i18n_proofreading 0.9.2 → 0.9.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 442bbc0db3a43634199ae4ad02e0b4c93bfe4b0278f5c4bf4236793acfd9006d
4
- data.tar.gz: b5adfadeac507e64888ea36412173daec3ec8b8b0067fe1c056de8b1c328c5b7
3
+ metadata.gz: c009ca04acda8614a83cfa656bc807a01765319ba2b7da5dcf80fb76f4980c94
4
+ data.tar.gz: dbad6b7f76f62b577ffe8dc05448ad0b35d67f621f8a820884bc8a48527ec007
5
5
  SHA512:
6
- metadata.gz: ad016e5b43be45f388e0f0c11956dbcfaed05d2702f1765d598a2c29e4ee2af8a539bb853c8d8ef8d0dd0121273c64e64353611b8acb494348d10e24188aa5d4
7
- data.tar.gz: '08506d993c5b691a33ab9dc327fc2ca84814723cd289bf014ff164181f4fa85d882901286ccc0816aa26363aba371893090ee4024845cb7e0431c57bb2483dd4'
6
+ metadata.gz: 8f1064cb1de9690b57823662ca4f479da538b6bd973880fd23e6781af99f723b5803322f13d76e66f74312dfd2287445ebff20b4c96880572951ad5db5345575
7
+ data.tar.gz: 4e7dda45dc4809cfe4393987be38f273e2dbf98f04162bc9d4af175c3b150bb5e9d00cabd9bb0d6d0c468e0f1356315b4c2f735e7d7019a4042f496c86d663e7
data/CHANGELOG.md CHANGED
@@ -2,6 +2,20 @@
2
2
 
3
3
  ## [Unreleased]
4
4
 
5
+ ## [0.9.3]
6
+
7
+ - Fix the widget going dead after a Turbo Drive visit under a nonce-based
8
+ Content-Security-Policy. The widget code was inlined as a nonce'd `<script>`;
9
+ Turbo body swaps re-run body scripts against the *original* page's CSP
10
+ header, which refuses the freshly minted inline nonce — so after any soft
11
+ visit the widget never booted until a hard reload. The code is now served as
12
+ a **same-origin, content-fingerprinted script**
13
+ (`GET {mount_path}/widget.js?v=<md5>`), which `script-src 'self'` (or the
14
+ nonce the tag still carries) covers on every visit. The fingerprinted URL is
15
+ immutable and cached for a year — new code means a new URL — while any other
16
+ URL only ETag-revalidates. The inline JSON config block is unchanged: it is
17
+ data, not code, and needs no nonce.
18
+
5
19
  ## [0.9.2]
6
20
 
7
21
  - Make the suggestion popover **full-screen on mobile** (≤ 480px wide): edge to
@@ -0,0 +1,26 @@
1
+ # frozen_string_literal: true
2
+
3
+ module I18nProofreading
4
+ # Serves the widget JavaScript as a plain same-origin script. Same-origin
5
+ # matters: under a `script-src 'self'` (or nonce-based) CSP, an external
6
+ # script from the app's own host is always allowed — including when Turbo
7
+ # Drive swaps the <body> and re-runs body scripts under the *original*
8
+ # page's CSP header, where a freshly minted inline nonce would be refused.
9
+ class WidgetsController < ApplicationController
10
+ # The script is static and carries no user data; without this, Rails'
11
+ # cross-origin JavaScript guard refuses to serve it to a plain
12
+ # <script src> request.
13
+ skip_forgery_protection
14
+
15
+ # The script URL carries a content fingerprint (?v=<md5>), so stale code
16
+ # is structurally impossible: new code means a new URL. The canonical
17
+ # fingerprinted URL is immutable and gets long-lived caching; anything
18
+ # else only ETag-revalidates.
19
+ def show
20
+ expires_in 1.year, public: true if params[:v] == Widget.fingerprint
21
+ return unless stale?(etag: [I18nProofreading::VERSION, Widget.fingerprint])
22
+
23
+ render plain: Widget.javascript, content_type: 'text/javascript'
24
+ end
25
+ end
26
+ end
data/config/routes.rb CHANGED
@@ -1,6 +1,10 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  I18nProofreading::Engine.routes.draw do
4
+ # The widget code, served same-origin so it runs under a `'self'`/nonce-based
5
+ # CSP even across Turbo body swaps (see WidgetsController).
6
+ get 'widget.js', to: 'widgets#show', as: :widget
7
+
4
8
  # index is the read-only admin dashboard; create + the `context` collection
5
9
  # route are the widget's public API (see SuggestionsController). There is
6
10
  # deliberately no update/destroy — the tool never mutates suggestions from the
@@ -1,5 +1,5 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module I18nProofreading
4
- VERSION = '0.9.2'
4
+ VERSION = '0.9.3'
5
5
  end
@@ -1,13 +1,14 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  require 'json'
4
+ require 'digest'
4
5
 
