dispatch-rails 0.10.0 → 0.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0fab7390093499294d3150088b49f04fc9fca920a711b33d1e8455e3a6ad2ea9
-  data.tar.gz: ba51af0c31c876c4d482445cb33353d56f97c5afb2a2dfc07d4a29e06a15d69d
+  metadata.gz: 5f742aa0ca8db65f9db9c6b5a135ae7d926fdf57dffde8d1d011ae3449298d32
+  data.tar.gz: e7b3df1d90a904e8c2383a03d3231c0ff7398b4f269632d697c5d728c42c386a
 SHA512:
-  metadata.gz: dce4062b5290d5a1e82f3c7bdf01d73a279ac4fa01a63431ed2ed3f97e58f2592229fd02d09db26cf811c1a774e2edcadb5ea82d1bb1654b75918d886685c70c
-  data.tar.gz: b7d09382ab99f1962a6ea92007364f5798d7cda3c33f1bd92cc111c6895de49554d655ca9d8b87a2d1978d0812cbf5e29cdc66e4821a766db8e3c8e71e29b11c
+  metadata.gz: b9cb75b00f87e29843b6837051100d1cac96448ab6db77a048837303b62cd98d18a1ab7dac1bd1f25a8f527b17cf644f2dab6ef46a4a62cf7edc88f1b02d71fd
+  data.tar.gz: f409e09011d0492ccf0ea168ac6f89129ee6fcb83431617a5560ea977c1872a4346586996679538db4b14ea3ae50396d95d47df42f4626f77fff59cd3a00d804

data/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to `dispatch-rails` are documented here. The format is based
 on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.2] - 2026-06-18
+
+### Fixed
+- The browser tracker/widget bootstrapped via an **inline** `<script>` (a nonced
+  `javascript_tag` that ran `import("/dispatch/…")`). Inline scripts are fragile
+  under Turbo + CSP — the nonce attribute is blanked after parse and must be
+  re-applied from the `csp-nonce` meta tag on every navigation — so hosts kept
+  seeing `script-src-elem blocked inline`. Both loaders are now plain **external
+  same-origin** `<script type="module" src="/dispatch/…">` tags, which
+  `script-src 'self'` allows outright — no nonce, no `'unsafe-inline'`, no Turbo
+  nonce drift. The nonce is still attached when the host generates one, so strict
+  nonce-only / `strict-dynamic` policies keep working. (`type="module"` also lets
+  the browser de-dupe the load across Turbo navigations via the module map.)
+- Browser CSP/Reporting-API events were attributed to the `/dispatch/reports`
+  endpoint the browser POSTs to, collapsing every violation across the app onto
+  one bogus URL. CSP reports now carry the violation's `document-uri` as the event
+  URL, so the dashboard groups and links them to the page that actually violated.
+
+## [0.10.1] - 2026-06-18
+
+### Fixed
+- The browser tracker/widget loaders import a fixed `/dispatch/error_tracker.js`
+  and `/dispatch/widget.js`, but nothing served those exact paths — the asset
+  pipeline only exposes the files under `/assets/...` (digested under Propshaft),
+  so the dynamic `import()` 404'd in every environment and the tracker/widget
+  silently never loaded. A new `AssetMiddleware` now serves both files at the
+  imported paths with a JS content type, requiring no host mount, route, or
+  precompile entry. (The config island stays a non-executable
+  `<script type="application/json">` and the loaders keep their nonce-aware
+  `javascript_tag`, so no CSP nonce is needed for either.)
+
 ## [0.10.0] - 2026-06-18
 
