glib-web 6.9.3 → 6.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: be34b6a047f58554b81fa3f72658076bcdefc2e06ec5b9d34f64a48208307ad2
-  data.tar.gz: b9daa421b06c9d995534d88ff8a7cc11024ca59291f67ceaaae4d96c7d2e7bed
+  metadata.gz: ebde832f6f50b0556f57e6b2d716d7315fa01c0def0b75953f8ecf5de60ca547
+  data.tar.gz: 4d217bd99f1a415bca302a08528a1da652788fc5cca031009e132079d2716381
 SHA512:
-  metadata.gz: 64e8c8220a4e59a60f6909f389dc7a1c2c0ed3e9086eb3ed4c6e8df979cdf2c87e8620dc79b75bb48eab574733a31f2787ad7bb4d281f4890e7d3feb592aab08
-  data.tar.gz: 8331b3ed70b4c3dd56dab59a9fcfaf9e59ef4fde9a1daf7c61a728598585685c7a0700ef4ebe9200bd9080dcd039d61d99358a4e623b3e739e47649dc83d704d
+  metadata.gz: bb08b62b519b2a2cfc7c9b1767fce93c4373b63b43082715211d44d051a58aafa5e94d4d5509fd907e86a2b0f6a4ce9c35ec7842ce29d2d21993cadcdf044796
+  data.tar.gz: 715c3de7e58cfa4a443cc73b75b5c3d6a47bc5e9eff3eeb5cd812d119e0dff76e5c14832163abeb9ce891ea5c12b4922918b6133aa90a2848ff31fa49f40e664

data/app/controllers/concerns/glib/auth/policy.rb

@@ -22,7 +22,11 @@ module Glib::Auth
       # - Need to find a solution where we can reuse a single public policy
       # after_action :verify_authorized
 
-      helper_method :policy, :can?, :cannot?
+      # Guarded because not every includer has `helper_method`: ActionController::Base
+      # does, but bare ActionController::API does not (gems like jbuilder may include
+      # ActionController::Helpers into it in a booted app, and a plain non-controller
+      # class never has it). Same guard Pundit's own included block uses.
+      helper_method :policy, :can?, :cannot? if respond_to?(:helper_method)
     end
 
     def assert_current_user_present

data/app/controllers/concerns/glib/auth/token_authenticatable.rb

@@ -0,0 +1,37 @@
+module Glib::Auth
+  # Bearer-token authentication for machine-facing APIs. The token's storage column and
+  # the user model are app-specific, so the lookup is a template method the app's base
+  # controller implements (return the user for a valid token, nil otherwise).
+  module TokenAuthenticatable
+    extend ActiveSupport::Concern
+
+    # Public to mirror the browser side, where Devise's current_user is public: glib
+    # hands policies the controller (Glib::ApplicationPolicy#controller), and host-app
+    # policies call these with an EXPLICIT receiver (`controller.current_user`,
+    # `delegate :user_signed_in?, to: :controller`). A private current_user would raise
+    # NoMethodError on the API line only -- the two surfaces must behave the same.
+    def current_user
+      @current_user
+    end
+
+    # Provided by Devise's helpers on the browser side; defined here so glib policies
+    # that delegate it to the controller work unchanged on API controllers.
+    def user_signed_in?
+      current_user.present?
+    end
+
+    private
+      def authenticate_api_token!
+        token = request.headers['Authorization'].to_s.sub(/\ABearer\s+/i, '')
+        @current_user = glib_find_user_by_api_token(token) if token.present?
+        return if @current_user
+
+        render json: { error: 'unauthorized' }, status: :unauthorized
+      end
+
+      # App implements: return the user for a valid token, nil otherwise.
+      def glib_find_user_by_api_token(_token)
+        raise NotImplementedError, "#{self.class} must define glib_find_user_by_api_token(token)"
+      end
+  end
+end

