context_drop 0.1.0

data/app/models/context_drop/application_record.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module ContextDrop
+  class ApplicationRecord < ActiveRecord::Base
+    self.abstract_class = true
+  end
+end

data/app/models/context_drop/attachment.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module ContextDrop
+  class Attachment < ApplicationRecord
+    self.table_name = "context_drop_attachments"
+
+    ATTACHMENT_TYPES = %w[image screenshot file].freeze
+
+    belongs_to :feedback,
+               class_name: "ContextDrop::Feedback",
+               inverse_of: :attachments
+
+    belongs_to :element_reference,
+               class_name: "ContextDrop::ElementReference",
+               optional: true,
+               inverse_of: :attachments
+
+    has_one_attached :file if respond_to?(:has_one_attached)
+
+    validates :attachment_type, presence: true, inclusion: { in: ATTACHMENT_TYPES }
+
+    before_validation :normalize_metadata
+
+    private
+
+    def normalize_metadata
+      self.metadata = {} unless metadata.is_a?(Hash)
+    end
+  end
+end

data/app/models/context_drop/element_reference.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module ContextDrop
+  class ElementReference < ApplicationRecord
+    self.table_name = "context_drop_element_references"
+
+    belongs_to :feedback,
+               class_name: "ContextDrop::Feedback",
+               inverse_of: :element_references
+
+    has_many :attachments,
+             class_name: "ContextDrop::Attachment",
+             foreign_key: :element_reference_id,
+             dependent: :nullify,
+             inverse_of: :element_reference
+
+    validates :tag_name, presence: true
+    validates :selector, presence: true
+    validate :validate_bounding_rect
+
+    before_validation :normalize_fields
+
+    private
+
+    def normalize_fields
+      self.tag_name = tag_name.to_s.strip.downcase if tag_name.present?
+      self.attributes_snapshot = {} unless attributes_snapshot.is_a?(Hash)
+      self.bounding_rect = {} unless bounding_rect.is_a?(Hash)
+      self.viewport = {} unless viewport.is_a?(Hash)
+      self.metadata = {} unless metadata.is_a?(Hash)
+    end
+
+    def validate_bounding_rect
+      unless bounding_rect.is_a?(Hash) && bounding_rect.any?
+        errors.add(:bounding_rect, "must be a non-empty coordinate hash")
+        return
+      end
+
+      required_keys = %w[x y width height]
+      stringified_keys = bounding_rect.keys.map(&:to_s)
+      missing = required_keys - stringified_keys
+      return if missing.empty?
+
+      errors.add(:bounding_rect, "is missing required keys: #{missing.join(', ')}")
+    end
+  end
+end

data/app/models/context_drop/feedback.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module ContextDrop
+  class Feedback < ApplicationRecord
+    self.table_name = "context_drop_feedbacks"
+
+    STATUSES = %w[new reviewed resolved dismissed].freeze
+
+    belongs_to :submitter, polymorphic: true, optional: true
+
+    has_many :attachments,
+             class_name: "ContextDrop::Attachment",
+             foreign_key: :feedback_id,
+             inverse_of: :feedback,
+             dependent: :destroy
+
+    has_many :element_references,
+             class_name: "ContextDrop::ElementReference",
+             foreign_key: :feedback_id,
+             inverse_of: :feedback,
+             dependent: :destroy
+
+    scope :new_records, -> { where(status: "new") }
+    scope :reviewed, -> { where(status: "reviewed") }
+    scope :resolved, -> { where(status: "resolved") }
+    scope :dismissed, -> { where(status: "dismissed") }
+    scope :recent, -> { order(created_at: :desc, id: :desc) }
+
+    validates :page_url, presence: true
+    validates :status, presence: true, inclusion: { in: STATUSES }
+    validate :ensure_content_or_context_present
+    validate :ensure_collection_limits
+
+    before_validation :normalize_defaults
+
+    def mark_reviewed!
+      update!(status: "reviewed")
+    end
+
+    def mark_resolved!
+      update!(status: "resolved")
+    end
+
+    def mark_dismissed!
+      update!(status: "dismissed")
+    end
+
+    def submitter_label
+      return "Anonymous" if submitter_type.blank? && submitter_id.blank?
