dispatch-rails 0.9.0 → 0.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 797a73d62a39b0ab3640364d8ef71186b61f3233da2788f7733b72c85e77cc75
-  data.tar.gz: 235fa20b827e25a6f0537e20d3cdd51221c0bebbed18013046901c9bdabf51ed
+  metadata.gz: a712af989dbaa59fcd32135400b74a6ddb41058f291d60dce865516e117a50c6
+  data.tar.gz: 1e1d88267bcffb7177556c6a0dd92c7e9e191356288e647881a1ef04410bbeb3
 SHA512:
-  metadata.gz: f3cbf75d09473580ec5f66ffaaf7d7623631c1a453bbe9b67b86e091e4fbcb56cd7da1ea141080b6375b714802915c00c4fd9f64d7c649bb2de7e6d6b46d1c0b
-  data.tar.gz: f24f36ca5d2769053faa65cb5b77da6e09a28aea5b4e3166bcbb64e2473729cd9b54df4d6936572fe3ecb41937cb5e43e32f0b9de24f2c27b1879532da0232de
+  metadata.gz: 891dee4bfc449f10ba4e4478ebd3fdd695d023f1853179563f63ccbbfa0a67c5431151576b403db02520c6132a0bb0ea6c93d64fe4999bde11006d820c39af26
+  data.tar.gz: f5be0e31f9ecbfce518e7533fc6a483c7bc12bcb5a624aae24a8617666232bf2d7a10f1787367313c7b741bf5ffe88dc07fff8e05bc0805e70012a50c65ef517

data/CHANGELOG.md

@@ -0,0 +1,54 @@
+# Changelog
+
+All notable changes to `dispatch-rails` are documented here. The format is based
+on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
+adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.10.1] - 2026-06-18
+
+### Fixed
+- The browser tracker/widget loaders import a fixed `/dispatch/error_tracker.js`
+  and `/dispatch/widget.js`, but nothing served those exact paths — the asset
+  pipeline only exposes the files under `/assets/...` (digested under Propshaft),
+  so the dynamic `import()` 404'd in every environment and the tracker/widget
+  silently never loaded. A new `AssetMiddleware` now serves both files at the
+  imported paths with a JS content type, requiring no host mount, route, or
+  precompile entry. (The config island stays a non-executable
+  `<script type="application/json">` and the loaders keep their nonce-aware
+  `javascript_tag`, so no CSP nonce is needed for either.)
+
+## [0.10.0] - 2026-06-18
+
+### Added
+- `config.require_authenticated_user` (default `false`): when enabled,
+  `dispatch_widget_tag` renders nothing on requests where the `user` lambda
+  resolves to `nil` or a blank hash. Lets a host app keep the feedback widget
+  off public/unauthenticated pages (home page, EULA, privacy policy) so only
+  signed-in users can submit reports. Off by default to preserve existing
+  behavior — the stock `user` resolver returns `nil`, so defaulting it on would
+  hide the widget for apps that haven't wired up identity.
+
+## [0.9.0]
+
+### Added
+- Capture SolidQueue infrastructure failures (pruned/orphaned jobs, thread
+  crashes, recurring-enqueue misses) that never flow through `Rails.error` or
+  ActiveJob.
+
+## [0.8.1]
+
+### Fixed
+- `ReportingEndpointMiddleware` no longer swallows host-app errors when the
+  browser-reports path is not owned by the gem.
+
+## [0.8.0]
+
+### Added
+- Browser CSP & Reporting-API capture (`capture_csp_violations`,
+  `capture_browser_reports`).
+
+## [0.7.0]
+
+### Added
+- Process-lifecycle capture (crash-at-exit, rake failures, shutdown flush) for
+  Honeybadger parity.

data/README.md

@@ -246,6 +246,22 @@ end
 <% end %>
 ```
 
+### Hiding the widget on public pages
+
+By default the widget renders for everyone, including anonymous visitors. If you
+only want signed-in users to be able to submit reports — keeping the button off
+public surfaces like the home page, EULA, or privacy policy — opt in:
+
+```ruby
+c.require_authenticated_user = true
+```
+
+With this on, `dispatch_widget_tag` returns `nil` (renders nothing) on any
+request where your `user` lambda resolves to `nil` or a blank hash, so make sure
+that lambda is wired up to your auth. It's off by default because the stock
+`user` resolver returns `nil`, and defaulting it on would hide the widget for
+apps that haven't configured identity.
+
 ### Per-page severity / labels
 