data/app/controllers/glib/api_controller.rb

@@ -0,0 +1,52 @@
+# The ApplicationController analog for agent- or machine-facing JSON APIs.
+#
+# Posture (do not re-derive it from a sibling app):
+# - The Bearer token IS the credential; possession decides authentication. There is
+#   deliberately no cookie/session path in: ActionController::API has no CSRF protection,
+#   so a cookie-authenticated write endpoint here would be a CSRF target. Do not add one.
+# - Authorization works exactly as on the browser side: policies decide, one per resource,
+#   derived by `glib_authorize_resource` from the controller name (override with
+#   `class:` when the derived name is wrong, as on any glib controller).
+# - Every subclass defines `glib_load_resource` (glib has no default) and is covered by a
+#   policy, including index-only controllers (define it as a no-op there).
+# - Opt OUT of authentication with `skip_before_action :authenticate_api_token!` for a
+#   public endpoint; never opt in ad hoc.
+#
+# Callback order is declaration order and is load-bearing:
+#   authenticate_api_token! -> glib_load_resource -> glib_authorize_resource
+# Token auth is declared before glib_auth_init so no request can reach record loading or
+# authorization unauthenticated. Keep the includes in that order in subclasses too.
+#
+# Unhandled exceptions keep Rails' default error body, which is HTML in development
+# unless the app is api-only. Consumers wanting JSON there should set
+# `config.debug_exception_response_format = :api` or add their own
+# `rescue_from` (the browser side's json_libs_rescue_500 does this for the same reason).
+class Glib::ApiController < ActionController::API
+  include Glib::Auth::TokenAuthenticatable
+  before_action :authenticate_api_token!
+
+  include Glib::Auth::Policy
+  glib_auth_init
+
+  rescue_from ActiveRecord::RecordNotFound do
+    render json: { error: 'not found' }, status: :not_found
+  end
+
+  rescue_from ActiveRecord::RecordInvalid do |e|
+    render json: { errors: e.record.errors }, status: :unprocessable_entity
+  end
+
+  rescue_from ActionController::ParameterMissing do
+    render json: { error: 'bad request' }, status: :bad_request
+  end
+
+  # The parent class, not Glib::Auth::Policy::UnauthorizedError: this covers both glib's
+  # raise sites (the subclass) and Pundit's own authorize(), which raises the parent --
+  # otherwise a consumer calling authorize() would get a 500 instead of JSON.
+  rescue_from Pundit::NotAuthorizedError do
+    # Token auth halts unauthenticated requests earlier, so this is normally 403;
+    # keep the 401 branch so the class is safe if a subclass skips token auth.
+    status = current_user ? :forbidden : :unauthorized
+    render json: { error: status.to_s }, status: status
+  end
+end

data/lib/glib/test/full_suite_rubocop.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require 'English'
+
+module Glib
+  module Test
+    # Suite-wide RuboCop auto-remediation, lifted from the per-project
+    # `test/linters/rubocop_test.rb` convention (originated in neowork-str) so
+    # projects get it from the gem via a CONSCIOUS opt-in: include
+    # Glib::Test::RubocopGuards once in the test setup. Never auto-require
+    # this from Glib::TestHelpers — that would enable a file-rewriting test
+    # in every project without a decision. It lints the WHOLE repo, so files
+    # nobody touches cannot silently accumulate offenses.
+    #
+    # Runs `rubocop -a` (safe autocorrect), which REWRITES files on disk to
+    # fix offenses, then asserts nothing remains AND nothing was rewritten.
+    # The mutation is deliberate (the repo's auto-remediation convention —
+    # i18n-tasks normalize runs the same way): a run that dirties a file is
+    # reported as a FAILURE so the rewrite cannot go unnoticed — that is the
+    # drift signal. Do NOT strip the `-a`; review the diff, keep the corrected
+    # output, and re-run. If a long-passing test suddenly breaks, investigate
+    # WHY first: usually a non-canonical file was committed, or a rubocop
+    # version bump changed a cop's rules.
+    #
+    # It self-registers with Minitest, so it runs on EVERY `rails test`
+    # invocation, single-file runs included. That is cheap on purpose: RuboCop
+    # caches per-file results, so a full-repo run on an unchanged tree costs
+    # about a second on a mid-size app.
+    #
+    # Deliberately does NOT skip under ENV['CI']: the local rails-test
+    # wrapper sets CI=true, and skipping here would silence this layer
+    # exactly where it runs. Opt out per-run with SKIP_FULL_SUITE_RUBOCOP=1.
+    class FullSuiteRubocop < ::ActiveSupport::TestCase
+      # `--format simple` offense lines: "C:  12:  3: [Correctable] Cop/Name: message"
+      # (line/column right-aligned to width 3, so the padding is 0-2 spaces).
+      OFFENSE_LINE = /^[A-Z]: *\d+: *\d+: /
+
+      def test_rubocop_autocorrect_then_clean
+        skip 'opted out via SKIP_FULL_SUITE_RUBOCOP' if ENV['SKIP_FULL_SUITE_RUBOCOP'] == '1'
+
+        # `scrub`: stderr is merged in, and one invalid byte would turn the
+        # scans below into an ArgumentError instead of a lint failure.
+        output = `bundle exec rubocop -a --format simple 2>&1`.scrub
+        clean = $CHILD_STATUS.success?
+
+        # Three distinct outcomes hide in one output, and each needs a
+        # different action — the message must say which, or an agent told
+        # only "offenses detected" reaches for a `rubocop:disable`:
+        #   [Corrected]   -a already rewrote it on disk (exit 0 if that's all)
+        #   [Correctable] survived -a because only the UNSAFE -A can fix it
+        #   neither       no autocorrect exists — semantic, read the cop
+        # Counted on the offense LINES only, so a cop message that happens to
+        # contain a marker cannot shift a bucket.
+        offenses = output.lines.grep(OFFENSE_LINE)
+        corrected = offenses.count { |line| line.include?('[Corrected]') }
+        unsafe = offenses.count { |line| line.include?('[Correctable]') }
+        semantic = offenses.size - corrected - unsafe
+
+        # A Proc message is built only on failure (Minitest calls it lazily).
+        assert(clean && corrected.zero?, -> { failure_message(output, corrected: corrected, unsafe: unsafe, semantic: semantic) })
+      end
+
+      private
+        def failure_message(output, corrected:, unsafe:, semantic:)
+          parts = []
+          if corrected.positive?
+            parts << "`rubocop -a` REWROTE #{corrected} offense(s) on disk (the [Corrected] lines below). That is the " \
+                     'drift signal, not a problem with this test: review `git diff`, keep the corrected output, ' \
+                     'and re-run — do not strip the -a.'
+          end
+          if unsafe.positive?
+            parts << "#{unsafe} offense(s) marked [Correctable] survived `-a` because their fix is UNSAFE: apply it " \
+                     'with `rubocop -A <file>` only after checking what it changes, or fix by hand.'
+          end
+          if semantic.positive?
+            parts << "#{semantic} offense(s) have NO autocorrect, so they are semantic, not mechanical: fix each the " \
+                     "way the cop's own message prescribes — DevDoc cops name their prescribed alternative in the " \
+                     "offense itself (full docs: the dev-doc repo's docs/cops/). A `rubocop:disable` is only for " \
+                     "the case a cop's own doc calls genuinely unavoidable; disables already present in a file are " \
+                     'narrow exceptions, not precedent.'
+          end
+          parts << 'RuboCop did not finish cleanly (see output below).' if parts.empty?
+          "#{parts.join("\n\n")}\n\n#{output}"
+        end
+    end
+  end
+end

