collavre_linear 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f91e7ebe8a6419a4b13d66c1d3cd919520bbef1c617981747f0008fafef63377
-  data.tar.gz: a960ab7bd872ba996974b5f02c4741e4d6285f5f699be6258fc1979ccf42dd38
+  metadata.gz: d8004796cae3abe1389345fbd85959f2390e8d8930768c86045ba202ca94c5e1
+  data.tar.gz: 0e6f414178db0ee5513f238cac0fabf75a44b4eea80a1f7142ce94487bbff798
 SHA512:
-  metadata.gz: b30d822da909ec236b3af65b015b846550c9128c1989169a1014cbfecf5d8a595c833732b26d4a9eaa7175da3042e05672a4ea0dca81ac92ad1524d9ec64c7f4
-  data.tar.gz: 4e6e4b2cf5ad7dbd39cffb15bbebc959f80ae8db047c019fd013f8625a2bd4f4fcb24ec57f1817f515432beaf740304697ea16ddf63e3d82c7d2236e577fe9e9
+  metadata.gz: 258031f64f076de07891357445af346b6bc10c75d43fb802d2a749eb1c7069bc4d81ca64a66366b0875b2f971c8bd986c223fb133ca47dcbc0ed9c86d936cf37
+  data.tar.gz: 07b41024a06d0d5074a43685a2dfbab697f92990fb6100849fcf893c38159665c553254bdaca8f40f5ea209b632dc6b880d583a133047a80a47cb0e89d2c25c0