 ### Added

data/app/views/dispatch/_error_tracker.html.erb

@@ -1,9 +1,9 @@
 <script type="application/json" id="dispatch-error-config"><%= raw error_config_json.gsub("</", "<\\/") %></script>
-<%# nonce: true picks up the host app's CSP nonce; the JSON config island above is non-executable and needs none %>
-<%= javascript_tag type: "module", nonce: true do %>
-  if (!window.__dispatchErrorTrackerLoaded) {
-    import("/dispatch/error_tracker.js").catch(() => {
-      console.error("[dispatch-rails] failed to load error_tracker.js — ensure the engine assets are mounted");
-    });
-  }
-<% end %>
+<%# The config island above is a non-executable application/json data block, so CSP
+    never applies to it. The tracker itself loads as an EXTERNAL same-origin script
+    (served by the engine's AssetMiddleware at this exact path), which script-src
+    'self' allows on its own — no nonce, no 'unsafe-inline', and none of the inline-
+    script-under-Turbo nonce drift that an inline loader is prone to. We still attach
+    the nonce when the host generates one, so strict nonce-only / strict-dynamic
+    policies (where 'self' alone isn't enough) keep working. %>
+<%= tag.script type: "module", src: "/dispatch/error_tracker.js", nonce: content_security_policy_nonce %>

data/app/views/dispatch/_widget.html.erb

@@ -60,12 +60,10 @@
   </div>
 </div>
 
-<%# nonce: true picks up the host app's CSP nonce; omitted when no nonce generator is configured %>
-<%= javascript_tag type: "module", nonce: true do %>
-  if (!window.__dispatchWidgetLoaded) {
-    window.__dispatchWidgetLoaded = true;
-    import("/dispatch/widget.js").catch(() => {
-      console.error("[dispatch-rails] failed to load widget.js — make sure the engine assets are mounted");
-    });
-  }
-<% end %>
+<%# Loaded as an EXTERNAL same-origin module (served by the engine's AssetMiddleware
+    at this exact path), so script-src 'self' allows it without a nonce or
+    'unsafe-inline' — no inline loader to be blocked under script-src-elem. type=module
+    both resolves widget.js's `import "@hotwired/stimulus"` via the host importmap and
+    de-dupes the load across Turbo navigations via the module map. The nonce is
+    attached when the host generates one, for strict nonce-only / strict-dynamic CSPs. %>
+<%= tag.script type: "module", src: "/dispatch/widget.js", nonce: content_security_policy_nonce %>

data/lib/dispatch/rails/asset_middleware.rb

@@ -0,0 +1,65 @@
+module Dispatch
+  module Rails
+    # Serves the gem's browser JS (error_tracker.js, widget.js) at the stable,
+    # non-digested /dispatch/<name>.js paths the view partials import from.
+    #
+    # The engine also registers the JS directory in config.assets.paths, but the
+    # partials deliberately import a fixed URL (so the inline loader needs no
+    # asset-pipeline lookup) — and the asset pipeline never exposes that exact URL:
+    # Propshaft serves the files under /assets/dispatch/<name>-<digest>.js, Sprockets
+    # under /assets/dispatch/<name>.js, and neither at /dispatch/<name>.js. With
+    # nothing serving that path the import 404s in every environment and the
+    # tracker/widget silently never load. This middleware closes that gap with no
+    # host mount, route, or precompile entry required.
+    #
+    # Registered outermost of the gem's middlewares (see Engine), so a matching GET
+    # short-circuits before the capture/heartbeat layers and never counts as traffic.
+    # It owns ONLY the two exact paths it knows; every other request passes straight
+    # through.
+    class AssetMiddleware
+      ASSET_DIR = File.expand_path("../../../app/assets/javascripts/dispatch", __dir__).freeze
+
+      # Exact request path => filename. A fixed allowlist (no path joining from the
+      # request) so a crafted PATH_INFO can never traverse out of ASSET_DIR.
+      ASSETS = {
+        "/dispatch/error_tracker.js" => "error_tracker.js",
+        "/dispatch/widget.js"        => "widget.js"
+      }.freeze
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        method = env["REQUEST_METHOD"]
+        filename = (method == "GET" || method == "HEAD") && ASSETS[env["PATH_INFO"]]
+        return @app.call(env) unless filename
+
+        serve(File.join(ASSET_DIR, filename), head: method == "HEAD")
+      end
+
+      private
+
+      def serve(path, head:)
+        body = File.binread(path)
+        # Lowercase header names: Rack 3 requires it, and middleware above us
+        # (Rack::ETag/ConditionalGet) only honors lowercase keys — a capitalized
+        # "Cache-Control" gets silently overridden with Rack's private default.
+        #
+        # Non-digested URL, so don't cache forever — a gem upgrade changes the bytes
+        # at the same path. An hour balances revalidation against churn; the host's
+        # Rack::ETag/ConditionalGet (outside this middleware) adds a content ETag and
+        # turns repeat fetches into 304s for free.
+        headers = {
+          "content-type"   => "text/javascript; charset=utf-8",
+          "cache-control"  => "public, max-age=3600",
+          "content-length" => body.bytesize.to_s
+        }
+        [200, headers, head ? [] : [body]]
+      rescue SystemCallError => e
+        warn "[dispatch-rails] failed to serve #{path}: #{e.class}: #{e.message}"
+        [404, { "content-type" => "text/plain" }, ["Not found"]]
+      end
+    end
+  end
+end

