commerce7-rails 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d17bdff3aaa4490b2fda29996b277c0947c5dcb6539d4bc02b8d81a63cb50fd0
-  data.tar.gz: b16fc3cdc51a00bf3e8563283db63fbaf2bc14d5508831038cb26c155ca3ad6e
+  metadata.gz: 54a31ca6f73ce04f8fe8c32d673e781f53f34a6bab48220a907d57d0d9500a95
+  data.tar.gz: afb4810f89069ce03865b4fdb683c7b4d6778f1028dc49e8a7122db063755ea0
 SHA512:
-  metadata.gz: 52f6b435f3044adf60b7210a78b1d0b69ccfaa018d126f89432a764875d55a4a370d50c87928a7f7e4024314b3c857a863e6ecc8512ce221c0f281065190ccd6
-  data.tar.gz: b7160af777302983bc93d39308bcf63a9f4058c177d5e1ddf5b37be021522fcb69dc5d109cbaf12db86550a45e006c52e18d67c98c8e92cbd18df6e56a4f5b94
+  metadata.gz: 347fb156c387dc45af3bffff70be82bb3c25f4e67ad5cce37de1fc6203be66dbe834b3d780931986296457601158dba77f0bdb3cab867555e5ba228f8ec9e858
+  data.tar.gz: e2424555f6b6948f79fdd8f72cdee26a8997c10d2c93dafc51eac65226c6eac06122fd03d93a90f53ecb62a00f57ef6c487480158e364532f1eafffc2cd26e69

data/README.md

@@ -4,11 +4,34 @@ Rails building blocks for building a [Commerce7](https://www.commerce7.com/) App
 
 This gem owns the Commerce7-protocol plumbing. Your app owns the business logic: your tenant model's own fields, what a webhook handler actually does, what your App Extension pages render.
 
+## Requirements
+
+- Rails 8.1.4 or later
+- Faraday 2.14.4 or later
+
+Both floors date from v0.3.0. Earlier versions allowed Rails 7.1+ and any Faraday 2.x.
+
+**Why:** `json` 3.0 changed the signature of `JSON.parse`, and older Rails and Faraday releases call it in ways it no longer accepts. Nothing in your app has to request `json` 3 for this to happen. It arrives as a transitive dependency (rubocop 1.91 pulls it in, for one), and neither Rails nor Faraday caps `json` below 3, so Bundler will happily resolve a combination that breaks at runtime. The floors rule those combinations out.
+
+- **Faraday 2.14.3 and earlier:** the JSON response middleware breaks, so every Commerce7 REST client response raises `Faraday::ParsingError: wrong number of arguments (given 2, expected 1)`.
+- **Rails before 8.1.4:** `ActiveSupport::JSON.decode` breaks, so every `json`/`jsonb` column read raises. That includes the `raw_activation_payload` column the install generator creates. How it fails depends on the Rails line:
+
+  | Rails | With `json` 3 |
+  |---|---|
+  | 7.1.x, 8.0.x | `ArgumentError: unknown keyword: quirks_mode` |
+  | 7.2.x | JSON decoding works |
+  | 8.1.0 to 8.1.3.x | `ArgumentError: wrong number of arguments (given 2, expected 1)` |
+  | 8.1.4 and later | Works |
+
+  A gemspec can't say "7.2.x or 8.1.4 and later", so the floor is 8.1.4.
+
+If you're stuck on an older Rails, stay on v0.2.1 and pin `json` below 3 in your app's Gemfile (`gem "json", "~> 2.21"`).
+
 ## Install
 
 ```ruby
 # Gemfile
-gem "commerce7-rails", github: "ERCubed/commerce7-rails", tag: "v0.2.0"
+gem "commerce7-rails", github: "ERCubed/commerce7-rails", tag: "v0.3.0"
 ```
 
 ```

data/app/controllers/commerce7/extension_controller.rb

@@ -18,15 +18,19 @@ module Commerce7
     # a cross-site iframe POST where the session cookie may not travel).
     protect_from_forgery with: :exception
 
-    before_action :authenticate_staff!
-
     # Rails sends X-Frame-Options: SAMEORIGIN by default, which blocks
     # Commerce7's admin panel (a different origin) from framing this page at
     # all. Commerce7 doesn't publish a stable admin origin to scope a
     # replacement CSP frame-ancestors to, so this just drops the blanket
     # deny; a host app that wants a tighter CSP can add its own
     # frame-ancestors directive once that origin is confirmed.
-    after_action { response.headers.delete("X-Frame-Options") }
+    #
+    # A before_action, declared ahead of authenticate_staff!, rather than an
+    # after_action: when auth fails, authenticate_staff! renders the error
+    # page and halts the chain, and after_actions never run — which left
+    # exactly the page staff most need to see blocked inside the iframe.
+    before_action { response.headers.delete("X-Frame-Options") }
+    before_action :authenticate_staff!
 
     rescue_from ActionController::ParameterMissing do |error|
       render plain: error.message, status: :bad_request

data/lib/commerce7/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Commerce7
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: commerce7-rails
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Eric Roberts
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: 8.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: 8.1.4
 - !ruby/object:Gem::Dependency
   name: faraday
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: 2.14.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: 2.14.4
 description: Activation/deactivation lifecycle, webhook dispatch, App Extension staff-JWT
   auth, the Commerce7 REST client, and the post-uninstall data purge Commerce7's security
   review requires — configured once, reused across every Commerce7 app.