i18n_feedback 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f4dee71413e641b59a88d1116ac134410395055d31f097d83800155feead9fc8
-  data.tar.gz: 4e41cd76dd83acbdd77ff95ece48bed916040bdf0e6227e78aa6090f8c28025b
+  metadata.gz: 9fdbfd25f140436e323ceb8eec7f22aaa1aa52d4e9979cb0e6cddf4020bf53a9
+  data.tar.gz: a6e68e6e68cc021427164c95f671a012c78c31855aa9d1fef5c8cea528577ca1
 SHA512:
-  metadata.gz: 9483d2a561d1edb370685c85ac3dfaa5030532c58102aeb923926ea180de687d738e9e7deccbf8a6689f617f4ae7da7a20750272a5306419d60389d574c5b4f4
-  data.tar.gz: d50924f6b93eec7fe93bb5e5baa8a7a53a43e8fdcf864b571531646d3f47f8554dff87e6766289ce0589830f0d354176759ea85ebadbff6722396664aec632b9
+  metadata.gz: 822a81c0d8e8d08c2d6e03a9208e899a2a5a6649bbafe347b3e56c3ab6c430bfb059e05ec03abde8307c2a9692f08c64d5f9b7a0c94fe8c10eefead0385ca845
+  data.tar.gz: cd0d806e70019c47b00572bf16e64a13b6435337f36affc6a9f283df8949f56d575fcfe0d35b147d558112990c1e07a0ef9dda3b98808bede245fbd3feed2b8e

data/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 ## [Unreleased]
 
+## [0.5.0]
+
+- Add a `status` to each suggestion — a string-backed Active Record enum with
+  values `pending`, `applied`, and `rejected` (`I18nFeedback::Suggestion::STATUSES`),
+  `status_`-prefixed (`status_applied?`, `status_applied!`, `Suggestion.status_pending`)
+  plus a `newest_first` scope. New suggestions start `pending`; the popover's
+  "already suggested" context now shows only pending ones, so applied/rejected
+  wordings stop resurfacing.
+
+  **Upgrading an existing install:** add the column with a migration —
+
+  ```ruby
+  add_column :i18n_feedback_suggestions, :status, :string, null: false, default: "pending"
+  add_index  :i18n_feedback_suggestions, :status
+  ```
+
+- Harden the public submission endpoint against abuse:
+  - Per-IP rate limiting via Rails' built-in limiter (Rails 7.2+; a no-op on
+    7.1). Default 30 requests / 60s, tunable or disable-able via
+    `config.rate_limit`; returns `429 Too Many Requests`.
+  - Length caps on the stored free-text fields (`proposed_value` / `old_value`
+    5000, `comment` / `page_url` 2000, `translation_key` 500) so a client can't
+    bloat the table with unbounded input.
+
+- Add a `.github/workflows/release.yml` that publishes to RubyGems via trusted
+  publishing (OIDC) when a `v*` tag is pushed — no stored credentials or MFA
+  prompt.
+
 ## [0.4.0]
 
 - Add a `config.on_submit` hook, called with each saved suggestion right after

data/README.md

@@ -116,6 +116,10 @@ I18nFeedback.configure do |config|
 
   # Keep in sync with the `mount` in config/routes.rb.
   config.mount_path = "/i18n_feedback"
+
+  # Per-IP throttle on the submission endpoint, passed to Rails' built-in rate
+  # limiter (Rails 7.2+; ignored on 7.1). Set nil to disable.
+  config.rate_limit = { to: 30, within: 60 }
 end
 ```
 
@@ -226,13 +230,25 @@ blue accent stays the same in both.
 Suggestions are ordinary records:
 
