dialecto-rails 0.1.0

data/lib/dialecto_rails/in_context/backend_hook.rb

@@ -0,0 +1,39 @@
+module DialectoRails
+  module InContext
+    # Prepended on the class of the I18n backend (spec-0023 §7.4), outside `Pluralization` and `Fallbacks`, so
+    # it sees the final string whichever of them ran. Never raises into the app: any failure returns the
+    # unmarked result.
+    #
+    # In live mode `gate` answers whether this thread is rendering for an editor; while it says no, a lookup
+    # takes the plain path and the hook leaves no trace.
+    module BackendHook
+      PLURAL = :dialecto_rails_plural
+
+      class << self
+        attr_accessor :marking, :logger, :gate
+
+        def active? = !marking.nil? && (gate.nil? || gate.call)
+      end
+
+      def translate(locale, key, options = ::I18n::EMPTY_HASH)
+        return super unless BackendHook.active?
+
+        marking = BackendHook.marking
+        Thread.current[PLURAL] = nil
+        result = super
+        begin
+          marking.call(locale, key, options, result, Thread.current[PLURAL])
+        rescue => error # standard errors only; the hook never breaks a page
+          BackendHook.logger&.debug("dialecto-rails: marking skipped (#{error.class}: #{error.message})")
+          result
+        end
+      end
+
+      def pluralize(locale, entry, count)
+        result = super
+        Thread.current[PLURAL] = [entry, result] if entry.is_a?(Hash) && BackendHook.active?
+        result
+      end
+    end
+  end
+end

data/lib/dialecto_rails/in_context/csp.rb

@@ -0,0 +1,72 @@
+module DialectoRails
+  module InContext
+    # In development, lets the overlay's origin through the app's own Content-Security-Policy (spec-0023
+    # §7.6): the origin is appended to the directives the policy already defines, or to `default-src` when it
+    # defines none of them. Only ever called after the development guard.
+    module Csp
+      DIRECTIVES = %w[script-src frame-src connect-src img-src style-src font-src].freeze
+
+      module_function
+
+      def allow(policy, origin)
+        return unless policy.respond_to?(:directives)
+
+        directives = policy.directives
+        present = DIRECTIVES.select { |name| directives.key?(name) }
+        if present.empty?
+          add(policy, "default-src", origin) if directives.key?("default-src")
+        else
+          present.each { |name| add(policy, name, origin) }
+        end
+      end
+
+      # Live mode: the same idea for one response's header text rather than the app's policy object, and only
+      # for frames, since the overlay comes from the site's own origin. `frame-src`, else `child-src`, else
+      # `default-src` governs frames; a policy with none of them lets frames through already. The browser
+      # enforces every policy, so several (an Array, or values joined by newlines) are widened one by one.
+      def widen_frame_src(header, origin)
+        return header.map { |policy| widen_frame_src(policy, origin) } if header.is_a?(Array)
+
+        policies = header.to_s.split("\n")
+        return policies.map { |policy| widen_frame_src(policy, origin) }.join("\n") if policies.size > 1
+
+        directives = header.to_s.split(";").map(&:strip).reject(&:empty?)
+        found = %w[frame-src child-src default-src].lazy.filter_map do |name|
+          directives.find { |directive| directive.split(/\s+/).first.downcase == name }
+        end.first
+        return header unless found
+
+        name, *sources = found.split(/\s+/)
+        sources = sources.reject { |source| source.casecmp?("'none'") }
+        sources << origin unless sources.include?(origin)
+        widened = (["frame-src"] + sources).join(" ")
+        return directives.map { |directive| directive.equal?(found) ? widened : directive }.join("; ") if name.casecmp?("frame-src")
+
+        (directives + [widened]).join("; ")
+      end
+
+      # Live mode: the nonce a script needs. A browser takes it from `script-src-elem`, else `script-src`, else
+      # `default-src`, and a nonce in `style-src` or elsewhere does not allow a script. `header` is the
+      # `content-security-policy` value: one policy, several joined by newlines, or an array of them. The first
+      # policy whose governing directive has a nonce wins.
+      def script_nonce(header)
+        Array(header).flat_map { |value| value.to_s.split("\n") }.each do |policy|
+          directives = policy.split(";").map(&:strip).reject(&:empty?)
+          governing = %w[script-src-elem script-src default-src].lazy.filter_map do |name|
+            directives.find { |directive| directive.split(/\s+/).first.downcase == name }
+          end.first
+          nonce = governing && governing[/'nonce-([A-Za-z0-9+\/=_-]+)'/, 1]
+          return nonce if nonce
+        end
+        nil
+      end
+
+      def add(policy, name, origin)
+        sources = Array(policy.directives[name]).reject { |source| source == "'none'" }
+        return if sources.include?(origin)
+
+        policy.public_send(name.tr("-", "_"), *sources, origin)
+      end
+    end
+  end
+end

