i18n_feedback 0.3.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b7fcc717fd98e35452b32dced0c863804d92a13c6c50986004c74ffad64189ca
-  data.tar.gz: 00fa165a3e61bd18e773458cc00c7e38d324e3b00387b1eb0b78269738b73369
+  metadata.gz: 9fdbfd25f140436e323ceb8eec7f22aaa1aa52d4e9979cb0e6cddf4020bf53a9
+  data.tar.gz: a6e68e6e68cc021427164c95f671a012c78c31855aa9d1fef5c8cea528577ca1
 SHA512:
-  metadata.gz: 8b2dcf16cb6edcec67828d8294cf670205c5b61b591cbeded1eb6605519a0a16b485d644c8b60d7b24d3134088396a22657a653acdeac7dc95b2aeeae64ea1ff
-  data.tar.gz: 8a60071cfafc8fd341723f4d92f132caa2b71953de672bb3f508b2923315e698ccdac7431acf5f07724c330cb2a70223abb34d560b65e61aa40350875c754b18
+  metadata.gz: 822a81c0d8e8d08c2d6e03a9208e899a2a5a6649bbafe347b3e56c3ab6c430bfb059e05ec03abde8307c2a9692f08c64d5f9b7a0c94fe8c10eefead0385ca845
+  data.tar.gz: cd0d806e70019c47b00572bf16e64a13b6435337f36affc6a9f283df8949f56d575fcfe0d35b147d558112990c1e07a0ef9dda3b98808bede245fbd3feed2b8e

data/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 ## [Unreleased]
 
+## [0.5.0]
+
+- Add a `status` to each suggestion — a string-backed Active Record enum with
+  values `pending`, `applied`, and `rejected` (`I18nFeedback::Suggestion::STATUSES`),
+  `status_`-prefixed (`status_applied?`, `status_applied!`, `Suggestion.status_pending`)
+  plus a `newest_first` scope. New suggestions start `pending`; the popover's
+  "already suggested" context now shows only pending ones, so applied/rejected
+  wordings stop resurfacing.
+
+  **Upgrading an existing install:** add the column with a migration —
+
+  ```ruby
+  add_column :i18n_feedback_suggestions, :status, :string, null: false, default: "pending"
+  add_index  :i18n_feedback_suggestions, :status
+  ```
+
+- Harden the public submission endpoint against abuse:
+  - Per-IP rate limiting via Rails' built-in limiter (Rails 7.2+; a no-op on
+    7.1). Default 30 requests / 60s, tunable or disable-able via
+    `config.rate_limit`; returns `429 Too Many Requests`.
+  - Length caps on the stored free-text fields (`proposed_value` / `old_value`
+    5000, `comment` / `page_url` 2000, `translation_key` 500) so a client can't
+    bloat the table with unbounded input.
+
+- Add a `.github/workflows/release.yml` that publishes to RubyGems via trusted
+  publishing (OIDC) when a `v*` tag is pushed — no stored credentials or MFA
+  prompt.
+
+## [0.4.0]
+
+- Add a `config.on_submit` hook, called with each saved suggestion right after
+  it's stored — notify Slack, send an email, open a ticket. Runs inline after
+  save, so keep it fast or hand off to a job.
+
 ## [0.3.1]
 
 - Fix the widget showing raw key markers (e.g. `⟦i18n_feedback.title⟧`) in its own

data/README.md

@@ -116,6 +116,10 @@ I18nFeedback.configure do |config|
 
   # Keep in sync with the `mount` in config/routes.rb.
   config.mount_path = "/i18n_feedback"
+
+  # Per-IP throttle on the submission endpoint, passed to Rails' built-in rate
+  # limiter (Rails 7.2+; ignored on 7.1). Set nil to disable.
+  config.rate_limit = { to: 30, within: 60 }
 end
 ```
 
@@ -226,13 +230,35 @@ blue accent stays the same in both.
 Suggestions are ordinary records:
 