data/app/javascript/__tests__/linear_modal_reopen.test.js

@@ -0,0 +1,178 @@
+import {
+  LINEAR_REOPEN_KEY,
+  markReopenAfterConnect,
+  consumeReopenAfterConnect,
+  safeSessionStorage,
+} from '../linear_modal_reopen.js';
+
+// Minimal in-memory Storage stand-in (jsdom's is fine too, but this keeps the
+// unit test free of environment setup and lets us model a throwing storage).
+function fakeStorage() {
+  const map = new Map();
+  return {
+    setItem: (k, v) => map.set(k, String(v)),
+    getItem: (k) => (map.has(k) ? map.get(k) : null),
+    removeItem: (k) => map.delete(k),
+    _size: () => map.size,
+  };
+}
+
+describe('safeSessionStorage', () => {
+  test('returns the storage object when Web Storage is available', () => {
+    // jsdom provides a working window.sessionStorage.
+    expect(safeSessionStorage()).toBe(window.sessionStorage);
+  });
+
+  test('returns null when the window.sessionStorage getter itself throws', () => {
+    // Web Storage disabled by policy (packaged WKWebView, storage-blocked
+    // browser) throws on the property *access*, before any value is passed to
+    // mark/consume. safeSessionStorage must absorb it so callers never throw.
+    const original = Object.getOwnPropertyDescriptor(window, 'sessionStorage');
+    Object.defineProperty(window, 'sessionStorage', {
+      configurable: true,
+      get() { throw new Error('SecurityError: storage disabled'); },
+    });
+    try {
+      expect(() => safeSessionStorage()).not.toThrow();
+      expect(safeSessionStorage()).toBeNull();
+    } finally {
+      if (original) Object.defineProperty(window, 'sessionStorage', original);
+    }
+  });
+});
+
+describe('markReopenAfterConnect', () => {
+  test('persists the unscoped sentinel when no creative id is given', () => {
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage);
+    expect(storage.getItem(LINEAR_REOPEN_KEY)).toBe('*');
+  });
+
+  test('the unscoped sentinel cannot equal any serialized creative id', () => {
+    // Creative ids are positive integers → digit strings. The sentinel must be a
+    // non-digit so a real id never gets misread as "unscoped".
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage);
+    expect(storage.getItem(LINEAR_REOPEN_KEY)).not.toMatch(/^\d+$/);
+  });
+
+  test('persists the creative id when given (scoped reopen)', () => {
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage, 42);
+    expect(storage.getItem(LINEAR_REOPEN_KEY)).toBe('42');
+  });
+
+  test('falls back to the unscoped sentinel for an empty creative id', () => {
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage, '');
+    expect(storage.getItem(LINEAR_REOPEN_KEY)).toBe('*');
+  });
+
+  test('tolerates a null storage without throwing', () => {
+    expect(() => markReopenAfterConnect(null)).not.toThrow();
+  });
+
+  test('swallows storage errors (private mode / WKWebView)', () => {
+    const throwing = { setItem: () => { throw new Error('QuotaExceeded'); } };
+    expect(() => markReopenAfterConnect(throwing)).not.toThrow();
+  });
+});
+
+describe('consumeReopenAfterConnect', () => {
+  test('returns true exactly once, then clears the flag (regression)', () => {
+    // Without the one-shot clear, every subsequent reload — including the one
+    // after a successful link — would reopen the modal. It must fire once.
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage);
+
+    expect(consumeReopenAfterConnect(storage)).toBe(true);
+    expect(consumeReopenAfterConnect(storage)).toBe(false);
+    expect(storage.getItem(LINEAR_REOPEN_KEY)).toBeNull();
+  });
+
+  test('reopens only when the current creative matches the stored one', () => {
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage, 42); // popup connected creative 42
+    // Opener is on the same creative → reopen.
+    expect(consumeReopenAfterConnect(storage, 42)).toBe(true);
+  });
+
+  test('does NOT reopen when the opener navigated to a different creative', () => {
+    // Codex P2: mid-flow navigation must not surface the wrong creative's modal.
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage, 42); // popup connected creative 42
+    // Opener moved to creative 99 before the reload → no reopen, flag cleared.
+    expect(consumeReopenAfterConnect(storage, 99)).toBe(false);
+    expect(storage.getItem(LINEAR_REOPEN_KEY)).toBeNull();
+  });
+
+  test('creative id 1 stays scoped and does NOT reopen a different creative', () => {
+    // Regression: the sentinel used to be '1', colliding with creative id 1 — so
+    // OAuth from creative 1 was misread as unscoped and reopened whatever modal
+    // the opener had navigated to. It must behave like any other scoped id.
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage, 1);           // popup connected creative 1
+    expect(consumeReopenAfterConnect(storage, 99)).toBe(false); // opener moved away
+  });
+
+  test('creative id 1 reopens when the opener is still on creative 1', () => {
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage, 1);
+    expect(consumeReopenAfterConnect(storage, 1)).toBe(true);
+  });
+
+  test('clears a mismatched intent so it never fires on a later matching visit', () => {
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage, 42);
+    consumeReopenAfterConnect(storage, 99); // mismatch on the reload
+    // Later navigation back to creative 42 must NOT auto-open — intent was spent.
+    expect(consumeReopenAfterConnect(storage, 42)).toBe(false);
+  });
+
+  test('matches across id string/number coercion', () => {
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage, 42);        // stored as '42'
+    expect(consumeReopenAfterConnect(storage, '42')).toBe(true); // dataset is a string
+  });
+
+  test('unscoped sentinel reopens regardless of current creative (legacy)', () => {
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage);            // no id → '1'
+    expect(consumeReopenAfterConnect(storage, 7)).toBe(true);
+  });
+
+  test('returns false when no reopen was pending', () => {
+    expect(consumeReopenAfterConnect(fakeStorage())).toBe(false);
+  });
+
+  test('tolerates a null storage', () => {
+    expect(consumeReopenAfterConnect(null)).toBe(false);
+  });
+
+  test('swallows storage errors and reports no pending reopen', () => {
+    const throwing = { getItem: () => { throw new Error('SecurityError'); } };
+    expect(consumeReopenAfterConnect(throwing)).toBe(false);
+  });
+
+  test('end-to-end via safeSessionStorage: mark on connect, consume once', () => {
+    // The call sites pass safeSessionStorage() rather than window.sessionStorage
+    // directly, so the whole flow must survive a storage-backed session.
+    const s = safeSessionStorage();
+    if (!s) return; // jsdom always provides it; guard just in case
+    s.removeItem(LINEAR_REOPEN_KEY);
+    markReopenAfterConnect(s);
+    expect(consumeReopenAfterConnect(s)).toBe(true);
+    expect(consumeReopenAfterConnect(s)).toBe(false);
+  });
+
+  test('end-to-end: mark on connect, consume on the next load', () => {
+    // Mirrors the real flow: the postMessage handler marks, the reload happens,
+    // then turbo:load consumes the flag and opens the modal exactly once.
+    const storage = fakeStorage();
+    markReopenAfterConnect(storage);          // linearConnected received
+    const reopenedFirstLoad = consumeReopenAfterConnect(storage);   // turbo:load
+    const reopenedSecondLoad = consumeReopenAfterConnect(storage);  // later nav
+    expect(reopenedFirstLoad).toBe(true);
+    expect(reopenedSecondLoad).toBe(false);
+  });
+});