data/lib/dialecto_rails/in_context/git_context.rb

@@ -0,0 +1,103 @@
+require "uri"
+require "open3"
+require_relative "../version"
+
+module DialectoRails
+  module InContext
+    # The site's context for the sidebar (spec-0016 §4, served at `/__dialecto/context`): `{repo, project,
+    # branch, sha, dirty, addon}`, read from git on demand so switching branches needs no restart. A git
+    # failure only leaves its field empty. Argument arrays, no shell; each call has a 5 s timeout.
+    class GitContext
+      SEGMENT = /\A[A-Za-z0-9._-]+\z/
+      SHA = /\A[0-9a-f]{40}\z/
+      MAX_DIRTY = 200
+      TIMEOUT = 5
+      CACHE_SECONDS = 1.0
+
+      def initialize(root:, project: nil, catalogs: "config/locales",
+        clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
+        @root = root.to_s
+        @project = project
+        @catalogs = catalogs
+        @clock = clock
+        @mutex = Mutex.new
+        @cached = nil
+        @cached_at = nil
+      end
+
+      def read
+        @mutex.synchronize do
+          now = @clock.call
+          return @cached if @cached && now - @cached_at < CACHE_SECONDS
+
+          @cached_at = now
+          @cached = build
+        end
+      end
+
+      def self.parse_github_remote(remote)
+        remote = remote.to_s.strip
+        host, path =
+          if remote.include?("://")
+            uri = URI.parse(remote) rescue nil
+            [uri&.host, uri&.path] if uri && %w[http https ssh git].include?(uri.scheme)
+          elsif (match = remote.match(%r{\A[^@\s/:]+@([^:/\s]+):(.+)\z}))
+            [match[1], match[2]]
+          end
+        return nil unless host && path && host.downcase == "github.com"
+
+        segments = path.delete_prefix("/").chomp("/").delete_suffix(".git").split("/")
+        segments.length == 2 && segments.all? { |segment| segment.match?(SEGMENT) } ? segments.join("/") : nil
+      end
+
+      # Repo-root-relative paths (sorted, unique, capped) from `git status --porcelain=v1 -z`.
+      def self.parse_porcelain_z(output)
+        fields = output.to_s.split("\0")
+        paths = []
+        until fields.empty?
+          field = fields.shift
+          match = field.match(/\A(.)(.) (.+)\z/m)
+          next unless match
+
+          paths << match[3]
+          renamed = "RC".include?(match[1]) || "RC".include?(match[2])
+          original = renamed ? fields.shift : nil
+          paths << original if original && !original.empty?
+        end
+        paths.uniq.sort.first(MAX_DIRTY)
+      end
+
+      private
+
+      def build
+        branch = git("rev-parse", "--abbrev-ref", "HEAD").to_s.strip
+        sha = git("rev-parse", "HEAD").to_s.strip
+        {
+          repo: self.class.parse_github_remote(git("remote", "get-url", "origin")),
+          project: @project,
+          branch: ["", "HEAD"].include?(branch) ? nil : branch,
+          sha: sha.match?(SHA) ? sha : nil,
+          dirty: self.class.parse_porcelain_z(git("status", "--porcelain=v1", "-z", "--untracked-files=all", "--",
+            File.expand_path(@catalogs, @root))),
+          addon: "rails@#{DialectoRails::VERSION}"
+        }
+      end
+
+      def git(*args)
+        Open3.popen3("git", "-C", @root, *args) do |stdin, stdout, stderr, waiter|
+          stdin.close
+          stdout.binmode
+          reader = Thread.new { stdout.read }
+          Thread.new { stderr.read }
+          unless waiter.join(TIMEOUT)
+            Process.kill("KILL", waiter.pid) rescue nil
+            return nil
+          end
+          waiter.value.success? ? reader.value.force_encoding(Encoding::UTF_8) : nil
+        end
+      rescue SystemCallError
+        nil
+      end
+    end
+  end
+end

