flipper-ui 0.21.0 → 0.23.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd4963986e65fb20081d23374099f2a054df7e78a81e2571ad3640831b7d0d81
-  data.tar.gz: b94fc64dcf6752a2951c8c03bd6161c46e4850f206ebb049f4aa8b0a5b20e881
+  metadata.gz: 3a6e8757e6a2726e4cf55323286a04caf186af13c6841a4e8b82b813b3c69f2f
+  data.tar.gz: 9ea49e24c52b723f7385da8c90dcae9daf96bef269f0b0e6066df1bc11065411
 SHA512:
-  metadata.gz: c46dbab449279c506b9d5ce1d2869392b8e4f0f6b8dab59b527b64a2acf25504cb5fb3e8af2e2601176f0f7c026afdf547196d197d4d0cfad0031e8a26f270bc
-  data.tar.gz: 95ed1aefbe02cdac6f8e938107a00a41e2e8754fa20351fa35948942557746d863d542c52b3993846828ce327b52aa4c151e1422997baea0e8099ff4c3580988
+  metadata.gz: c7e435cc10e1b05c2282c022d977666479de870dc14cad3914e19e17acb6eacaf644fe37bf751f2931fb26525079a07b00b374f4815afdd10ab0e4192448ad27
+  data.tar.gz: a3a8fa7a1be586667573b98ee311a157f23591ee4f7bad15b1638aa25a1ec6444f75c909f90cd331d9cd17d8ba8869367755c299a9798e6eedef8583c2833dc7

data/examples/ui/authorization.ru

@@ -5,50 +5,13 @@
 #   http://localhost:9999/
 #
 require 'bundler/setup'
-require "logger"
-
 require "flipper/ui"
 require "flipper/adapters/pstore"
-require "active_support/notifications"
 
 Flipper.register(:admins) { |actor|
   actor.respond_to?(:admin?) && actor.admin?
 }
 
-Flipper.register(:early_access) { |actor|
-  actor.respond_to?(:early?) && actor.early?
-}
-
-# Setup logging of flipper calls.
-if ENV["LOG"] == "1"
-  $logger = Logger.new(STDOUT)
-  require "flipper/instrumentation/log_subscriber"
-  Flipper::Instrumentation::LogSubscriber.logger = $logger
-end
-
-adapter = Flipper::Adapters::PStore.new
-flipper = Flipper.new(adapter, instrumenter: ActiveSupport::Notifications)
-
-Flipper::UI.configure do |config|
-  # config.banner_text = 'Production Environment'
-  # config.banner_class = 'danger'
-  config.feature_creation_enabled = true
-  config.feature_removal_enabled = true
-  # config.show_feature_description_in_list = true
-  config.descriptions_source = lambda do |_keys|
-    {
-      "search_performance_another_long_thing" => "Just to test feature name length.",
-      "gauges_tracking" => "Should we track page views with gaug.es.",
-      "unused" => "Not used.",
-      "suits" => "Are suits necessary in business?",
-      "secrets" => "Secrets are lies.",
-      "logging" => "Log all the things.",
-      "new_cache" => "Like the old cache but newer.",
-      "a/b" => "Why would someone use a slash? I don't know but someone did. Let's make this really long so they regret using slashes. Please don't use slashes.",
-    }
-  end
-end
-
 # Example middleware to allow reading the Flipper UI but nothing else.
 class FlipperReadOnlyMiddleware
   def initialize(app)
@@ -67,18 +30,17 @@ class FlipperReadOnlyMiddleware
 end
 
