dispatch-rails 0.10.0 → 0.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0fab7390093499294d3150088b49f04fc9fca920a711b33d1e8455e3a6ad2ea9
-  data.tar.gz: ba51af0c31c876c4d482445cb33353d56f97c5afb2a2dfc07d4a29e06a15d69d
+  metadata.gz: a712af989dbaa59fcd32135400b74a6ddb41058f291d60dce865516e117a50c6
+  data.tar.gz: 1e1d88267bcffb7177556c6a0dd92c7e9e191356288e647881a1ef04410bbeb3
 SHA512:
-  metadata.gz: dce4062b5290d5a1e82f3c7bdf01d73a279ac4fa01a63431ed2ed3f97e58f2592229fd02d09db26cf811c1a774e2edcadb5ea82d1bb1654b75918d886685c70c
-  data.tar.gz: b7d09382ab99f1962a6ea92007364f5798d7cda3c33f1bd92cc111c6895de49554d655ca9d8b87a2d1978d0812cbf5e29cdc66e4821a766db8e3c8e71e29b11c
+  metadata.gz: 891dee4bfc449f10ba4e4478ebd3fdd695d023f1853179563f63ccbbfa0a67c5431151576b403db02520c6132a0bb0ea6c93d64fe4999bde11006d820c39af26
+  data.tar.gz: f5be0e31f9ecbfce518e7533fc6a483c7bc12bcb5a624aae24a8617666232bf2d7a10f1787367313c7b741bf5ffe88dc07fff8e05bc0805e70012a50c65ef517

data/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `dispatch-rails` are documented here. The format is based
 on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.1] - 2026-06-18
+
+### Fixed
+- The browser tracker/widget loaders import a fixed `/dispatch/error_tracker.js`
+  and `/dispatch/widget.js`, but nothing served those exact paths — the asset
+  pipeline only exposes the files under `/assets/...` (digested under Propshaft),
+  so the dynamic `import()` 404'd in every environment and the tracker/widget
+  silently never loaded. A new `AssetMiddleware` now serves both files at the
+  imported paths with a JS content type, requiring no host mount, route, or
+  precompile entry. (The config island stays a non-executable
+  `<script type="application/json">` and the loaders keep their nonce-aware
+  `javascript_tag`, so no CSP nonce is needed for either.)
+
 ## [0.10.0] - 2026-06-18
 
 ### Added

data/lib/dispatch/rails/asset_middleware.rb

@@ -0,0 +1,65 @@
+module Dispatch
+  module Rails
+    # Serves the gem's browser JS (error_tracker.js, widget.js) at the stable,
+    # non-digested /dispatch/<name>.js paths the view partials import from.
+    #
+    # The engine also registers the JS directory in config.assets.paths, but the
+    # partials deliberately import a fixed URL (so the inline loader needs no
+    # asset-pipeline lookup) — and the asset pipeline never exposes that exact URL:
+    # Propshaft serves the files under /assets/dispatch/<name>-<digest>.js, Sprockets
+    # under /assets/dispatch/<name>.js, and neither at /dispatch/<name>.js. With
+    # nothing serving that path the import 404s in every environment and the
+    # tracker/widget silently never load. This middleware closes that gap with no
+    # host mount, route, or precompile entry required.
+    #
+    # Registered outermost of the gem's middlewares (see Engine), so a matching GET
+    # short-circuits before the capture/heartbeat layers and never counts as traffic.
+    # It owns ONLY the two exact paths it knows; every other request passes straight
+    # through.
+    class AssetMiddleware
+      ASSET_DIR = File.expand_path("../../../app/assets/javascripts/dispatch", __dir__).freeze
+
+      # Exact request path => filename. A fixed allowlist (no path joining from the
+      # request) so a crafted PATH_INFO can never traverse out of ASSET_DIR.
+      ASSETS = {
+        "/dispatch/error_tracker.js" => "error_tracker.js",
+        "/dispatch/widget.js"        => "widget.js"
+      }.freeze
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        method = env["REQUEST_METHOD"]
+        filename = (method == "GET" || method == "HEAD") && ASSETS[env["PATH_INFO"]]
+        return @app.call(env) unless filename
+
+        serve(File.join(ASSET_DIR, filename), head: method == "HEAD")
+      end
+
+      private
+
+      def serve(path, head:)
+        body = File.binread(path)
+        # Lowercase header names: Rack 3 requires it, and middleware above us
+        # (Rack::ETag/ConditionalGet) only honors lowercase keys — a capitalized
+        # "Cache-Control" gets silently overridden with Rack's private default.
+        #
+        # Non-digested URL, so don't cache forever — a gem upgrade changes the bytes
+        # at the same path. An hour balances revalidation against churn; the host's
+        # Rack::ETag/ConditionalGet (outside this middleware) adds a content ETag and
+        # turns repeat fetches into 304s for free.
+        headers = {
+          "content-type"   => "text/javascript; charset=utf-8",
+          "cache-control"  => "public, max-age=3600",
+          "content-length" => body.bytesize.to_s
+        }
+        [200, headers, head ? [] : [body]]
+      rescue SystemCallError => e
+        warn "[dispatch-rails] failed to serve #{path}: #{e.class}: #{e.message}"
+        [404, { "content-type" => "text/plain" }, ["Not found"]]
+      end
+    end
+  end
+end