data/lib/dispatch/rails/engine.rb

@@ -23,6 +23,14 @@ module Dispatch
         if defined?(::Importmap) && app.respond_to?(:importmap)
           # Host app can pin "dispatch-widget" / "dispatch-error-tracker" in its importmap.
         end
+
+        # Serve error_tracker.js / widget.js at the /dispatch/<name>.js paths the
+        # view partials import from. Added first (so it's the OUTERMOST of the gem's
+        # middlewares — config.middleware.use appends, and this initializer runs
+        # before the capture/heartbeat ones below), letting a matching GET
+        # short-circuit before those layers. The asset pipeline only ever exposes
+        # these under /assets/..., so without this the import 404s everywhere.
+        app.config.middleware.use Dispatch::Rails::AssetMiddleware
       end
 
       # Server-side exception capture. The middleware is added last (innermost),

data/lib/dispatch/rails/event_builder.rb

@@ -16,17 +16,23 @@ module Dispatch
       MAX_PARAMS_BYTES    = 8_000
       SAFE_HEADERS        = %w[User-Agent Referer Accept Content-Type Host X-Request-Id].freeze
 
-      def self.call(exception, handled:, env: nil, user: nil, tags: {}, level: "error")
-        new(exception, handled: handled, env: env, user: user, tags: tags, level: level).call
+      def self.call(exception, handled:, env: nil, user: nil, tags: {}, level: "error", request_url: nil)
+        new(exception, handled: handled, env: env, user: user, tags: tags, level: level,
+                       request_url: request_url).call
       end
 
-      def initialize(exception, handled:, env: nil, user: nil, tags: {}, level: "error")
+      def initialize(exception, handled:, env: nil, user: nil, tags: {}, level: "error", request_url: nil)
         @exception = exception
         @handled = handled
         @env = env
         @user = user
         @tags = tags || {}
         @level = level
+        # Override for the event's request URL. A browser report (CSP, NEL, …) is
+        # POSTed to /dispatch/reports, so the env URL is that endpoint, not the page
+        # that violated the policy — the caller passes the report's document-uri here
+        # so the dashboard attributes (and groups) the event to the real page.
+        @request_url_override = request_url
         @source_cache = {}
         @config = Dispatch::Rails.configuration
       end
@@ -221,6 +227,8 @@ module Dispatch
       end
 
       def request_url
+        return @request_url_override if @request_url_override.present?
+
         scheme = @env["rack.url_scheme"] || "http"
         host = @env["HTTP_HOST"] || @env["SERVER_NAME"]
         return nil if host.nil?