+
+      if submitter
+        if submitter.respond_to?(:email) && submitter.email.present?
+          "#{submitter_type}##{submitter_id} (#{submitter.email})"
+        elsif submitter.respond_to?(:name) && submitter.name.present?
+          "#{submitter_type}##{submitter_id} (#{submitter.name})"
+        else
+          "#{submitter_type}##{submitter_id}"
+        end
+      else
+        "#{submitter_type}##{submitter_id}"
+      end
+    end
+
+    private
+
+    def normalize_defaults
+      self.status = "new" if status.blank?
+      self.metadata = {} unless metadata.is_a?(Hash)
+    end
+
+    def ensure_content_or_context_present
+      has_message = message.to_s.strip != ""
+      has_attachments = attachments.reject(&:marked_for_destruction?).any?
+      has_elements = element_references.reject(&:marked_for_destruction?).any?
+
+      return if has_message || has_attachments || has_elements
+
+      errors.add(:base, "Feedback must include a message, an attachment, or a selected DOM element")
+    end
+
+    def ensure_collection_limits
+      max_att = ContextDrop.config.max_attachments.to_i
+      max_el = ContextDrop.config.max_element_references.to_i
+
+      if attachments.reject(&:marked_for_destruction?).size > max_att
+        errors.add(:attachments, "exceeds maximum allowed (#{max_att})")
+      end
+
+      return unless element_references.reject(&:marked_for_destruction?).size > max_el
+
+      errors.add(:element_references, "exceeds maximum allowed (#{max_el})")
+    end
+  end
+end

data/app/services/context_drop/metadata_sanitizer.rb

@@ -0,0 +1,215 @@
+# frozen_string_literal: true
+
+require "time"
+
+module ContextDrop
+  class MetadataSanitizer
+    ALLOWED_ATTRIBUTE_KEYS = %w[
+      id
+      class
+      role
+      name
+      type
+      href
+      title
+      placeholder
+      alt
+      data-testid
+      data-test
+      data-cy
+      data-qa
+      data-turbo-frame
+    ].freeze
+
+    FORBIDDEN_METADATA_KEYS = %w[
+      outerhtml
+      innerhtml
+      value
+      defaultvalue
+      password
+      secret
+      token
+      authorization
+      cookie
+    ].freeze
+
+    MAX_TEXT_LENGTH = 500
+    MAX_SELECTOR_LENGTH = 500
+    MAX_DOM_PATH_LENGTH = 1000
+    MAX_ATTR_VALUE_LENGTH = 300
+
+    class SensitiveElementError < ContextDrop::Error; end
+
+    class << self
+      def sanitize_element_reference(raw_params)
+        params = stringify_hash(raw_params)
+        tag_name = params["tag_name"].to_s.strip.downcase
+        raw_attrs = stringify_hash(params["attributes_snapshot"] || params["attributes"] || {})
+
+        if sensitive_element?(tag_name, raw_attrs, params["selector"].to_s)
+          raise SensitiveElementError, "Cannot attach excluded or sensitive DOM element"
+        end
+
+        {
+          client_ref: truncate_str(params["client_ref"], 128),
+          tag_name: tag_name,
+          selector: truncate_str(params["selector"], MAX_SELECTOR_LENGTH).to_s,
+          dom_path: truncate_str(params["dom_path"], MAX_DOM_PATH_LENGTH),
+          text_content: sanitize_text_content(tag_name, params["text_content"]),
+          attributes_snapshot: sanitize_attributes(raw_attrs),
+          bounding_rect: sanitize_bounding_rect(params["bounding_rect"]),
+          viewport: sanitize_viewport(params["viewport"]),
+          metadata: sanitize_generic_hash(params["metadata"]),
+          captured_at: parse_timestamp(params["captured_at"])
+        }
+      end
+
+      def sanitize_feedback_metadata(raw_metadata)
+        sanitize_generic_hash(raw_metadata)
+      end
+
+      def sanitize_attachment_metadata(raw_metadata)
+        sanitize_generic_hash(raw_metadata)
+      end
+
+      def sensitive_element?(tag_name, attrs, selector = "")
+        input_type = attrs["type"].to_s.strip.downcase
+        return true if tag_name == "input" && %w[password hidden].include?(input_type)
+        return true if attrs.key?("data-feedback-ignore") || attrs.key?("data-feedback-sensitive")
+
+        autocomplete = attrs["autocomplete"].to_s.strip.downcase
+        return true if autocomplete.start_with?("cc-")
+
+        sel_down = selector.to_s.downcase
+        return true if sel_down.include?("data-feedback-ignore") || sel_down.include?("data-feedback-sensitive")
+
+        false
+      end
+
+      def sanitize_attributes(raw_attrs)
+        attrs = stringify_hash(raw_attrs)
+        sanitized = {}
+
+        attrs.each do |key, value|
+          normalized_key = key.to_s.strip.downcase
+          next if normalized_key.empty?