 # You can uncomment these to get some default data:
-# flipper[:search_performance_another_long_thing].enable
-# flipper[:gauges_tracking].enable
-# flipper[:unused].disable
-# flipper[:suits].enable_actor Flipper::Actor.new('1')
-# flipper[:suits].enable_actor Flipper::Actor.new('6')
-# flipper[:secrets].enable_group :admins
-# flipper[:secrets].enable_group :early_access
-# flipper[:logging].enable_percentage_of_time 5
-# flipper[:new_cache].enable_percentage_of_actors 15
-# flipper["something/slashed"].add
-
-run Flipper::UI.app(flipper) { |builder|
+# Flipper.enable(:search_performance_another_long_thing)
+# Flipper.disable(:gauges_tracking)
+# Flipper.disable(:unused)
+# Flipper.enable_actor(:suits, Flipper::Actor.new('1'))
+# Flipper.enable_actor(:suits, Flipper::Actor.new('6'))
+# Flipper.enable_group(:secrets, :admins)
+# Flipper.enable_percentage_of_time(:logging, 5)
+# Flipper.enable_percentage_of_actors(:new_cache, 15)
+# Flipper.add("a/b")
+
+run Flipper::UI.app { |builder|
   builder.use Rack::Session::Cookie, secret: "_super_secret"
   builder.use FlipperReadOnlyMiddleware
 }

data/examples/ui/basic.ru

@@ -42,16 +42,16 @@ Flipper::UI.configure do |config|
 end
 
 # You can uncomment these to get some default data:
-# flipper[:search_performance_another_long_thing].enable
-# flipper[:gauges_tracking].enable
-# flipper[:unused].disable
-# flipper[:suits].enable_actor Flipper::Actor.new('1')
-# flipper[:suits].enable_actor Flipper::Actor.new('6')
-# flipper[:secrets].enable_group :admins
-# flipper[:secrets].enable_group :early_access
-# flipper[:logging].enable_percentage_of_time 5
-# flipper[:new_cache].enable_percentage_of_actors 15
-# flipper["a/b"].add
+# Flipper.enable(:search_performance_another_long_thing)
+# Flipper.disable(:gauges_tracking)
+# Flipper.disable(:unused)
+# Flipper.enable_actor(:suits, Flipper::Actor.new('1'))
+# Flipper.enable_actor(:suits, Flipper::Actor.new('6'))
+# Flipper.enable_group(:secrets, :admins)
+# Flipper.enable_group(:secrets, :early_access)
+# Flipper.enable_percentage_of_time(:logging, 5)
+# Flipper.enable_percentage_of_actors(:new_cache, 15)
+# Flipper.add("a/b")
 
 run Flipper::UI.app { |builder|
   builder.use Rack::Session::Cookie, secret: "_super_secret"

data/flipper-ui.gemspec

@@ -24,4 +24,5 @@ Gem::Specification.new do |gem|
   gem.add_dependency 'rack-protection', '>= 1.5.3', '< 2.2.0'
   gem.add_dependency 'flipper', "~> #{Flipper::VERSION}"
   gem.add_dependency 'erubi', '>= 1.0.0', '< 2.0.0'
+  gem.add_dependency 'sanitize', '< 7'
 end

data/lib/flipper/ui/action.rb

@@ -3,6 +3,7 @@ require 'flipper/ui/configuration'
 require 'flipper/ui/error'
 require 'erubi'
 require 'json'
+require 'sanitize'
 
 module Flipper
   module UI
@@ -26,6 +27,36 @@ module Flipper
                                              'delete'.freeze,
                                            ]).freeze
 
