fopost-rails 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5959178d911d67f15c611ae03d778c338acb8c90e0f0d40b5b6484ba5b0608c6
-  data.tar.gz: 4ed0650b489d85ad122a10ee30787456eca0606846c8bfcdab4aeb42ccf8fe23
+  metadata.gz: 66538248d3e80cefb4a338b87150c210d74f4cb4beccb9b581b9c17be5ee78ab
+  data.tar.gz: 456c6e82e21492da699bc289602099d11d18b4ce45d55fc6304a9dacb7a5fc1f
 SHA512:
-  metadata.gz: dc18b76fcd3d73197793b2803bd7b427b86d8d9a4e194528c70009b47712841ff8317eeaecb957920506ddea4b9b7200afafe23588a178e7a4e93f997007ad34
-  data.tar.gz: f89fa93ca20e7f221a0e3e7fd90c18dfd9853a4e964b20bfe9ddfdc47a90831212e74232fa130976ca4c2f10610094afae7f8f27d9b76b6078b0cf695607ed8f
+  metadata.gz: 658fe9d5a6693fb5c283362cc468f36f0e674312c1527f2d89984c0743a36c0c9a983c3002ad98043855395e8516f05efaad80e68582ff84b7156fdfcd902422
+  data.tar.gz: 56ee14f403c563b9f78cc3b36a87bd57811ed1716583131612c14b29f7f01eca0e1be025e925d6d90c315967f27273d3306c899383b748a165d7147c5a0116a1

data/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this gem are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the gem follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - 2026-10-18
+
+### Added
+
+- `POST /fopost/articles` on the mounted engine receives the blog's website target. The `fopost`
+  gem verifies the signature; `article.published` reaches `config.on_article_published` and the
+  `fopost.article.published` notification, and a returned URL is echoed as `{ "url": ... }`.
+- `website_secret` setting (`FOPOST_WEBSITE_SECRET`), falling back to `webhook_secret`.
+
+### Changed
+
+- Requires `fopost` `~> 0.3`, now resolved from RubyGems instead of the GitHub source.
+- The README points at `fopost.com/dashboard` instead of the retired app host.
+
 ## [0.1.0] - 2026-08-30
 
 Initial release.
@@ -17,4 +31,5 @@ Initial release.
 - A mountable engine that verifies incoming webhook signatures and republishes them as
   `ActiveSupport::Notifications` events.
 
+[0.2.0]: https://github.com/fopost/fopost-rails/releases/tag/v0.2.0
 [0.1.0]: https://github.com/fopost/fopost-rails/releases/tag/v0.1.0

data/README.md

@@ -36,7 +36,7 @@ bin/rails generate fopost:install
 
 ## Configure
 
-Create an API key at [app.fopost.com/api-keys](https://app.fopost.com/api-keys) and put it
+Create an API key at [fopost.com/dashboard/api-keys](https://fopost.com/dashboard/api-keys) and put it
 somewhere the app can read it:
 
 ```bash
@@ -67,6 +67,7 @@ Every setting resolves the same way — **what you set explicitly wins, then Rai
 | `max_retries` | `max_retries` | `FOPOST_MAX_RETRIES` | `3` |
 | `default_workspace_id` | `default_workspace_id` | `FOPOST_WORKSPACE_ID` | none |
 | `webhook_secret` | `webhook_secret` | `FOPOST_WEBHOOK_SECRET` | none |
+| `website_secret` | `website_secret` | `FOPOST_WEBSITE_SECRET` | falls back to `webhook_secret` |
 | `queue_name` | `queue_name` | `FOPOST_QUEUE` | `default` |
 
 Set them in the initializer:
@@ -88,7 +89,7 @@ config.fopost.default_workspace_id = 'ws_...'
 
 `Fopost::Rails.client` is a configured `Fopost::Client`, memoized and safe to call from any
 thread. The [`fopost` gem README](https://github.com/fopost/fopost-ruby) documents the full
-resource surface — `posts`, `accounts`, `workspaces`, `labels`, `ai`.
+resource surface — `posts`, `accounts`, `workspaces`, `labels`, `ai`, `blog`.
 