+          next if FORBIDDEN_METADATA_KEYS.include?(normalized_key)
+          next if normalized_key.start_with?("on")
+
+          allowed = ALLOWED_ATTRIBUTE_KEYS.include?(normalized_key) ||
+                    (normalized_key.start_with?("aria-") && normalized_key != "aria-hidden")
+          next unless allowed
+
+          str_val = value.to_s.strip
+          if normalized_key == "href" && str_val.downcase.start_with?("javascript:", "data:")
+            next
+          end
+
+          sanitized[normalized_key] = truncate_str(str_val, MAX_ATTR_VALUE_LENGTH)
+        end
+
+        sanitized
+      end
+
+      def sanitize_bounding_rect(raw_rect)
+        rect = stringify_hash(raw_rect)
+        return {} if rect.empty?
+
+        result = {}
+        %w[x y width height].each do |coord|
+          next unless rect.key?(coord) && !rect[coord].nil?
+
+          num = Float(rect[coord])
+          result[coord] = num.finite? ? num.round(2) : 0.0
+        rescue ArgumentError, TypeError
+          next
+        end
+        result
+      end
+
+      def sanitize_viewport(raw_viewport)
+        vp = stringify_hash(raw_viewport)
+        return {} if vp.empty?
+
+        result = {}
+        %w[width height].each do |dim|
+          next unless vp.key?(dim) && !vp[dim].nil?
+
+          num = Integer(Float(vp[dim]))
+          result[dim] = num.positive? ? num : 0
+        rescue ArgumentError, TypeError
+          next
+        end
+        result
+      end
+
+      def sanitize_generic_hash(input, depth = 0)
+        return {} if depth > 4 || !input.is_a?(Hash)
+
+        cleaned = {}
+        input.each do |k, v|
+          key_str = k.to_s.strip
+          next if key_str.empty?
+          next if FORBIDDEN_METADATA_KEYS.include?(key_str.downcase)
+
+          cleaned[key_str] = case v
+                             when Hash
+                               sanitize_generic_hash(v, depth + 1)
+                             when Array
+                               v.first(25).map { |item| item.is_a?(Hash) ? sanitize_generic_hash(item, depth + 1) : sanitize_scalar(item) }
+                             else
+                               sanitize_scalar(v)
+                             end
+        end
+        cleaned
+      end
+
+      private
+
+      def sanitize_text_content(tag_name, text)
+        return nil if text.nil?
+        return nil if %w[input textarea select password].include?(tag_name)
+
+        normalized = text.to_s.gsub(/\s+/, " ").strip
+        return nil if normalized.empty?
+
+        truncate_str(normalized, MAX_TEXT_LENGTH)
+      end
+
+      def sanitize_scalar(val)
+        case val
+        when Numeric, TrueClass, FalseClass, NilClass
+          val
+        else
+          truncate_str(val.to_s, MAX_TEXT_LENGTH)
+        end
+      end
+
+      def truncate_str(value, max_len)
+        return nil if value.nil?
+
+        str = value.to_s
+        str.length > max_len ? str[0, max_len] : str
+      end
+
+      def parse_timestamp(val)
+        return Time.now.utc if val.nil? || val.to_s.strip.empty?