+      SOURCES = {
+        bootstrap_css: {
+          src: 'https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css'.freeze,
+          hash: 'sha384-B0vP5xmATw1+K9KRQjQERJvTumQW0nPEzvF6L/Z6nronJ3oUOFUFpCjEUQouq2+l'.freeze
+        }.freeze,
+        jquery_js: {
+          src: 'https://code.jquery.com/jquery-3.6.0.slim.js'.freeze,
+          hash: 'sha256-HwWONEZrpuoh951cQD1ov2HUK5zA5DwJ1DNUXaM6FsY='.freeze
+        }.freeze,
+        popper_js: {
+          src: 'https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js'.freeze,
+          hash: 'sha384-ApNbgh9B+Y1QKtv3Rn7W3mgPxhU9K/ScQsAP7hUibX39j7fakFPskvXusvfa0b4Q'.freeze
+        }.freeze,
+        bootstrap_js: {
+          src: 'https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js'.freeze,
+          hash: 'sha384-+YQ4JLhjyBLPDQt//I+STsc9iw4uQqACwlvpslubQzn4u2UU2UFM80nGisd026JF'.freeze
+        }.freeze
+      }.freeze
+      SCRIPT_SRCS = SOURCES.values_at(:jquery_js, :popper_js, :bootstrap_js).map { |s| s[:src] }
+      STYLE_SRCS = SOURCES.values_at(:bootstrap_css).map { |s| s[:src] }
+      CONTENT_SECURITY_POLICY = <<-CSP.delete("\n")
+        default-src 'none';
+        img-src 'self';
+        font-src 'self';
+        script-src 'report-sample' 'self' #{SCRIPT_SRCS.join(' ')};
+        style-src 'self' 'unsafe-inline' #{STYLE_SRCS.join(' ')};
+        style-src-attr 'unsafe-inline' ;
+        style-src-elem 'self' #{STYLE_SRCS.join(' ')};
+      CSP
+
       # Public: Call this in subclasses so the action knows its route.
       #
       # regex - The Regexp that this action should run for.
@@ -130,6 +161,7 @@ module Flipper
       # Returns a response.
       def view_response(name)
         header 'Content-Type', 'text/html'
+        header 'Content-Security-Policy', CONTENT_SECURITY_POLICY
         body = view_with_layout { view_without_layout name }
         halt [@code, @headers, [body]]
       end
@@ -151,7 +183,7 @@ module Flipper
       # location - The String location to set the Location header to.
       def redirect_to(location)
         status 302
-        header 'Location', "#{script_name}#{location}"
+        header 'Location', "#{script_name}#{Rack::Utils.escape_path(location)}"
         halt [@code, @headers, ['']]
       end
 
@@ -207,6 +239,7 @@ module Flipper
       def view(name)
         path = views_path.join("#{name}.erb")
         raise "Template does not exist: #{path}" unless path.exist?
+
         eval(Erubi::Engine.new(path.read, escape: true).src)
       end
 
@@ -237,6 +270,22 @@ module Flipper
       def valid_request_method?
         VALID_REQUEST_METHOD_NAMES.include?(request_method_name)
       end
+
+      def bootstrap_css
+        SOURCES[:bootstrap_css]
+      end
+
+      def bootstrap_js
+        SOURCES[:bootstrap_js]
+      end
+
+      def popper_js
+        SOURCES[:popper_js]
+      end
+
+      def jquery_js
+        SOURCES[:jquery_js]
+      end
     end
   end
 end

data/lib/flipper/ui/actions/actors_gate.rb

@@ -25,19 +25,22 @@ module Flipper
         def post
           feature = flipper[feature_name]
           value = params['value'].to_s.strip
+          values = value.split(UI.configuration.actors_separator).map(&:strip).uniq
 
-          if Util.blank?(value)
-            error = Rack::Utils.escape("#{value.inspect} is not a valid actor value.")
+          if values.empty?
+            error = "#{value.inspect} is not a valid actor value."
             redirect_to("/features/#{feature.key}/actors?error=#{error}")
           end
 
-          actor = Flipper::Actor.new(value)
+          values.each do |value|
+            actor = Flipper::Actor.new(value)
 