 ```ruby
 class PostsController < ApplicationController
@@ -203,6 +204,49 @@ post '/fopost/webhooks',
      }
 ```
 
+## Receive blog articles
+
+The same engine mount also serves `POST /fopost/articles`, the receiver for the blog's **Website**
+target. Set that target to `https://your-app.example/fopost/articles`, copy the website secret it
+shows you once into `config.website_secret`, and hand FoPost a callback:
+
+```ruby
+# config/initializers/fopost.rb
+Fopost::Rails.configure do |config|
+  config.website_secret = Rails.application.credentials.dig(:fopost, :website_secret)
+
+  config.on_article_published = lambda do |article|
+    record = Article.create!(
+      title: article.title,
+      slug: article.slug,
+      body: article.body_html,
+      excerpt: article.excerpt,
+      tags: article.tags,
+      published_at: article.published_at
+    )
+    Rails.application.routes.url_helpers.article_url(record)
+  end
+end
+```
+
+`article` is a `Fopost::BlogArticlePublished` from the `fopost` gem: `title`, `slug`, `excerpt`,
+`meta_title`, `meta_description`, `body_markdown`, `body_html`, `featured_image`, `images`, `tags`,
+`keyword`, `word_count`, `published_at`. Image URLs stay fetchable for six hours, so store your own
+copy. Return the URL the article now lives at and the receiver answers `{ "url": "..." }`; return
+anything else and it answers `{ "ok": true }`.
+
+Prefer events? Every verified `article.published` also fires
+`ActiveSupport::Notifications.instrument('fopost.article.published', ...)` with `:article`, `:data`,
+`:timestamp` and `:delivery_id`, whether or not a callback is set.
+
+Verification is the `fopost` gem's `Fopost::Webhooks.verify`: the timestamped
+`X-FoPost-Signature-256` over the raw body, rejected outside a 300 second window. A bad signature
+is a `401` and the callback never runs; a test delivery (`article.test`) answers `{ "ok": true }`.
+To sign one yourself in a request spec, use `Fopost::Webhooks.sign("#{timestamp}.#{body}", secret)`.
+
+Managing the blog itself (settings, keywords, articles) is `Fopost::Rails.client.blog`, documented
+in the [`fopost` gem README](https://github.com/fopost/fopost-ruby#blog).
+
 ## Testing your app
 
 Swap the client for one wired to your own transport and nothing touches the network:
@@ -223,7 +267,7 @@ separate on purpose and never depend on each other.
 ## Links
 
 - Documentation: [fopost.com/docs](https://fopost.com/docs)
-- API keys: [app.fopost.com/api-keys](https://app.fopost.com/api-keys)
+- API keys: [fopost.com/dashboard/api-keys](https://fopost.com/dashboard/api-keys)
 - The SDK this wraps: [`fopost`](https://github.com/fopost/fopost-ruby)
 - Issues: [github.com/fopost/fopost-rails/issues](https://github.com/fopost/fopost-rails/issues)
 - Support: [fopost.com/contact](https://fopost.com/contact)

data/app/controllers/fopost/rails/articles_controller.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'active_support/notifications'
+
+module Fopost
+  module Rails
+    # Receives the blog's website target: FoPost posts here when an article is
+    # published. The signature is verified by the `fopost` gem over the raw
+    # body; a mismatch is a 401 and nothing runs.
+    #
+    #   # config/initializers/fopost.rb
+    #   config.on_article_published = ->(article) { Article.import!(article).url }
+    #
+    # The callback may return the URL the article now lives at, which is
+    # echoed back as `{ "url": ... }`. `fopost.article.published` also fires as
+    # an ActiveSupport::Notifications event for subscribers.
+    class ArticlesController < ActionController::API
+      def create
+        secret = Fopost::Rails.config.website_secret || Fopost::Rails.config.webhook_secret
+        return head :service_unavailable if secret.nil? || secret.to_s.empty?
+
+        event = Fopost::Webhooks.verify(request.raw_post, request.headers, secret)
+        return render json: { ok: true } unless event.event == 'article.published'
+
+        url = deliver(event)
+        render json: url.is_a?(String) && !url.empty? ? { url: url } : { ok: true }
+      rescue Fopost::WebhookSignatureError
+        head :unauthorized
+      end
+
+      private
+
+      def deliver(event)
+        article = event.article
+        notification = {
+          event: event.event,
+          article: article,
+          data: event.data,
+          timestamp: event.timestamp,
+          delivery_id: request.headers[Fopost::Webhooks::DELIVERY_HEADER]
+        }
+        ActiveSupport::Notifications.instrument('fopost.article.published', notification)
+