data/lib/dialecto_rails/in_context/key_index.rb

@@ -0,0 +1,128 @@
+require "psych"
+require_relative "../scan/catalogs"
+
+module DialectoRails
+  module InContext
+    # `(locale, key) → domain`, answered from the project's own locale files without running any code. A
+    # string whose key isn't here is not marked: that leaves out every gem's locale files, `default:` text and
+    # missing translations, none of which Dialecto holds.
+    #
+    # The domain is the file's path relative to `config/locales/` (spec-0015 §1), the server's bucket. Files
+    # are read as a YAML syntax tree (`Psych.parse`, never `load`), so tags and aliases can't execute or expand;
+    # a key reached only through a `<<: *alias` merge isn't indexed (the server locks those too).
+    class KeyIndex
+      RECHECK_MS = 500
+      LOCALES_DIR = "config/locales/".freeze
+
+      def initialize(root:, catalog_paths:, load_path: -> { ::I18n.load_path },
+        clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond) })
+        @root = real(File.expand_path(root)).chomp("/") + "/"
+        @catalogs = Scan::Catalogs.new(catalog_paths)
+        @load_path = load_path
+        @clock = clock
+        @mutex = Mutex.new
+        @signature = nil
+        @checked_at = nil
+        @table = {}
+      end
+
+      # The domain of `key` in `locale`, or nil.
+      def domain(locale, key)
+        refresh
+        @table.dig(locale.to_s, key)
+      end
+
+      def locales
+        refresh
+        @table.keys
+      end
+
+      # Catalog files inside the project, in load order (later ones win a duplicate key).
+      def files
+        @load_path.call.filter_map do |path|
+          full = real(File.expand_path(path.to_s))
+          next unless full.start_with?(@root) && full.end_with?(".yml", ".yaml")
+
+          relative = full.delete_prefix(@root)
+          relative if @catalogs.match?(relative)
+        end.uniq
+      end
+
+      def self.domain_for(relative_path)
+        at = relative_path.start_with?(LOCALES_DIR) ? 0 : relative_path.index("/" + LOCALES_DIR)
+        return relative_path unless at
+
+        relative_path[(at.zero? ? LOCALES_DIR.length : at + 1 + LOCALES_DIR.length)..]
+      end
+
+      private
+
+      # Symlinks resolved on both sides, so a project reached through one (macOS /var, a linked checkout) still
+      # matches the paths Rails puts on the load path.
+      def real(path)
+        File.realpath(path)
+      rescue SystemCallError
+        path
+      end
+
+      def refresh
+        now = @clock.call
+        return if @checked_at && now - @checked_at < RECHECK_MS
+
+        @mutex.synchronize do
+          @checked_at = now
+          paths = files
+          signature = paths.map { |path| [path, mtime(path)] }
+          next if signature == @signature
+
+          @signature = signature
+          @table = build(paths)
+        end
+      end
+
+      def mtime(path)
+        File.mtime(File.join(@root, path)).to_f
+      rescue SystemCallError
+        nil
+      end
+
+      def build(paths)
+        table = Hash.new { |hash, locale| hash[locale] = {} }
+        paths.each do |path|
+          document = parse(File.join(@root, path))
+          root = document&.root
+          next unless root.is_a?(Psych::Nodes::Mapping)
+
+          domain = self.class.domain_for(path)
+          pairs(root).each do |locale_node, value|
+            next unless locale_node.is_a?(Psych::Nodes::Scalar)
+
+            walk(value, [], table[locale_node.value], domain)
+          end
+        end
+        table.default_proc = nil
+        table
+      end
+
+      def parse(path)
+        Psych.parse_file(path)
+      rescue Psych::SyntaxError, SystemCallError, EncodingError
+        nil
+      end
+
+      def pairs(mapping) = mapping.children.each_slice(2).to_a
+
+      def walk(node, path, table, domain)
+        return unless node.is_a?(Psych::Nodes::Mapping)
+
+        pairs(node).each do |key_node, value|
+          next unless key_node.is_a?(Psych::Nodes::Scalar) && key_node.value != "<<"
+
+          key_path = path + [key_node.value]
+          table[key_path.join(".")] = domain
+          walk(value, key_path, table, domain)
+        end
+      end
+    end
+  end
+end