data/app/javascript/collavre_linear.js

@@ -15,19 +15,38 @@
 // unconfirmed and errors would vanish. Route through the shared in-app modal
 // like the GitHub/Slack/Notion engines do.
 import { alertDialog, confirmDialog } from 'collavre/lib/utils/dialog';
+import {
+  markReopenAfterConnect,
+  consumeReopenAfterConnect,
+  safeSessionStorage,
+} from './linear_modal_reopen.js';
 
 let linearIntegrationInitialized = false;
 
 if (!linearIntegrationInitialized) {
   linearIntegrationInitialized = true;
 
-  // The OAuth popup posts `linearConnected` to the opener when it closes.
-  // Reload so the modal re-renders in the connected (link-a-project) state.
+  // The OAuth popup posts `linearConnected` to the opener once the account is
+  // connected. Reload so the modal re-renders in the connected (link-a-project)
+  // state, then reopen it (see turbo:load) so the user lands directly on the
+  // project settings step instead of a closed modal.
   // Bound to `window` once — it survives Turbo navigations, unlike the
   // per-navigation element listeners set up in turbo:load below.
   window.addEventListener('message', function (event) {
     if (event.origin !== window.location.origin) return;
     if (event.data && event.data.type === 'linearConnected') {
+      // Close the popup from here. window.close() inside the popup is unreliable
+      // after the cross-origin OAuth round trip and in the desktop WebView, so
+      // the popup's own "Close" button looked dead — closing the window we
+      // opened is the reliable path.
+      try {
+        if (event.source && !event.source.closed) event.source.close();
+      } catch (e) { /* cross-origin or already closed */ }
+      // Survive the reload: reopen the modal on the next load so the flow lands
+      // on the project-link step automatically. Scope it to the creative the
+      // popup was opened for (event.data.creativeId) so a mid-flow navigation to
+      // a different creative doesn't auto-open the wrong creative's link modal.
+      markReopenAfterConnect(safeSessionStorage(), event.data.creativeId);
       window.location.reload();
     }
   });
@@ -191,6 +210,15 @@ if (!linearIntegrationInitialized) {
       showModal();
     });
 
+    // Just returned from the OAuth popup: open the modal straight to the
+    // project-link step instead of leaving the (display:none) modal closed, so
+    // the user doesn't have to reopen the Linear menu by hand. Only reopen when
+    // this page's creative matches the one the popup connected for — otherwise a
+    // mid-flow navigation would surface the wrong creative's link modal.
+    if (consumeReopenAfterConnect(safeSessionStorage(), modal.dataset.creativeId)) {
+      showModal();
+    }
+
     closeBtn?.addEventListener('click', closeModal);
 