+        return val if val.is_a?(Time)
+
+        Time.iso8601(val.to_s)
+      rescue ArgumentError
+        Time.now.utc
+      end
+
+      def stringify_hash(obj)
+        if obj.respond_to?(:to_unsafe_h)
+          obj.to_unsafe_h.transform_keys(&:to_s)
+        elsif obj.is_a?(Hash)
+          obj.transform_keys(&:to_s)
+        else
+          {}
+        end
+      end
+    end
+  end
+end

data/app/services/context_drop/upload_validator.rb

@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+
+require "stringio"
+begin
+  require "marcel"
+rescue LoadError
+  # Fallback to built-in magic byte detection if Marcel is not loaded
+end
+
+module ContextDrop
+  class UploadValidator
+    class ValidationError < ContextDrop::Error
+      attr_reader :http_status
+
+      def initialize(message, http_status: :unprocessable_entity)
+        super(message)
+        @http_status = http_status
+      end
+    end
+
+    MIME_EXTENSIONS = {
+      "image/png" => %w[.png],
+      "image/jpeg" => %w[.jpg .jpeg],
+      "image/webp" => %w[.webp],
+      "image/gif" => %w[.gif]
+    }.freeze
+
+    PNG_SIGNATURE = "\x89PNG\r\n\x1A\n".b.freeze
+    JPEG_SIGNATURE = "\xFF\xD8\xFF".b.freeze
+    GIF87_SIGNATURE = "GIF87a".b.freeze
+    GIF89_SIGNATURE = "GIF89a".b.freeze
+    RIFF_SIGNATURE = "RIFF".b.freeze
+    WEBP_SIGNATURE = "WEBP".b.freeze
+
+    class << self
+      # Validates an uploaded file (ActionDispatch::Http::UploadedFile, Rack::Test::UploadedFile, or Hash/IO)
+      # Returns a normalized Hash `{ io:, filename:, content_type:, byte_size:, dimensions: [w, h] }`
+      def validate!(upload)
+        io, original_filename = extract_io_and_filename(upload)
+        raise ValidationError, "Missing file upload" if io.nil?
+
+        io.rewind if io.respond_to?(:rewind)
+        raw_bytes = io.read.to_s.b
+        io.rewind if io.respond_to?(:rewind)
+
+        byte_size = raw_bytes.bytesize
+        raise ValidationError, "Uploaded file cannot be empty" if byte_size.zero?
+
+        max_size = ContextDrop.config.max_attachment_size.to_i
+        if max_size.positive? && byte_size > max_size
+          raise ValidationError.new(
+            "File size (#{byte_size} bytes) exceeds maximum allowed size (#{max_size} bytes)",
+            http_status: :unprocessable_entity
+          )
+        end
+
+        detected_mime = detect_magic_mime_type(raw_bytes)
+        allowed_types = Array(ContextDrop.config.allowed_content_types)
+
+        if detected_mime.nil? || !allowed_types.include?(detected_mime)
+          raise ValidationError, "Unsupported or invalid file content type (detected: #{detected_mime || 'unknown'})"
+        end
+
+        sanitized_filename = sanitize_filename(original_filename, detected_mime)
+        validate_extension!(sanitized_filename, detected_mime)
+
+        dimensions = extract_image_dimensions(raw_bytes, detected_mime)
+        validate_dimensions!(dimensions)
+
+        {
+          io: StringIO.new(raw_bytes),
+          filename: sanitized_filename,
+          content_type: detected_mime,
+          byte_size: byte_size,
+          dimensions: dimensions
+        }
+      end
+
+      def detect_magic_mime_type(bytes)
+        header = bytes[0, 32].to_s.b
+        magic_mime = if header.start_with?(PNG_SIGNATURE)
+                       "image/png"
+                     elsif header.start_with?(JPEG_SIGNATURE)
+                       "image/jpeg"
+                     elsif header.start_with?(GIF87_SIGNATURE) || header.start_with?(GIF89_SIGNATURE)
+                       "image/gif"
+                     elsif header.bytesize >= 12 && header[0, 4] == RIFF_SIGNATURE && header[8, 4] == WEBP_SIGNATURE
+                       "image/webp"
+                     end
+
+        return magic_mime if magic_mime
+
+        if defined?(Marcel::MimeType)
+          marcel_type = Marcel::MimeType.for(StringIO.new(bytes))
+          return marcel_type if MIME_EXTENSIONS.key?(marcel_type)
+        end
+
+        nil
+      end
+
+      def extract_image_dimensions(bytes, mime_type)
+        case mime_type
+        when "image/png"
+          return nil if bytes.bytesize < 24
+
+          bytes[16, 8].unpack("NN")
+        when "image/gif"
+          return nil if bytes.bytesize < 10
+
+          bytes[6, 4].unpack("vv")
+        when "image/webp"
+          extract_webp_dimensions(bytes)
+        when "image/jpeg"
+          extract_jpeg_dimensions(bytes)
+        end
+      rescue StandardError
+        nil
+      end
+
+      def sanitize_filename(filename, detected_mime)
+        default_ext = MIME_EXTENSIONS.fetch(detected_mime, [".bin"]).first
+        return "attachment#{default_ext}" if filename.nil? || filename.to_s.strip.empty?