-          case params['operation']
-          when 'enable'
-            feature.enable_actor actor
-          when 'disable'
-            feature.disable_actor actor
+            case params['operation']
+            when 'enable'
+              feature.enable_actor actor
+            when 'disable'
+              feature.disable_actor actor
+            end
           end
 
           redirect_to("/features/#{feature.key}")

data/lib/flipper/ui/actions/features.rb

@@ -49,14 +49,14 @@ module Flipper
           value = params['value'].to_s.strip
 
           if Util.blank?(value)
-            error = Rack::Utils.escape("#{value.inspect} is not a valid feature name.")
+            error = "#{value.inspect} is not a valid feature name."
             redirect_to("/features/new?error=#{error}")
           end
 
           feature = flipper[value]
           feature.add
 
-          redirect_to "/features/#{Rack::Utils.escape_path(value)}"
+          redirect_to "/features/#{value}"
         end
       end
     end

data/lib/flipper/ui/actions/file.rb

@@ -5,7 +5,7 @@ module Flipper
   module UI
     module Actions
       class File < UI::Action
-        route %r{(images|css|js|octicons)/.*\Z}
+        route %r{(images|css|js)/.*\Z}
 
         def get
           Rack::File.new(public_path).call(request.env)

data/lib/flipper/ui/actions/groups_gate.rb

@@ -35,7 +35,7 @@ module Flipper
 
             redirect_to("/features/#{feature.key}")
           else
-            error = Rack::Utils.escape("The group named #{value.inspect} has not been registered.")
+            error = "The group named #{value.inspect} has not been registered."
             redirect_to("/features/#{feature.key}/groups?error=#{error}")
           end
         end

data/lib/flipper/ui/actions/percentage_of_actors_gate.rb

@@ -16,7 +16,7 @@ module Flipper
           begin
             feature.enable_percentage_of_actors params['value']
           rescue ArgumentError => exception
-            error = Rack::Utils.escape("Invalid percentage of actors value: #{exception.message}")
+            error = "Invalid percentage of actors value: #{exception.message}"
             redirect_to("/features/#{@feature.key}?error=#{error}")
           end
 

data/lib/flipper/ui/actions/percentage_of_time_gate.rb

@@ -16,7 +16,7 @@ module Flipper
           begin
             feature.enable_percentage_of_time params['value']
           rescue ArgumentError => exception
-            error = Rack::Utils.escape("Invalid percentage of time value: #{exception.message}")
+            error = "Invalid percentage of time value: #{exception.message}"
             redirect_to("/features/#{@feature.key}?error=#{error}")
           end
 

data/lib/flipper/ui/configuration.rb

@@ -44,6 +44,11 @@ module Flipper
       # Default false. Only works when using descriptions.
       attr_accessor :show_feature_description_in_list
 
+      # Public: What should be used to denote you are trying to add multiple
+      # actors at once (instead of just a single actor).
+      # Default is comma ",".
+      attr_accessor :actors_separator
+
       VALID_BANNER_CLASS_VALUES = %w(
         danger
         dark
@@ -68,6 +73,7 @@ module Flipper
         @add_actor_placeholder = "a flipper id"
         @descriptions_source = DEFAULT_DESCRIPTIONS_SOURCE
         @show_feature_description_in_list = false
+        @actors_separator = ','
       end
 
       def using_descriptions?

data/lib/flipper/ui/decorators/feature.rb

@@ -23,11 +23,11 @@ module Flipper
         def color_class
           case feature.state
           when :on
-            'text-success'
+            'bg-success'
           when :off
-            'text-danger'
+            'bg-danger'
           when :conditional
-            'text-warning'
+            'bg-warning'
           end
         end
 

data/lib/flipper/ui/middleware.rb

@@ -12,6 +12,7 @@ module Flipper
       def initialize(app, options = {})
         @app = app
         @env_key = options.fetch(:env_key, 'flipper')
+        @flipper = options.fetch(:flipper) { Flipper }
 