data/lib/glib/test/rubocop_guards.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Glib
+  module Test
+    # Conscious opt-in for the suite-time RuboCop guard. Including this module
+    # ONCE in the project's test setup IS the project's explicit decision to
+    # run it. It must stay a separate include precisely because
+    # Glib::TestHelpers is mixed in for unrelated reasons (crawlers, travel
+    # helpers): auto-requiring the guard from there would enable it without
+    # any conscious decision, and FullSuiteRubocop runs `rubocop -a`, which
+    # REWRITES files on disk.
+    #
+    #   class ActiveSupport::TestCase
+    #     include Glib::Test::RubocopGuards # opts in: full-suite `rubocop -a`
+    #   end
+    #
+    # This module is defined as soon as the gem loads (glib/test_helpers
+    # requires it at file level), so the include works on its own — in
+    # ActiveSupport::TestCase or in a single test class — with no ordering
+    # dependency on Glib::TestHelpers.
+    #
+    # What the include switches on: Glib::Test::FullSuiteRubocop — `rubocop -a`
+    # over the whole repo on every `rails test` invocation, failing when
+    # anything was rewritten or remains (runs under CI too).
+    #
+    # MIGRATION NOTE: in the published releases before this change (6.9.3 and
+    # earlier as released), Glib::TestHelpers auto-required a report-only
+    # ChangedFilesRubocop guard (working-tree edits only, skipped under CI),
+    # so every project had it without asking. That guard is retired:
+    # FullSuiteRubocop is a superset, and the local rails-test wrapper sets
+    # CI=true, where the old guard never ran anyway. A project bumping to the
+    # first release that contains this change must add the include line above
+    # or it silently has no suite-time RuboCop guard at all.
+    module RubocopGuards
+      extend ActiveSupport::Concern
+
+      included do
+        require 'glib/test/full_suite_rubocop'
+      end
+    end
+  end
+end

data/lib/glib/test_helpers.rb

@@ -1,15 +1,18 @@
+# The suite-time RuboCop guard (FullSuiteRubocop) is NOT auto-loaded by this
+# module: it runs `rubocop -a` and rewrites files, so switching it on is a
+# conscious per-project opt-in (`include Glib::Test::RubocopGuards`). Requiring
+# rubocop_guards here only DEFINES that inert module — nothing runs until a
+# project explicitly includes it — and doing so at file level (this file is
+# required when the gem loads) means the include works anywhere, with no
+# dependency on Glib::TestHelpers being included first.
+require 'glib/test/rubocop_guards'
+
 module Glib
   module TestHelpers
     extend ActiveSupport::Concern
 