data/lib/dialecto_rails/in_context/launch_token.rb

@@ -0,0 +1,78 @@
+require "json"
+require "openssl"
+require_relative "../config"
+
+module DialectoRails
+  module InContext
+    # Verifies the launch token Dialecto mints for an editor (spec-0025 §3) with no call to Dialecto:
+    #
+    #   token  = base64url(payload) "." base64url(signature)
+    #   signed = "dialecto-live-edit-v1." base64url(payload)
+    #
+    # The signature is Ed25519 under the repo's key, and the purpose prefix keeps a signature made for another
+    # purpose (a release manifest) from verifying here. Needs the openssl gem 3.0 or later (Ruby 3.2 ships
+    # 3.1) on OpenSSL 1.1.1 or later. Pure: the caller passes the key, the site's origin and the time.
+    module LaunchToken
+      PREFIX = "dialecto-live-edit-v1.".freeze
+      BASE64URL = /\A[A-Za-z0-9_-]*\z/
+
+      Result = Struct.new(:claims, :reason) do
+        def ok? = reason.nil?
+      end
+
+      module_function
+
+      # `phase` is `:start` when the token first arrives (which also requires `start_by` not to have passed)
+      # or `:session` for the cookie on later requests (only `exp` matters). `reason` is one of `:malformed`,
+      # `:bad_signature`, `:expired`, `:late`, `:wrong_origin` and `:wrong_repo`.
+      #
+      # With `repo` ("owner/name") the token's repo claim must match it, ignoring case (`:wrong_repo`): a
+      # cheap check against a key pasted from the wrong repo.
+      def verify(token, public_key, origin, now, phase = :session, repo: nil)
+        return failure(:malformed) unless token.is_a?(String) && public_key.is_a?(String) && public_key.bytesize == 32
+        return failure(:malformed) unless origin.is_a?(String) && now.is_a?(Integer)
+
+        payload_b64, signature_b64, extra = token.split(".", 3)
+        return failure(:malformed) if payload_b64.nil? || signature_b64.nil? || extra
+
+        signature = decode(signature_b64)
+        return failure(:malformed) unless signature&.bytesize == 64
+        return failure(:bad_signature) unless signed?(payload_b64, signature, public_key)
+
+        claims = claims(payload_b64)
+        return failure(:malformed) unless claims
+
+        return failure(:expired) if now >= claims["exp"]
+        return failure(:late) if phase == :start && now > claims["start_by"]
+        return failure(:wrong_origin) unless Config.normalize_origin(claims["origin"]) == origin
+        return failure(:wrong_repo) if repo && !(claims["repo"].is_a?(String) && claims["repo"].casecmp?(repo))
+
+        Result.new(claims, nil)
+      end
+
+      def failure(reason) = Result.new(nil, reason)
+
+      def decode(text)
+        return nil unless text.match?(BASE64URL) && text.length % 4 != 1
+
+        (text.tr("-_", "+/") + "=" * (-text.length % 4)).unpack1("m")
+      end
+
+      def signed?(payload_b64, signature, public_key)
+        OpenSSL::PKey.new_raw_public_key("ED25519", public_key).verify(nil, signature, PREFIX + payload_b64)
+      rescue OpenSSL::PKey::PKeyError
+        false
+      end
+
+      def claims(payload_b64)
+        json = decode(payload_b64)
+        claims = json && JSON.parse(json.force_encoding(Encoding::UTF_8))
+        valid = claims.is_a?(Hash) && claims["v"] == 1 && claims["origin"].is_a?(String) &&
+          claims["exp"].is_a?(Integer) && claims["start_by"].is_a?(Integer)
+        valid ? claims : nil
+      rescue JSON::ParserError, EncodingError
+        nil
+      end
+    end
+  end
+end