     modal.addEventListener('click', function (event) {

data/app/javascript/linear_modal_reopen.js

@@ -0,0 +1,74 @@
+// Reopen-after-connect intent for the Linear integration modal.
+//
+// When the OAuth popup finishes it posts `linearConnected` and the opener does a
+// full `window.location.reload()` so the server re-renders the modal in its
+// project-linking state (the account now exists). But the modal defaults to
+// `display:none` and nothing re-opens it after the reload — so the connect→link
+// step is invisible and the user has to click the Linear connect button again to
+// reach it.
+//
+// This module persists a one-shot "reopen the modal" flag across that reload.
+// Factored out of the side-effectful collavre_linear.js opener so the behavior
+// is unit-testable (that file is imported only for its window/turbo listeners).
+
+export const LINEAR_REOPEN_KEY = 'linearReopenModal';
+
+// Read window.sessionStorage defensively. When Web Storage is disabled by policy
+// (packaged WKWebView, a browser blocking storage for the site) the property
+// getter *itself* throws — before any value reaches mark/consume — so guarding
+// only inside those functions is not enough; the access site must be guarded
+// too. Returns null when unavailable so callers never take an uncaught throw.
+export function safeSessionStorage() {
+  try {
+    return window.sessionStorage;
+  } catch (e) {
+    return null;
+  }
+}
+
+// Unscoped sentinel. Stored when the OAuth creative id is unknown so the reopen
+// still fires (matches any page) — the scoped path stores the id instead. Must
+// be a value no serialized creative id can equal: ids are positive integers and
+// serialize to digit strings, so a non-digit marker never collides. (A previous
+// '1' sentinel collided with creative id 1 — that page's scoped reopen was
+// misread as unscoped and skipped the mismatch guard.)
+const UNSCOPED = '*';
+
+// Record that the modal should reopen after the next full-page reload, scoped to
+// the creative the OAuth popup was opened for. The popup posts its own
+// creativeId; storing it lets consume verify the reloaded page still shows that
+// same creative before reopening — otherwise, if the opener navigated to a
+// different creative while the popup was open, the reload would auto-open the
+// wrong creative's link modal and the user could link the project to it.
+// Tolerates a missing or throwing storage (private-mode Safari, packaged
+// WKWebView) — the reopen is a convenience and must never throw inside the
+// postMessage handler.
+export function markReopenAfterConnect(storage, creativeId) {
+  const value =
+    creativeId != null && String(creativeId) !== '' ? String(creativeId) : UNSCOPED;
+  try {
+    if (storage) storage.setItem(LINEAR_REOPEN_KEY, value);
+  } catch (e) {
+    /* storage unavailable — skip the reopen nicety */
+  }
+}
+
+// Consume the reopen intent: returns true at most once, then clears the flag so
+// a later unrelated reload (e.g. after linking succeeds) does not reopen it. The
+// flag is cleared on the first consume regardless of match, so a stale intent
+// (opener navigated elsewhere) never lingers to reopen the modal on some later
+// visit. Returns true only when the stored creative id matches the current page
+// (or when the legacy unscoped sentinel was stored).
+export function consumeReopenAfterConnect(storage, currentCreativeId) {
+  try {
+    if (!storage) return false;
+    const stored = storage.getItem(LINEAR_REOPEN_KEY);
+    if (!stored) return false;
+    storage.removeItem(LINEAR_REOPEN_KEY); // one-shot regardless of match
+    if (stored === UNSCOPED) return true;
+    return String(currentCreativeId == null ? '' : currentCreativeId) === stored;
+  } catch (e) {
+    /* storage unavailable — treat as no pending reopen */
+  }
+  return false;
+}

data/app/services/collavre_linear/client.rb

@@ -423,7 +423,7 @@ module CollavreLinear
       parsed = begin
         JSON.parse(response.body)
       rescue JSON::ParserError
-        raise Error, "Linear returned non-JSON response (HTTP #{response.code}): #{response.body.to_s[0, 200]}"
+        raise Error, "Linear returned non-JSON response (HTTP #{response.code}) from #{endpoint}: #{response.body.to_s[0, 200]}"
       end
 