data/lib/dispatch/rails/reporter.rb

@@ -21,7 +21,8 @@ module Dispatch
         user = resolve_user(config, env, context)
         tags = merged_tags(config, env, context)
         event = EventBuilder.call(exception, handled: handled, env: env, user: user,
-                                             tags: tags, level: level)
+                                             tags: tags, level: level,
+                                             request_url: context[:request_url])
         event = config.before_send.call(event) if config.before_send.respond_to?(:call)
         return if event.nil?
 

data/lib/dispatch/rails/reporting_endpoint_middleware.rb

@@ -57,7 +57,10 @@ module Dispatch
       # A FRESH Rack triple per call — downstream middleware mutates the array and
       # headers, so a shared/frozen response would raise or corrupt across requests.
       def no_content
-        [204, { "Content-Type" => "text/plain" }, []]
+        # Lowercase header name for Rack 3 conformance (it requires lowercase
+        # response header field names; capitalized keys can be dropped by
+        # downstream middleware).
+        [204, { "content-type" => "text/plain" }, []]
       end
 
       def handles?(config, env)
@@ -97,7 +100,13 @@ module Dispatch
           handled: true, env: env,
           # report-only disposition is monitoring, not a live block — keep it quieter.
           level: fields[:disposition].to_s == "report" ? "info" : "warning",
-          context: { tags: { csp: "true", report_type: "csp-violation" }.merge(fields) }
+          context: {
+            # Attribute the violation to the page it happened on, not to this
+            # /dispatch/reports endpoint the browser POSTed the report to — otherwise
+            # every CSP violation across the app collapses onto one bogus URL.
+            request_url: fields[:document_uri],
+            tags: { csp: "true", report_type: "csp-violation" }.merge(fields)
+          }
         )
       end
 

data/lib/dispatch/rails/response_annotator.rb

@@ -16,8 +16,11 @@ module Dispatch
     # never changes the status code, never swallows a propagating exception, and
     # passes through untouched anything it cannot safely parse.
     class ResponseAnnotator
-      HEADER_REQUEST_ID = "X-Dispatch-Request-Id"
-      HEADER_REPORT_URL = "X-Dispatch-Report-Url"
+      # Lowercase header names for Rack 3 conformance. HTTP header names are
+      # case-insensitive to clients, so emitting them lowercase changes nothing
+      # the caller sees, while satisfying Rack 3's lowercase-only requirement.
+      HEADER_REQUEST_ID = "x-dispatch-request-id"
+      HEADER_REPORT_URL = "x-dispatch-report-url"
       BODY_REQUEST_ID   = "dispatch_request_id"
       BODY_REPORT_URL   = "dispatch_report_url"
 
@@ -100,7 +103,7 @@ module Dispatch
       def replace_content_length!(headers, bytesize)
         headers.delete("Content-Length")
         headers.delete("content-length")
-        headers["Content-Length"] = bytesize.to_s
+        headers["content-length"] = bytesize.to_s
       end
     end
   end

data/lib/dispatch/rails/version.rb

@@ -1,5 +1,5 @@
 module Dispatch
   module Rails
-    VERSION = "0.10.0".freeze
+    VERSION = "0.10.2".freeze
   end
 end

data/lib/dispatch-rails.rb

@@ -4,6 +4,7 @@ require "dispatch/rails/event_builder"
 require "dispatch/rails/transport"
 require "dispatch/rails/reporter"
 require "dispatch/rails/middleware"
+require "dispatch/rails/asset_middleware"
 require "dispatch/rails/reporting_endpoint_middleware"
 require "dispatch/rails/response_annotator"
 require "dispatch/rails/heartbeat_aggregator"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dispatch-rails
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.10.2
 platform: ruby
 authors:
 - Dispatch Team
@@ -47,6 +47,7 @@ files:
 - app/views/dispatch/_error_tracker.html.erb
 - app/views/dispatch/_widget.html.erb
 - lib/dispatch-rails.rb
+- lib/dispatch/rails/asset_middleware.rb
 - lib/dispatch/rails/configuration.rb
 - lib/dispatch/rails/engine.rb
 - lib/dispatch/rails/error_subscriber.rb