data/lib/dispatch/rails/engine.rb

@@ -23,6 +23,14 @@ module Dispatch
         if defined?(::Importmap) && app.respond_to?(:importmap)
           # Host app can pin "dispatch-widget" / "dispatch-error-tracker" in its importmap.
         end
+
+        # Serve error_tracker.js / widget.js at the /dispatch/<name>.js paths the
+        # view partials import from. Added first (so it's the OUTERMOST of the gem's
+        # middlewares — config.middleware.use appends, and this initializer runs
+        # before the capture/heartbeat ones below), letting a matching GET
+        # short-circuit before those layers. The asset pipeline only ever exposes
+        # these under /assets/..., so without this the import 404s everywhere.
+        app.config.middleware.use Dispatch::Rails::AssetMiddleware
       end
 
       # Server-side exception capture. The middleware is added last (innermost),

data/lib/dispatch/rails/reporting_endpoint_middleware.rb

@@ -57,7 +57,10 @@ module Dispatch
       # A FRESH Rack triple per call — downstream middleware mutates the array and
       # headers, so a shared/frozen response would raise or corrupt across requests.
       def no_content
-        [204, { "Content-Type" => "text/plain" }, []]
+        # Lowercase header name for Rack 3 conformance (it requires lowercase
+        # response header field names; capitalized keys can be dropped by
+        # downstream middleware).
+        [204, { "content-type" => "text/plain" }, []]
       end
 
       def handles?(config, env)

data/lib/dispatch/rails/response_annotator.rb

@@ -16,8 +16,11 @@ module Dispatch
     # never changes the status code, never swallows a propagating exception, and
     # passes through untouched anything it cannot safely parse.
     class ResponseAnnotator
-      HEADER_REQUEST_ID = "X-Dispatch-Request-Id"
-      HEADER_REPORT_URL = "X-Dispatch-Report-Url"
+      # Lowercase header names for Rack 3 conformance. HTTP header names are
+      # case-insensitive to clients, so emitting them lowercase changes nothing
+      # the caller sees, while satisfying Rack 3's lowercase-only requirement.
+      HEADER_REQUEST_ID = "x-dispatch-request-id"
+      HEADER_REPORT_URL = "x-dispatch-report-url"
       BODY_REQUEST_ID   = "dispatch_request_id"
       BODY_REPORT_URL   = "dispatch_report_url"
 
@@ -100,7 +103,7 @@ module Dispatch
       def replace_content_length!(headers, bytesize)
         headers.delete("Content-Length")
         headers.delete("content-length")
-        headers["Content-Length"] = bytesize.to_s
+        headers["content-length"] = bytesize.to_s
       end
     end
   end

data/lib/dispatch/rails/version.rb

@@ -1,5 +1,5 @@
 module Dispatch
   module Rails
-    VERSION = "0.10.0".freeze
+    VERSION = "0.10.1".freeze
   end
 end

data/lib/dispatch-rails.rb

@@ -4,6 +4,7 @@ require "dispatch/rails/event_builder"
 require "dispatch/rails/transport"
 require "dispatch/rails/reporter"
 require "dispatch/rails/middleware"
+require "dispatch/rails/asset_middleware"
 require "dispatch/rails/reporting_endpoint_middleware"
 require "dispatch/rails/response_annotator"
 require "dispatch/rails/heartbeat_aggregator"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dispatch-rails
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.10.1
 platform: ruby
 authors:
 - Dispatch Team
@@ -47,6 +47,7 @@ files:
 - app/views/dispatch/_error_tracker.html.erb
 - app/views/dispatch/_widget.html.erb
 - lib/dispatch-rails.rb
+- lib/dispatch/rails/asset_middleware.rb
 - lib/dispatch/rails/configuration.rb
 - lib/dispatch/rails/engine.rb
 - lib/dispatch/rails/error_subscriber.rb