       if parsed["errors"].present?
@@ -470,9 +470,32 @@ module CollavreLinear
     end
 
     def resolve_endpoint
-      if defined?(Collavre::IntegrationSettings::Resolver)
-        Collavre::IntegrationSettings::Resolver.get(:linear_api_endpoint).presence
-      end || DEFAULT_ENDPOINT
+      configured =
+        if defined?(Collavre::IntegrationSettings::Resolver)
+          Collavre::IntegrationSettings::Resolver.get(:linear_api_endpoint).presence
+        end
+
+      normalize_endpoint(configured) || DEFAULT_ENDPOINT
+    end
+
+    # Guard a misconfigured `linear_api_endpoint` override. Linear's GraphQL API
+    # lives at the `/graphql` path; an admin who pastes only a base URL
+    # (e.g. `https://host:port` or `.../`) would otherwise POST to `/`, which a
+    # non-Linear server answers with a 404 ("Cannot POST /"). When the configured
+    # value carries no meaningful path, point it at `/graphql`. A value that
+    # already specifies a non-root path is left untouched.
+    def normalize_endpoint(value)
+      return nil if value.blank?
+
+      uri = URI.parse(value.strip)
+      return value if uri.path.present? && uri.path != "/"
+
+      uri.path = "/graphql"
+      uri.to_s
+    rescue URI::InvalidURIError
+      # Not a parseable URI: return as-is and let the request surface the failure
+      # rather than silently rewriting an unrecognizable value.
+      value
     end
 
     # Convert symbol keys to camelCase strings for GraphQL variables.

data/app/views/collavre_linear/auth/setup.html.erb

@@ -50,13 +50,33 @@
   </div>
 
   <script>
-    document.getElementById('close-btn').addEventListener('click', function() {
+    // Tell the opener the account is connected so it advances straight to the
+    // project-link step. The opener also closes this popup (window.close() below
+    // is unreliable after the cross-origin OAuth round trip and in the desktop
+    // WebView, which is why the "Close" button used to look dead).
+    function notifyOpener() {
       try {
-        if (window.opener) {
-          window.opener.postMessage({ type: 'linearConnected' }, window.location.origin);
+        if (window.opener && !window.opener.closed) {
+          // Include the creative this popup was opened for so the opener only
+          // reopens the modal when it's still showing that same creative — not
+          // whatever creative it may have navigated to while the popup was open.
+          var wizard = document.getElementById('linear-wizard');
+          var creativeId = wizard ? wizard.dataset.creativeId : '';
+          window.opener.postMessage(
+            { type: 'linearConnected', creativeId: creativeId },
+            window.location.origin
+          );
         }
       } catch (e) {}
-      window.close();
+    }
+
+    // Auto-advance on load: no click required — the opener reloads and jumps to
+    // the project settings ("link a project") step.
+    notifyOpener();
+
+    document.getElementById('close-btn').addEventListener('click', function() {
+      notifyOpener();
+      try { window.close(); } catch (e) {}
     });
   </script>
 </body>

data/lib/collavre_linear/version.rb

@@ -1,3 +1,3 @@
 module CollavreLinear
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: collavre_linear
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Collavre
@@ -49,7 +49,9 @@ files:
 - app/controllers/collavre_linear/auth_controller.rb
 - app/controllers/collavre_linear/creatives/integrations_controller.rb
 - app/controllers/collavre_linear/webhooks_controller.rb
+- app/javascript/__tests__/linear_modal_reopen.test.js
 - app/javascript/collavre_linear.js
+- app/javascript/linear_modal_reopen.js
 - app/jobs/collavre_linear/inbound_apply_job.rb
 - app/jobs/collavre_linear/outbound_archive_job.rb
 - app/jobs/collavre_linear/outbound_comment_delete_job.rb