         @action_collection = ActionCollection.new
 
@@ -43,7 +44,7 @@ module Flipper
         if action_class.nil?
           @app.call(env)
         else
-          flipper = env.fetch(@env_key)
+          flipper = env.fetch(@env_key) { Flipper }
           action_class.run(flipper, request)
         end
       end

data/lib/flipper/ui/public/css/application.css

@@ -29,3 +29,10 @@ html {
 .toggle-on .toggle-block-when-off {
   display: none;
 }
+
+.status {
+  height: 10px;
+  width: 10px;
+  border-radius: 50%;
+  display: inline-block;
+}

data/lib/flipper/ui/views/add_actor.erb

@@ -8,7 +8,7 @@
   <h4 class="card-header">Enable Actor for <%= @feature.key %></h4>
   <div class="card-body">
     <p>
-      Turn on this feature for an individual actor.
+      Turn on this feature for actors.
     </p>
     <form action="<%= script_name %>/features/<%= @feature.key %>/actors" method="post" class="form-inline">
       <%== csrf_input_tag %>

data/lib/flipper/ui/views/feature.erb

@@ -9,7 +9,7 @@
     <div class="col">
       <div class="card">
         <div class="card-body">
-          <%= @feature.description %>
+          <%== Sanitize.fragment(@feature.description, Sanitize::Config::BASIC) %>
         </div>
       </div>
     </div>
@@ -21,7 +21,7 @@
     <div class="card">
       <%# Gate State Header %>
       <div class="card-header">
-        <span class="octicon octicon-squirrel <%= @feature.color_class %> mr-2"></span>
+        <span class="status <%= @feature.color_class %> mr-2"></span>
         <%= @feature.gate_state_title %>
       </div>
 
@@ -69,8 +69,8 @@
                   <%== csrf_input_tag %>
                   <input type="hidden" name="operation" value="disable">
                   <input type="hidden" name="value" value="<%= item %>">
-                  <button type="submit" value="Disable" class="btn btn-link btn-sm text-danger" data-toggle="tooltip" title="Disable <%= item %>" data-placement="left">
-                    <span class="octicon octicon-trashcan"></span>
+                  <button type="submit" value="Disable" class="btn btn-outline-danger" data-toggle="tooltip" title="Disable <%= item %>" data-placement="left">
+                    Remove
                   </button>
                 </form>
               </div>
@@ -130,8 +130,8 @@
                   <%== csrf_input_tag %>
                   <input type="hidden" name="operation" value="disable">
                   <input type="hidden" name="value" value="<%= item %>">
-                  <button type="submit" value="Disable" class="btn btn-link btn-sm text-danger" data-toggle="tooltip" title="Disable <%= item %>" data-placement="left">
-                    <span class="octicon octicon-trashcan"></span>
+                  <button type="submit" value="Disable" class="btn btn-outline-danger" data-toggle="tooltip" title="Disable <%= item %>" data-placement="left">
+                    Remove
                   </button>
                 </form>
               </div>

data/lib/flipper/ui/views/features.erb

@@ -40,14 +40,14 @@
       <% @features.each do |feature| %>
         <div class="feature row align-items-center mt-0 px-3 border-bottom">
           <div class="col-1 col-md-auto">
-            <span class="octicon octicon-squirrel <%= feature.color_class %>" data-toggle="tooltip" title=<%= feature.state.to_s.capitalize %>></span>
+            <span class="status <%= feature.color_class %>" data-toggle="tooltip" title=<%= feature.state.to_s.capitalize %>></span>
           </div>
           <div class="col-10">
             <a href="<%= "#{script_name}/features/#{feature.key}" %>" class="d-block px-0 py-3 btn text-left text-dark">
               <div class="text-truncate" style="font-weight: 500"><%= feature.key %></div>
               <% if Flipper::UI.configuration.show_feature_description_in_list? && Flipper::UI::Util.present?(feature.description) %>
                 <div class="text-muted font-weight-light" style="line-height: 1.4; white-space: initial; padding: 8px 0">
-                  <%= feature.description %>
+                  <%== Sanitize.fragment(feature.description, Sanitize::Config::BASIC) %>
                 </div>
               <% end %>
               <div class="text-muted text-truncate">

data/lib/flipper/ui/views/layout.erb

@@ -6,15 +6,14 @@
     <meta http-equiv="X-UA-Compatible" content="IE=edge">
     <meta name="viewport" content="width=device-width, initial-scale=1">
 