 ```ruby
-I18nFeedback::Suggestion.order(created_at: :desc).each do |s|
+I18nFeedback::Suggestion.where(status: "pending").newest_first.each do |s|
   puts "#{s.locale} #{s.translation_key}: #{s.old_value.inspect} -> #{s.proposed_value.inspect}"
 end
 ```
 
 Each row stores `translation_key`, `locale`, `old_value`, `proposed_value`,
-`comment`, `page_url`, and optional `author_id` / `author_label`.
+`comment`, `page_url`, `status`, and optional `author_id` / `author_label`.
+
+Every suggestion has a `status` — one of `pending`, `applied`, or `rejected`
+(`I18nFeedback::Suggestion::STATUSES`), backed by an Active Record enum. New
+suggestions start `pending`; once you apply a wording to your locale files or
+decide against it, set the status accordingly so the popover stops offering it
+as pending context:
+
+```ruby
+suggestion.status_applied!          # bang setter
+suggestion.status_applied?          # => true
+I18nFeedback::Suggestion.status_pending.newest_first  # scope per status
+```
 
 ### Getting notified
 

data/Rakefile

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require 'bundler/setup'
+# Defines build/install/release — `rake release` is what the trusted-publishing
+# workflow (.github/workflows/release.yml) runs to push the gem to RubyGems.
+require 'bundler/gem_tasks'
 
 APP_RAKEFILE = File.expand_path('spec/dummy/Rakefile', __dir__)
 load 'rails/tasks/engine.rake' if File.exist?(APP_RAKEFILE)

data/app/controllers/i18n_feedback/suggestions_controller.rb

@@ -2,12 +2,26 @@
 
 module I18nFeedback
   class SuggestionsController < ApplicationController
+    # Throttle the public submission endpoint per IP so one user or bot can't
+    # flood the table. Uses the rate limiter built into Rails 7.2+ (backed by
+    # Rails.cache); a no-op on Rails 7.1. Tune or disable via config.rate_limit —
+    # read once at boot, after the host's initializer.
+    if respond_to?(:rate_limit) && I18nFeedback.config.rate_limit
+      rate_limit(**I18nFeedback.config.rate_limit,
+                 only: :create,
+                 with: lambda {
+                   render json: { errors: ['Too many suggestions. Please slow down and try again.'] },
+                          status: :too_many_requests
+                 })
+    end
+
     # Pending suggestions for one key/locale, shown as read-only context when the
     # proofreader reopens the popover for a string someone already flagged.
     def index
       suggestions = Suggestion
                     .where(translation_key: params[:key], locale: params[:locale])
-                    .order(id: :desc)
+                    .status_pending
+                    .newest_first
                     .limit(20)
 
       render json: suggestions.map { |suggestion| suggestion_json(suggestion) }

data/app/models/i18n_feedback/suggestion.rb

@@ -5,10 +5,23 @@ module I18nFeedback
   # is optional and stored as loose fields (no foreign key to the host's user
   # table) so the model is portable across apps with different user models.
   class Suggestion < ApplicationRecord
-    validates :translation_key, presence: true
-    validates :proposed_value, presence: true
+    # Lifecycle of a proposed wording: a fresh suggestion is `pending` until a
+    # developer applies it to the locale files or rejects it. String-backed so
+    # the column stays human-readable; prefixed so the generated methods read as
+    # `status_pending?` / `Suggestion.status_applied` and never clash.
+    STATUSES = %w[pending applied rejected].freeze
+
+    enum :status, STATUSES.index_by(&:itself), prefix: :status, default: :pending
+
+    validates :translation_key, presence: true, length: { maximum: 500 }
+    validates :proposed_value, presence: true, length: { maximum: 5_000 }
+    validates :old_value, length: { maximum: 5_000 }
+    validates :comment, length: { maximum: 2_000 }
+    validates :page_url, length: { maximum: 2_000 }
     validates :locale,
               presence: true,
               inclusion: { in: ->(_) { I18nFeedback.config.available_locales.call.map(&:to_s) } }
+
+    scope :newest_first, -> { order(id: :desc) }
   end
 end

data/lib/generators/i18n_feedback/install/templates/create_i18n_feedback_suggestions.rb.tt

@@ -9,6 +9,7 @@ class CreateI18nFeedbackSuggestions < ActiveRecord::Migration<%= migration_versi
       t.text :proposed_value, null: false
       t.text :comment
       t.string :page_url
+      t.string :status, null: false, default: 'pending'
       t.string :author_id
       t.string :author_label
 
@@ -16,5 +17,6 @@ class CreateI18nFeedbackSuggestions < ActiveRecord::Migration<%= migration_versi
     end
 
     add_index :i18n_feedback_suggestions, %i[translation_key locale]
+    add_index :i18n_feedback_suggestions, :status
   end
 end

data/lib/i18n_feedback/configuration.rb

@@ -52,6 +52,11 @@ module I18nFeedback
     # ticket. Runs inline after save; keep it fast or hand off to a job.
     attr_accessor :on_submit
 
+    # Per-IP throttle for the public submission endpoint, as keyword arguments
+    # for Rails' rate limiter (Rails 7.2+; ignored on 7.1). Read once when the
+    # controller loads — set it in an initializer. nil disables throttling.
+    attr_accessor :rate_limit
+
     def initialize
       @enabled_environments = %w[development staging]
       @enabled = ->(_request) { true }
@@ -64,6 +69,7 @@ module I18nFeedback
       @pill_label = nil
       @toggle_param = 'i18n_feedback'
       @on_submit = ->(_suggestion) {}
+      @rate_limit = { to: 30, within: 60 }
     end
 
     def environment_enabled?

data/lib/i18n_feedback/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module I18nFeedback
-  VERSION = '0.4.0'
+  VERSION = '0.5.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: i18n_feedback
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Yaroslav Shmarov
@@ -97,7 +97,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 3.6.9
 specification_version: 4
 summary: 'In-context i18n proofreading for Rails: click any translated string and
   suggest a fix.'