+
+        base = File.basename(filename.to_s.strip).gsub(/[^a-zA-Z0-9._-]/, "_")
+        base = "attachment#{default_ext}" if base.empty? || base.start_with?(".")
+        base
+      end
+
+      private
+
+      def extract_io_and_filename(upload)
+        if upload.respond_to?(:tempfile) && upload.respond_to?(:original_filename)
+          [upload.tempfile, upload.original_filename]
+        elsif upload.is_a?(Hash)
+          io = upload[:io] || upload["io"] || upload[:tempfile] || upload["tempfile"]
+          fname = upload[:filename] || upload["filename"] || upload[:original_filename] || upload["original_filename"]
+          [io, fname]
+        elsif upload.respond_to?(:read)
+          fname = upload.respond_to?(:original_filename) ? upload.original_filename : "screenshot.png"
+          [upload, fname]
+        else
+          [nil, nil]
+        end
+      end
+
+      def validate_extension!(filename, detected_mime)
+        ext = File.extname(filename).downcase
+        allowed_exts = MIME_EXTENSIONS[detected_mime] || []
+        return if ext.empty? || allowed_exts.include?(ext)
+
+        raise ValidationError, "File extension '#{ext}' does not match detected content type '#{detected_mime}'"
+      end
+
+      def validate_dimensions!(dimensions)
+        return if dimensions.nil?
+
+        max_dims = Array(ContextDrop.config.max_image_dimensions)
+        return unless max_dims.size == 2
+
+        width, height = dimensions
+        max_w, max_h = max_dims.map(&:to_i)
+
+        if width <= 0 || height <= 0
+          raise ValidationError, "Invalid image dimensions (#{width}x#{height})"
+        end
+
+        return unless (max_w.positive? && width > max_w) || (max_h.positive? && height > max_h)
+
+        raise ValidationError, "Image dimensions (#{width}x#{height}) exceed maximum allowed (#{max_w}x#{max_h})"
+      end
+
+      def extract_webp_dimensions(bytes)
+        return nil if bytes.bytesize < 30
+
+        chunk_type = bytes[12, 4]
+        case chunk_type
+        when "VP8 ".b
+          w, h = bytes[26, 4].unpack("vv")
+          [w & 0x3FFF, h & 0x3FFF]
+        when "VP8L".b
+          bits = bytes[21, 4].unpack1("V")
+          w = (bits & 0x3FFF) + 1
+          h = ((bits >> 14) & 0x3FFF) + 1
+          [w, h]
+        when "VP8X".b
+          w = (bytes[24, 3] + "\x00".b).unpack1("V") + 1
+          h = (bytes[27, 3] + "\x00".b).unpack1("V") + 1
+          [w, h]
+        end
+      end
+
+      def extract_jpeg_dimensions(bytes)
+        idx = 2
+        len = bytes.bytesize
+        while idx + 9 < len
+          if bytes.getbyte(idx) != 0xFF
+            idx += 1
+            next
+          end
+          marker = bytes.getbyte(idx + 1)
+          idx += 2
+          next if marker == 0xD8 || marker == 0xD9 || (marker >= 0xD0 && marker <= 0xD7)
+
+          seg_len = bytes[idx, 2].unpack1("n")
+          break if seg_len.nil? || seg_len < 2
+
+          if [0xC0, 0xC1, 0xC2, 0xC3].include?(marker)
+            height, width = bytes[idx + 3, 4].unpack("nn")
+            return [width, height]
+          end
+          idx += seg_len
+        end
+        nil
+      end
+    end
+  end
+end

data/app/views/context_drop/dashboard/feedbacks/index.html.erb

@@ -0,0 +1,86 @@
+<div class="cd-tabs" role="tablist" aria-label="Filter feedback by status">
+  <a href="<%= dashboard_feedbacks_path(q: @search_query.presence, page_url: @page_url_filter.presence) %>"