-    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css" integrity="sha384-Gn5384xqQ1aoWXA+058RXPxPg6fy4IWvTNh0E263XmFcJlSAwiGgFAW/dAiS6JXm" crossorigin="anonymous">
-    <link rel="stylesheet" href="<%= script_name %>/octicons/octicons.css">
+    <link rel="stylesheet" href="<%= bootstrap_css[:src] %>" integrity="<%= bootstrap_css[:hash] %>" crossorigin="anonymous">
     <link rel="stylesheet" href="<%= script_name %>/css/application.css">
   </head>
   <body class="py-4">
     <div class="container mw-600">
       <%- unless Flipper::UI.configuration.banner_text.nil? -%>
         <div class="alert alert-<%= Flipper::UI.configuration.banner_class %> text-center font-weight-bold">
-          <%= Flipper::UI.configuration.banner_text %>
+          <%== Sanitize.fragment(Flipper::UI.configuration.banner_text, Sanitize::Config::BASIC) %>
         </div>
       <%- end -%>
 
@@ -52,9 +51,9 @@
       <% end %>
     </div>
 
-    <script src="https://code.jquery.com/jquery-3.2.1.slim.min.js" integrity="sha384-KJ3o2DKtIkvYIK3UENzmM7KCkRr/rE9/Qpg6aAZGJwFDMVNA/GpGFF93hXpG5KkN" crossorigin="anonymous"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js" integrity="sha384-ApNbgh9B+Y1QKtv3Rn7W3mgPxhU9K/ScQsAP7hUibX39j7fakFPskvXusvfa0b4Q" crossorigin="anonymous"></script>
-    <script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js" integrity="sha384-JZR6Spejh4U02d8jOt6vLEHfe/JQGiRRSQQxSfFWpi1MquVdAyjUar5+76PVCmYl" crossorigin="anonymous"></script>
+    <script src="<%= jquery_js[:src] %>" integrity="<%= jquery_js[:hash] %>" crossorigin="anonymous"></script>
+    <script src="<%= popper_js[:src] %>" integrity="<%= popper_js[:hash] %>" crossorigin="anonymous"></script>
+    <script src="<%= bootstrap_js[:src] %>" integrity="<%= bootstrap_js[:hash] %>" crossorigin="anonymous"></script>
     <script src="<%= script_name %>/js/application.js"></script>
   </body>
 </html>

data/lib/flipper/ui.rb

@@ -39,14 +39,14 @@ module Flipper
     def self.app(flipper = nil, options = {})
       env_key = options.fetch(:env_key, 'flipper')
       rack_protection_options = options.fetch(:rack_protection, use: :authenticity_token)
+
       app = ->(_) { [200, { 'Content-Type' => 'text/html' }, ['']] }
       builder = Rack::Builder.new
       yield builder if block_given?
       builder.use Rack::Protection, rack_protection_options
       builder.use Rack::MethodOverride
       builder.use Flipper::Middleware::SetupEnv, flipper, env_key: env_key
-      builder.use Flipper::Middleware::Memoizer, env_key: env_key
-      builder.use Flipper::UI::Middleware, env_key: env_key
+      builder.use Flipper::UI::Middleware, flipper: flipper, env_key: env_key
       builder.run app
       klass = self
       builder.define_singleton_method(:inspect) { klass.inspect } # pretty rake routes output

data/lib/flipper/version.rb

@@ -1,3 +1,3 @@
 module Flipper
-  VERSION = '0.21.0'.freeze
+  VERSION = '0.23.0'.freeze
 end

data/spec/flipper/ui/action_spec.rb

@@ -1,5 +1,3 @@
-require 'helper'
-
 RSpec.describe Flipper::UI::Action do
   describe 'request methods' do
     let(:action_subclass) do