+        Fopost::Rails.config.on_article_published&.call(article)
+      end
+    end
+  end
+end

data/config/routes.rb

@@ -2,6 +2,7 @@
 
 Fopost::Rails::Engine.routes.draw do
   post '/webhooks', to: 'webhooks#create', as: :webhooks
+  post '/articles', to: 'articles#create', as: :articles
 
   # So mounting straight onto the endpoint path also works:
   #   mount Fopost::Rails::Engine => '/fopost/webhooks'

data/lib/fopost/rails/configuration.rb

@@ -15,7 +15,7 @@ module Fopost
     #   end
     class Configuration
       SETTINGS = %i[
-        api_key base_url timeout max_retries default_workspace_id webhook_secret queue_name
+        api_key base_url timeout max_retries default_workspace_id webhook_secret website_secret queue_name
       ].freeze
 
       ENV_KEYS = {
@@ -25,6 +25,7 @@ module Fopost
         max_retries: 'FOPOST_MAX_RETRIES',
         default_workspace_id: 'FOPOST_WORKSPACE_ID',
         webhook_secret: 'FOPOST_WEBHOOK_SECRET',
+        website_secret: 'FOPOST_WEBSITE_SECRET',
         queue_name: 'FOPOST_QUEUE'
       }.freeze
 
@@ -37,6 +38,11 @@ module Fopost
 
       attr_writer(*SETTINGS)
 
+      # Called with a Fopost::BlogArticlePublished for every verified
+      # `article.published` delivery. Return the URL the article now lives at
+      # and the receiver echoes it back to FoPost.
+      attr_accessor :on_article_published
+
       def api_key
         resolve(:api_key)
       end
@@ -65,6 +71,12 @@ module Fopost
         resolve(:webhook_secret)
       end
 
+      # The blog's website secret, shown once when the website target is set.
+      # The article receiver falls back to `webhook_secret` when it is unset.
+      def website_secret
+        resolve(:website_secret)
+      end
+
       def queue_name
         resolve(:queue_name)
       end
@@ -83,6 +95,7 @@ module Fopost
       # Drop every explicit value, so the next read falls back again.
       def reset!
         SETTINGS.each { |key| instance_variable_set(:"@#{key}", nil) }
+        @on_article_published = nil
         self
       end
 
@@ -92,7 +105,9 @@ module Fopost
 
       # Keeps the key out of logs and consoles.
       def inspect
-        redacted = to_h.merge(api_key: mask(api_key), webhook_secret: mask(webhook_secret))
+        redacted = to_h.merge(
+          api_key: mask(api_key), webhook_secret: mask(webhook_secret), website_secret: mask(website_secret)
+        )
         "#<Fopost::Rails::Configuration #{redacted.map { |k, v| "#{k}=#{v.inspect}" }.join(' ')}>"
       end
 

data/lib/fopost/rails/version.rb

@@ -2,6 +2,6 @@
 
 module Fopost
   module Rails
-    VERSION = '0.1.0'
+    VERSION = '0.2.0'
   end
 end

data/lib/generators/fopost/install/install_generator.rb

@@ -22,7 +22,7 @@ module Fopost
             bin/rails credentials:edit     # fopost: { api_key: fp_... }
             # or export FOPOST_API_KEY=fp_...
 
-          Create a key at https://app.fopost.com/api-keys.
+          Create a key at https://fopost.com/dashboard/api-keys.
         TEXT
       end
     end

data/lib/generators/fopost/install/templates/fopost.rb.tt

@@ -6,7 +6,7 @@
 # then Rails credentials under `fopost:`, then the environment. Leave a line
 # commented to take the fallback.
 Fopost::Rails.configure do |config|
-  # Create a key at https://app.fopost.com/api-keys.
+  # Create a key at https://fopost.com/dashboard/api-keys.
   # Falls back to credentials `fopost: api_key:`, then ENV['FOPOST_API_KEY'].
   # config.api_key = nil
 
@@ -20,6 +20,13 @@ Fopost::Rails.configure do |config|
   # Shown once, when you create a webhook. Required by the mounted endpoint.
   # config.webhook_secret = nil
 
+  # Shown once, when you set the blog's website target. Used by /fopost/articles;
+  # falls back to webhook_secret.
+  # config.website_secret = nil
+
+  # Receives a Fopost::BlogArticlePublished; return the URL you published it at.
+  # config.on_article_published = ->(article) { Article.import!(article).url }
+
   # ActiveJob queue for PublishJob and CreatePostJob.
   # config.queue_name = 'default'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fopost-rails
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - FoPost
@@ -36,14 +36,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '0.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '0.3'
 - !ruby/object:Gem::Dependency
   name: railties
   requirement: !ruby/object:Gem::Requirement
@@ -74,6 +74,7 @@ files:
 - CHANGELOG.md
 - LICENSE
 - README.md
+- app/controllers/fopost/rails/articles_controller.rb
 - app/controllers/fopost/rails/webhooks_controller.rb
 - config/routes.rb
 - lib/fopost-rails.rb