     included do
       extend ClassMethods
-
-      # Auto-load ChangedFilesRubocop only when this module is mixed into a
-      # test class. AllHelpers also includes Glib::TestHelpers into view
-      # helper modules in production controllers; in that context
-      # ActiveSupport::TestCase is not loaded, so we skip the require.
-      require 'glib/test/changed_files_rubocop' if defined?(::ActiveSupport::TestCase)
     end
 
     module ClassMethods

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 6.9.3
+  version: 6.10.0
 platform: ruby
 authors:
 - ''
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-29 00:00:00.000000000 Z
+date: 2026-09-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activestorage
@@ -205,6 +205,7 @@ files:
 - app/controllers/concerns/glib/analytics/funnel.rb
 - app/controllers/concerns/glib/auth/policy.rb
 - app/controllers/concerns/glib/auth/response.rb
+- app/controllers/concerns/glib/auth/token_authenticatable.rb
 - app/controllers/concerns/glib/form_stepper/controller.rb
 - app/controllers/concerns/glib/form_stepper/step.rb
 - app/controllers/concerns/glib/json/dynamic_text.rb
@@ -215,6 +216,7 @@ files:
 - app/controllers/concerns/glib/json/ui.rb
 - app/controllers/concerns/glib/json/validation.rb
 - app/controllers/concerns/glib/params/allowlist.rb
+- app/controllers/glib/api_controller.rb
 - app/controllers/glib/blob_url_generators_controller.rb
 - app/controllers/glib/errors_controller.rb
 - app/controllers/glib/glib_direct_uploads_controller.rb
@@ -595,8 +597,9 @@ files:
 - lib/glib/rubocop/cops/localize.rb
 - lib/glib/rubocop/cops/test_name_parentheses.rb
 - lib/glib/snapshot.rb
-- lib/glib/test/changed_files_rubocop.rb
+- lib/glib/test/full_suite_rubocop.rb
 - lib/glib/test/parallel_coverage.rb
+- lib/glib/test/rubocop_guards.rb
 - lib/glib/test_helpers.rb
 - lib/glib/time_freezable_mailer.rb
 - lib/glib/time_returning_mailer.rb

data/lib/glib/test/changed_files_rubocop.rb

@@ -1,55 +0,0 @@
-# frozen_string_literal: true
-
-require 'English'
-require 'shellwords'
-
-module Glib
-  module Test
-    # Fast RuboCop guard for the subset-run workflow.
-    #
-    # Lives in glib-web's test helper so any project that includes
-    # `Glib::TestHelpers` into `ActiveSupport::TestCase` picks it up. Minitest
-    # runs all loaded test classes on every invocation, so this fires on every
-    # `rails test` — but it lints ONLY the files you have changed in the
-    # working tree (unstaged + staged + untracked). That keeps it fast and
-    # fails the run the moment an edited file has an offense.
-    #
-    # Skip with `SKIP_CHANGED_RUBOCOP=1` during tight debug loops. Auto-skips
-    # on CI because gem caches put thousands of vendored `.rb` files into the
-    # working tree (the "working-tree diff == your edits" premise breaks).
-    class ChangedFilesRubocop < ::ActiveSupport::TestCase
-      # Extensions RuboCop targets by default (see its AllCops/Include). We
-      # rely on `--force-exclusion` to honour the project's AllCops/Exclude.
-      RUBOCOP_EXTENSIONS = %w[.rb .rake .jbuilder .gemspec].freeze
-
-      def test_changed_files_are_rubocop_clean
-        skip 'opted out via SKIP_CHANGED_RUBOCOP' if ENV['SKIP_CHANGED_RUBOCOP'] == '1'
-        skip 'CI lints every file separately; this guard is for local working-tree edits' if ENV['CI']
-
-        files = changed_ruby_files
-        # IMPORTANT: never call rubocop with zero paths — it would lint the whole repo.
-        skip 'no changed Ruby files in the working tree' if files.empty?
-
-        output = `bundle exec rubocop --force-exclusion --format simple #{files.shelljoin} 2>&1`
-
-        assert(
-          $CHILD_STATUS.success?,
-          'RuboCop offenses in files you changed (fix them with `rubocop -a`):' \
-          "\n\n#{output}"
-        )
-      end
-
-      private
-        def changed_ruby_files
-          # `git status --porcelain` covers unstaged, staged, and untracked in
-          # one spawn. Each line is `XY PATH` (or `XY ORIG -> PATH` for
-          # renames); PATH starts at index 3. Deleted files are dropped by the
-          # File.file? check below (no on-disk entry to lint).
-          `git status --porcelain`
-            .split("\n")
-            .filter_map { |line| line[3..]&.split(' -> ')&.last }
-            .select { |path| RUBOCOP_EXTENSIONS.include?(File.extname(path)) && File.file?(path) }
-        end
-    end
-  end
-end