+     class="cd-tab <%= 'active' if @current_status.blank? %>">
+    All (<%= @status_counts["all"] %>)
+  </a>
+  <% ContextDrop::Feedback::STATUSES.each do |status_name| %>
+    <a href="<%= dashboard_feedbacks_path(status: status_name, q: @search_query.presence, page_url: @page_url_filter.presence) %>"
+       class="cd-tab <%= 'active' if @current_status == status_name %>">
+      <%= status_name.capitalize %> (<%= @status_counts[status_name] || 0 %>)
+    </a>
+  <% end %>
+</div>
+
+<div class="cd-card">
+  <form method="get" action="<%= dashboard_feedbacks_path %>" class="cd-filter-bar">
+    <% if @current_status.present? %>
+      <input type="hidden" name="status" value="<%= @current_status %>">
+    <% end %>
+    <input type="search"
+           name="q"
+           value="<%= @search_query %>"
+           placeholder="Search message, selector, or DOM text..."
+           class="cd-input"
+           aria-label="Search feedback">
+    <input type="text"
+           name="page_url"
+           value="<%= @page_url_filter %>"
+           placeholder="Filter by page URL (e.g. /checkout)"
+           class="cd-input"
+           aria-label="Filter by page URL">
+    <button type="submit" class="cd-btn cd-btn-primary">Filter</button>
+    <% if @search_query.present? || @page_url_filter.present? || @current_status.present? %>
+      <a href="<%= dashboard_feedbacks_path %>" class="cd-btn">Reset</a>
+    <% end %>
+  </form>
+
+  <% if @feedbacks.empty? %>
+    <p style="color: var(--cd-muted); padding: 1.5rem 0; text-align: center; margin: 0;">
+      No feedback records found matching the current filters.
+    </p>
+  <% else %>
+    <table class="cd-table">
+      <thead>
+        <tr>
+          <th>ID</th>
+          <th>Status</th>
+          <th>Message &amp; Context</th>
+          <th>Page URL</th>
+          <th>Submitter</th>
+          <th>Created</th>
+          <th>Actions</th>
+        </tr>
+      </thead>
+      <tbody>
+        <% @feedbacks.each do |fb| %>
+          <tr id="feedback-row-<%= fb.id %>">
+            <td><a href="<%= dashboard_feedback_path(fb) %>" class="cd-mono">#<%= fb.id %></a></td>
+            <td>
+              <span class="cd-badge cd-badge-<%= fb.status %>"><%= fb.status %></span>
+            </td>
+            <td>
+              <div style="font-weight: 500; margin-bottom: 0.25rem;">
+                <%= fb.message.present? ? truncate(fb.message, length: 120) : "(No text message)" %>
+              </div>
+              <div style="display: flex; gap: 0.5rem; flex-wrap: wrap; font-size: 0.75rem; color: var(--cd-muted);">
+                <span>Attachments: <strong><%= fb.attachments.size %></strong></span>
+                <span>Elements: <strong><%= fb.element_references.size %></strong></span>
+                <% fb.element_references.first(2).each do |el| %>
+                  <code class="cd-mono"><%= el.selector %></code>
+                <% end %>
+              </div>
+            </td>
+            <td><code class="cd-mono"><%= fb.page_url %></code></td>
+            <td><%= fb.submitter_label %></td>
+            <td style="white-space: nowrap; color: var(--cd-muted);">
+              <%= fb.created_at&.strftime("%Y-%m-%d %H:%M UTC") %>
+            </td>
+            <td>
+              <a href="<%= dashboard_feedback_path(fb) %>" class="cd-btn">Inspect</a>
+            </td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  <% end %>
+</div>