 ```erb

data/app/helpers/dispatch/widget_helper.rb

@@ -13,6 +13,11 @@ module Dispatch
       return nil unless config.configured?
 
       user = config.user.respond_to?(:call) ? config.user.call(self) : nil
+      # Hide the widget on unauthenticated pages when the host opts in — keeps
+      # the report button off public surfaces (home page, EULA, …) where there
+      # is no signed-in user to attribute a report to.
+      return nil if config.require_authenticated_user && user.blank?
+
       base_metadata = config.metadata.respond_to?(:call) ? config.metadata.call(self) : {}
 
       page_metadata = base_metadata.to_h.merge(extra_metadata)

data/lib/dispatch/rails/asset_middleware.rb

@@ -0,0 +1,65 @@
+module Dispatch
+  module Rails
+    # Serves the gem's browser JS (error_tracker.js, widget.js) at the stable,
+    # non-digested /dispatch/<name>.js paths the view partials import from.
+    #
+    # The engine also registers the JS directory in config.assets.paths, but the
+    # partials deliberately import a fixed URL (so the inline loader needs no
+    # asset-pipeline lookup) — and the asset pipeline never exposes that exact URL:
+    # Propshaft serves the files under /assets/dispatch/<name>-<digest>.js, Sprockets
+    # under /assets/dispatch/<name>.js, and neither at /dispatch/<name>.js. With
+    # nothing serving that path the import 404s in every environment and the
+    # tracker/widget silently never load. This middleware closes that gap with no
+    # host mount, route, or precompile entry required.
+    #
+    # Registered outermost of the gem's middlewares (see Engine), so a matching GET
+    # short-circuits before the capture/heartbeat layers and never counts as traffic.
+    # It owns ONLY the two exact paths it knows; every other request passes straight
+    # through.
+    class AssetMiddleware
+      ASSET_DIR = File.expand_path("../../../app/assets/javascripts/dispatch", __dir__).freeze
+
+      # Exact request path => filename. A fixed allowlist (no path joining from the
+      # request) so a crafted PATH_INFO can never traverse out of ASSET_DIR.
+      ASSETS = {
+        "/dispatch/error_tracker.js" => "error_tracker.js",
+        "/dispatch/widget.js"        => "widget.js"
+      }.freeze
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        method = env["REQUEST_METHOD"]
+        filename = (method == "GET" || method == "HEAD") && ASSETS[env["PATH_INFO"]]
+        return @app.call(env) unless filename
+
+        serve(File.join(ASSET_DIR, filename), head: method == "HEAD")
+      end
+
+      private
+
+      def serve(path, head:)
+        body = File.binread(path)
+        # Lowercase header names: Rack 3 requires it, and middleware above us
+        # (Rack::ETag/ConditionalGet) only honors lowercase keys — a capitalized
+        # "Cache-Control" gets silently overridden with Rack's private default.
+        #
+        # Non-digested URL, so don't cache forever — a gem upgrade changes the bytes
+        # at the same path. An hour balances revalidation against churn; the host's
+        # Rack::ETag/ConditionalGet (outside this middleware) adds a content ETag and
+        # turns repeat fetches into 304s for free.
+        headers = {
+          "content-type"   => "text/javascript; charset=utf-8",
+          "cache-control"  => "public, max-age=3600",
+          "content-length" => body.bytesize.to_s
+        }
+        [200, headers, head ? [] : [body]]
+      rescue SystemCallError => e
+        warn "[dispatch-rails] failed to serve #{path}: #{e.class}: #{e.message}"
+        [404, { "content-type" => "text/plain" }, ["Not found"]]
+      end
+    end
+  end
+end

data/lib/dispatch/rails/configuration.rb

@@ -10,7 +10,8 @@ module Dispatch
       MODES = %i[widget errors_only].freeze
 
       # Bug-report widget
-      attr_accessor :api_key, :endpoint, :user, :metadata, :capture_console, :capture_clicks, :button_position
+      attr_accessor :api_key, :endpoint, :user, :metadata, :capture_console, :capture_clicks, :button_position,
+                    :require_authenticated_user
       # Mode + API-only context
       attr_accessor :mode, :context, :send_default_params
       # Exception tracking
@@ -38,6 +39,13 @@ module Dispatch
         @capture_console = false
         @capture_clicks = true # track the last few clicks as a "user path" for context
         @button_position = "bottom-right"
+        # Opt-in: hide the widget on requests with no resolved user (the `user`
+        # lambda returned nil/blank). Lets a host app keep the widget off
+        # public/unauthenticated pages — a home page, EULA, privacy policy —
+        # where anyone could otherwise submit a report. Off by default because
+        # the stock `user` resolver returns nil, so defaulting it on would hide
+        # the widget for every app that hasn't wired up identity.
+        @require_authenticated_user = false
 
