it 'normalizes and includes all plugins' do
         plugins = JSON.parse(plugins_json)
+
         expect(plugins.size).to eq(2)
         expect(plugins.first).to include(
           'type' => 'external',
           'import_name' => '@ckeditor/plugin1'
         )
         expect(plugins.last).to include(
-          'type' => 'inline',
-          'name' => 'plugin2',
-          'code' => 'export default class Plugin2 {}'
+          'type' => 'external',
+          'window_name' => 'plugin2'
         )
       end
     end

data/spec/lib/ckeditor5/rails/editor/helpers/config_helpers_spec.rb

@@ -43,14 +43,15 @@ RSpec.describe CKEditor5::Rails::Editor::Helpers::Config do
         expect do
           helper.ckeditor5_preset do
             inline_plugin :CustomPlugin, <<~JS
-              import Plugin from '@ckeditor/ckeditor5-core/src/plugin';
-              export default class CustomPlugin extends Plugin {
+              const { Plugin } = await import( 'ckeditor5' );
+
+              return class CustomPlugin extends Plugin {
                 static get pluginName() { return 'CustomPlugin'; }
               }
             JS
           end
         end.to raise_error(
-          CKEditor5::Rails::Presets::Concerns::PluginMethods::DisallowedInlinePlugin,
+          CKEditor5::Rails::Presets::Concerns::PluginMethods::DisallowedInlinePluginError,
           'Inline plugins are not allowed here.'
         )
       end

data/spec/lib/ckeditor5/rails/editor/props_base_plugin_spec.rb

@@ -23,7 +23,7 @@ RSpec.describe CKEditor5::Rails::Editor::PropsBasePlugin do
     end
 
     it 'returns inline plugin instances unchanged' do
-      inline = CKEditor5::Rails::Editor::PropsInlinePlugin.new(:Custom, 'export default class {}')
+      inline = CKEditor5::Rails::Editor::PropsInlinePlugin.new(:Custom, 'return class {}')
       plugin = described_class.normalize(inline)
       expect(plugin).to be(inline)
     end

data/spec/lib/ckeditor5/rails/editor/props_inline_plugin_spec.rb

@@ -5,8 +5,9 @@ require 'spec_helper'
 RSpec.describe CKEditor5::Rails::Editor::PropsInlinePlugin do
   let(:valid_code) do
     <<~JAVASCRIPT
-      import Plugin from '@ckeditor/ckeditor5-core/src/plugin';
-      export default class CustomPlugin extends Plugin {
+      const { Plugin } = await import( 'ckeditor5' );
+
+      return class CustomPlugin extends Plugin {
         init() {
           console.log('Custom plugin initialized');
         }
@@ -23,20 +24,14 @@ RSpec.describe CKEditor5::Rails::Editor::PropsInlinePlugin do
       expect { described_class.new(:CustomPlugin, nil) }
         .to raise_error(ArgumentError, 'Code must be a String')
     end
-
-    it 'raises error when code lacks export default' do
-      expect { described_class.new(:CustomPlugin, 'class CustomPlugin {}') }
-        .to raise_error(ArgumentError, /must include `export default`/)
-    end
   end
 
   describe '#to_h' do
     it 'returns correct hash representation' do
       plugin = described_class.new(:CustomPlugin, valid_code)
       expect(plugin.to_h).to eq({
-                                  type: :inline,
-                                  name: :CustomPlugin,
-                                  code: valid_code
+                                  type: :external,
+                                  window_name: :CustomPlugin
                                 })
     end
   end

data/spec/lib/ckeditor5/rails/hooks/form_spec.rb

@@ -7,7 +7,11 @@ RSpec.describe CKEditor5::Rails::Hooks::Form do
     let(:post) { Post.new(content: 'Initial content') }
     let(:builder) { described_class.new(:post, post, template) }
     let(:template) do
-      ActionView::Base.new(ActionView::LookupContext.new([]), {}, nil)
+      Class.new(ActionView::Base) do
+        def content_security_policy_nonce
+          'test-nonce'
+        end
+      end.new(ActionView::LookupContext.new([]), {}, nil)
     end
 
     before do

data/spec/lib/ckeditor5/rails/presets/preset_builder_spec.rb

@@ -243,8 +243,9 @@ RSpec.describe CKEditor5::Rails::Presets::PresetBuilder do
   describe '#inline_plugin' do
     let(:plugin_code) do
       <<~JAVASCRIPT
-        import Plugin from 'ckeditor5/src/plugin';
-        export default class CustomPlugin extends Plugin {
+        const { Plugin } = await import( 'ckeditor5' );
+
+        return class CustomPlugin extends Plugin {
           init() {
             // plugin initialization
           }
@@ -258,7 +259,9 @@ RSpec.describe CKEditor5::Rails::Presets::PresetBuilder do
       plugin = builder.config[:plugins].first
       expect(plugin).to be_a(CKEditor5::Rails::Editor::PropsInlinePlugin)
       expect(plugin.name).to eq(:CustomPlugin)
-      expect(plugin.code).to eq(plugin_code)
+      expect(plugin.code).to eq(
+        '(async()=>{const{Plugin:t}=await import("ckeditor5");return class i extends t{init(){}}})();'
+      )
     end
 
     it 'allows multiple inline plugins' do
@@ -268,6 +271,18 @@ RSpec.describe CKEditor5::Rails::Presets::PresetBuilder do
       plugin_names = builder.config[:plugins].map(&:name)
       expect(plugin_names).to eq(%i[Plugin1 Plugin2])
     end
+
+    it 'should raise UnsupportedESModuleError when ES module is passed' do
+      expect do
+        builder.inline_plugin(:CustomPlugin, 'export default class CustomPlugin {}')
+      end.to raise_error(CKEditor5::Rails::Presets::Concerns::PluginMethods::UnsupportedESModuleError)
+    end
+
+    it 'should raise MissingInlinePluginError when plugin code is invalid' do
+      expect do
+        builder.inline_plugin(:CustomPlugin, 'return class CustomPlugin {}')
+      end.to raise_error(CKEditor5::Rails::Presets::Concerns::PluginMethods::MissingInlinePluginError)
+    end
   end
 
   describe '#plugin' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ckeditor5
 version: !ruby/object:Gem::Version
-  version: 1.23.4
+  version: 1.24.0
 platform: ruby
 authors:
 - Mateusz Bagiński
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-12-19 00:00:00.000000000 Z
+date: 2024-12-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -68,6 +68,7 @@ files:
 - lib/ckeditor5/rails/cdn/ckbox_bundle.rb
 - lib/ckeditor5/rails/cdn/ckeditor_bundle.rb
 - lib/ckeditor5/rails/cdn/concerns/bundle_builder.rb
+- lib/ckeditor5/rails/cdn/concerns/inline_plugins_tags_builder.rb
 - lib/ckeditor5/rails/cdn/helpers.rb
 - lib/ckeditor5/rails/cdn/url_generator.rb
 - lib/ckeditor5/rails/context/helpers.rb