 ```ruby
-I18nFeedback::Suggestion.order(created_at: :desc).each do |s|
+I18nFeedback::Suggestion.where(status: "pending").newest_first.each do |s|
   puts "#{s.locale} #{s.translation_key}: #{s.old_value.inspect} -> #{s.proposed_value.inspect}"
 end
 ```
 
 Each row stores `translation_key`, `locale`, `old_value`, `proposed_value`,
-`comment`, `page_url`, and optional `author_id` / `author_label`.
+`comment`, `page_url`, `status`, and optional `author_id` / `author_label`.
+
+Every suggestion has a `status` — one of `pending`, `applied`, or `rejected`
+(`I18nFeedback::Suggestion::STATUSES`), backed by an Active Record enum. New
+suggestions start `pending`; once you apply a wording to your locale files or
+decide against it, set the status accordingly so the popover stops offering it
+as pending context:
+
+```ruby
+suggestion.status_applied!          # bang setter
+suggestion.status_applied?          # => true
+I18nFeedback::Suggestion.status_pending.newest_first  # scope per status
+```
+
+### Getting notified
+
+To be pinged when a suggestion comes in, set `on_submit`. It's called with the
+saved `Suggestion` right after it's stored — notify Slack, send an email, open a
+ticket. It runs inline in the request, so keep it fast or hand off to a job:
+
+```ruby
+config.on_submit = ->(suggestion) { SuggestionMailer.with(suggestion:).created.deliver_later }
+```
 
 ## Security
 

data/Rakefile

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require 'bundler/setup'
+# Defines build/install/release — `rake release` is what the trusted-publishing
+# workflow (.github/workflows/release.yml) runs to push the gem to RubyGems.
+require 'bundler/gem_tasks'
 
 APP_RAKEFILE = File.expand_path('spec/dummy/Rakefile', __dir__)
 load 'rails/tasks/engine.rake' if File.exist?(APP_RAKEFILE)

data/app/controllers/i18n_feedback/suggestions_controller.rb

@@ -2,12 +2,26 @@
 
 module I18nFeedback
   class SuggestionsController < ApplicationController
+    # Throttle the public submission endpoint per IP so one user or bot can't
+    # flood the table. Uses the rate limiter built into Rails 7.2+ (backed by
+    # Rails.cache); a no-op on Rails 7.1. Tune or disable via config.rate_limit —
+    # read once at boot, after the host's initializer.
+    if respond_to?(:rate_limit) && I18nFeedback.config.rate_limit
+      rate_limit(**I18nFeedback.config.rate_limit,
+                 only: :create,
+                 with: lambda {
+                   render json: { errors: ['Too many suggestions. Please slow down and try again.'] },
+                          status: :too_many_requests
+                 })
+    end
+
     # Pending suggestions for one key/locale, shown as read-only context when the
     # proofreader reopens the popover for a string someone already flagged.
     def index
       suggestions = Suggestion
                     .where(translation_key: params[:key], locale: params[:locale])
-                    .order(id: :desc)
+                    .status_pending
+                    .newest_first
                     .limit(20)
 
       render json: suggestions.map { |suggestion| suggestion_json(suggestion) }
@@ -18,6 +32,7 @@ module I18nFeedback
       attribute_author(suggestion)
 
       if suggestion.save
+        I18nFeedback.config.on_submit.call(suggestion)
         head :created
       else
         render json: { errors: suggestion.errors.full_messages }, status: :unprocessable_entity

data/app/models/i18n_feedback/suggestion.rb

@@ -5,10 +5,23 @@ module I18nFeedback
   # is optional and stored as loose fields (no foreign key to the host's user
   # table) so the model is portable across apps with different user models.
   class Suggestion < ApplicationRecord
-    validates :translation_key, presence: true
-    validates :proposed_value, presence: true
+    # Lifecycle of a proposed wording: a fresh suggestion is `pending` until a
+    # developer applies it to the locale files or rejects it. String-backed so
+    # the column stays human-readable; prefixed so the generated methods read as
+    # `status_pending?` / `Suggestion.status_applied` and never clash.
+    STATUSES = %w[pending applied rejected].freeze
+
+    enum :status, STATUSES.index_by(&:itself), prefix: :status, default: :pending
+
+    validates :translation_key, presence: true, length: { maximum: 500 }
+    validates :proposed_value, presence: true, length: { maximum: 5_000 }
+    validates :old_value, length: { maximum: 5_000 }
+    validates :comment, length: { maximum: 2_000 }
+    validates :page_url, length: { maximum: 2_000 }
     validates :locale,
               presence: true,
               inclusion: { in: ->(_) { I18nFeedback.config.available_locales.call.map(&:to_s) } }
+
+    scope :newest_first, -> { order(id: :desc) }
   end
 end

data/lib/generators/i18n_feedback/install/templates/create_i18n_feedback_suggestions.rb.tt

@@ -9,6 +9,7 @@ class CreateI18nFeedbackSuggestions < ActiveRecord::Migration<%= migration_versi
       t.text :proposed_value, null: false
       t.text :comment
       t.string :page_url
+      t.string :status, null: false, default: 'pending'
       t.string :author_id
       t.string :author_label
 
@@ -16,5 +17,6 @@ class CreateI18nFeedbackSuggestions < ActiveRecord::Migration<%= migration_versi
     end
 
     add_index :i18n_feedback_suggestions, %i[translation_key locale]
+    add_index :i18n_feedback_suggestions, :status
   end
 end

data/lib/generators/i18n_feedback/install/templates/initializer.rb

@@ -36,4 +36,9 @@ I18nFeedback.configure do |config|
   # Keep this in sync with the `mount` line in config/routes.rb.
   #
   # config.mount_path = "/i18n_feedback"
+
+  # Called with each saved suggestion — notify Slack, send an email, open a
+  # ticket. Runs inline after save, so keep it fast or hand off to a job.
+  #
+  # config.on_submit = ->(suggestion) { SuggestionMailer.with(suggestion:).created.deliver_later }
 end

data/lib/i18n_feedback/configuration.rb

@@ -48,6 +48,15 @@ module I18nFeedback
     # suggest mode without the parameter.
     attr_accessor :toggle_param
 
+    # Called with each saved suggestion — notify Slack, send an email, open a
+    # ticket. Runs inline after save; keep it fast or hand off to a job.
+    attr_accessor :on_submit
+
+    # Per-IP throttle for the public submission endpoint, as keyword arguments
+    # for Rails' rate limiter (Rails 7.2+; ignored on 7.1). Read once when the
+    # controller loads — set it in an initializer. nil disables throttling.
+    attr_accessor :rate_limit
+
     def initialize
       @enabled_environments = %w[development staging]
       @enabled = ->(_request) { true }
@@ -59,6 +68,8 @@ module I18nFeedback
       @show_pill = true
       @pill_label = nil
       @toggle_param = 'i18n_feedback'
+      @on_submit = ->(_suggestion) {}
+      @rate_limit = { to: 30, within: 60 }
     end
 
     def environment_enabled?

data/lib/i18n_feedback/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module I18nFeedback
-  VERSION = '0.3.1'
+  VERSION = '0.5.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: i18n_feedback
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.5.0
 platform: ruby
 authors:
 - Yaroslav Shmarov
@@ -97,7 +97,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 3.6.9
 specification_version: 4
 summary: 'In-context i18n proofreading for Rails: click any translated string and
   suggest a fix.'