         # Mode + API-only context
         @mode = :widget

data/lib/dispatch/rails/engine.rb

@@ -23,6 +23,14 @@ module Dispatch
         if defined?(::Importmap) && app.respond_to?(:importmap)
           # Host app can pin "dispatch-widget" / "dispatch-error-tracker" in its importmap.
         end
+
+        # Serve error_tracker.js / widget.js at the /dispatch/<name>.js paths the
+        # view partials import from. Added first (so it's the OUTERMOST of the gem's
+        # middlewares — config.middleware.use appends, and this initializer runs
+        # before the capture/heartbeat ones below), letting a matching GET
+        # short-circuit before those layers. The asset pipeline only ever exposes
+        # these under /assets/..., so without this the import 404s everywhere.
+        app.config.middleware.use Dispatch::Rails::AssetMiddleware
       end
 
       # Server-side exception capture. The middleware is added last (innermost),

data/lib/dispatch/rails/reporting_endpoint_middleware.rb

@@ -57,7 +57,10 @@ module Dispatch
       # A FRESH Rack triple per call — downstream middleware mutates the array and
       # headers, so a shared/frozen response would raise or corrupt across requests.
       def no_content
-        [204, { "Content-Type" => "text/plain" }, []]
+        # Lowercase header name for Rack 3 conformance (it requires lowercase
+        # response header field names; capitalized keys can be dropped by
+        # downstream middleware).
+        [204, { "content-type" => "text/plain" }, []]
       end
 
       def handles?(config, env)

data/lib/dispatch/rails/response_annotator.rb

@@ -16,8 +16,11 @@ module Dispatch
     # never changes the status code, never swallows a propagating exception, and
     # passes through untouched anything it cannot safely parse.
     class ResponseAnnotator
-      HEADER_REQUEST_ID = "X-Dispatch-Request-Id"
-      HEADER_REPORT_URL = "X-Dispatch-Report-Url"
+      # Lowercase header names for Rack 3 conformance. HTTP header names are
+      # case-insensitive to clients, so emitting them lowercase changes nothing
+      # the caller sees, while satisfying Rack 3's lowercase-only requirement.
+      HEADER_REQUEST_ID = "x-dispatch-request-id"
+      HEADER_REPORT_URL = "x-dispatch-report-url"
       BODY_REQUEST_ID   = "dispatch_request_id"
       BODY_REPORT_URL   = "dispatch_report_url"
 
@@ -100,7 +103,7 @@ module Dispatch
       def replace_content_length!(headers, bytesize)
         headers.delete("Content-Length")
         headers.delete("content-length")
-        headers["Content-Length"] = bytesize.to_s
+        headers["content-length"] = bytesize.to_s
       end
     end
   end

data/lib/dispatch/rails/version.rb

@@ -1,5 +1,5 @@
 module Dispatch
   module Rails
-    VERSION = "0.9.0".freeze
+    VERSION = "0.10.1".freeze
   end
 end

data/lib/dispatch-rails.rb

@@ -4,6 +4,7 @@ require "dispatch/rails/event_builder"
 require "dispatch/rails/transport"
 require "dispatch/rails/reporter"
 require "dispatch/rails/middleware"
+require "dispatch/rails/asset_middleware"
 require "dispatch/rails/reporting_endpoint_middleware"
 require "dispatch/rails/response_annotator"
 require "dispatch/rails/heartbeat_aggregator"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dispatch-rails
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.10.1
 platform: ruby
 authors:
 - Dispatch Team
@@ -39,6 +39,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - README.md
 - app/assets/javascripts/dispatch/error_tracker.js
 - app/assets/javascripts/dispatch/widget.js
@@ -46,6 +47,7 @@ files:
 - app/views/dispatch/_error_tracker.html.erb
 - app/views/dispatch/_widget.html.erb
 - lib/dispatch-rails.rb
+- lib/dispatch/rails/asset_middleware.rb
 - lib/dispatch/rails/configuration.rb
 - lib/dispatch/rails/engine.rb
 - lib/dispatch/rails/error_subscriber.rb