5
6
  module I18nProofreading
6
7
  # Serves the self-contained browser widget. The JavaScript is plain ES (no
7
8
  # framework, no build step) and styles itself inline, so it drops into any Rails
8
- # app regardless of its CSS or JS setup. It is inlined into the page rather than
9
- # served as a separate asset to avoid any dependency on the host's asset
10
- # pipeline.
9
+ # app regardless of its CSS or JS setup. It is served by the engine's own
10
+ # controller (see WidgetsController) rather than through an asset pipeline, to
11
+ # avoid any dependency on the host's asset setup.
11
12
  module Widget
12
13
  # Lives under lib/ (not app/assets/), so a host that runs an asset
13
14
  # pipeline never ingests it: Rails auto-registers every engine's
@@ -24,6 +25,13 @@ module I18nProofreading
24
25
  @javascript ||= File.read(SOURCE)
25
26
  end
26
27
 
28
+ # Content fingerprint for the cache-busting script URL: a changed file is
29
+ # a changed URL, so no browser can ever run stale widget code — Safari
30
+ # has been caught ignoring must-revalidate on same-URL scripts.
31
+ def fingerprint
32
+ @fingerprint ||= Digest::MD5.hexdigest(javascript)
33
+ end
34
+
27
35
  # The two <script> tags to place before </body>.
28
36
  #
29
37
  # The config rides in a `type="application/json"` block: it is *data*, not
@@ -32,8 +40,12 @@ module I18nProofreading
32
40
  # widget can re-read the *current* page's config on every `turbo:load`
33
41
  # instead of being stuck with whatever the last full load evaluated.
34
42
  #
35
- # `nonce:` stamps only the widget script (the code), so it runs under a
36
- # nonce-based Content-Security-Policy; pass nil when the app has no nonce.
43
+ # The code is a same-origin `src` script served by the engine NOT
44
+ # inlined. Under a nonce-based CSP, Turbo Drive body swaps re-run body
45
+ # scripts against the *original* page's CSP header, so a fresh inline
46
+ # nonce gets refused; a same-origin src is covered by `'self'` on every
47
+ # visit. `nonce:` is still stamped for hosts whose script-src has no
48
+ # 'self'; pass nil when the app has no nonce.
37
49
  def snippet(endpoint:, locale:, active:, nonce: nil)
38
50
  config = {
39
51
  endpoint: endpoint,
@@ -48,9 +60,10 @@ module I18nProofreading
48
60
  # Escape "</" so a value can't close the <script> block early.
49
61
  json = config.to_json.gsub('</', '<\/')
50
62
  nonce_attr = nonce ? %( nonce="#{nonce}") : ''
63
+ src = "#{I18nProofreading.config.mount_path.chomp('/')}/widget.js?v=#{fingerprint}"
51
64
 
52
65
  %(<script type="application/json" data-i18n-proofreading-config>#{json}</script>) +
53
- %(<script data-i18n-proofreading-widget#{nonce_attr}>#{javascript}</script>)
66
+ %(<script src="#{src}" defer#{nonce_attr} data-i18n-proofreading-widget></script>)
54
67
  end
55
68
 
56
69
  private
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: i18n_proofreading
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.9.2
4
+ version: 0.9.3
5
5
  platform: ruby
6
6
  authors:
7
7
  - Yaroslav Shmarov
@@ -40,6 +40,7 @@ files:
40
40
  - Rakefile
41
41
  - app/controllers/i18n_proofreading/application_controller.rb
42
42
  - app/controllers/i18n_proofreading/suggestions_controller.rb
43
+ - app/controllers/i18n_proofreading/widgets_controller.rb
43
44
  - app/helpers/i18n_proofreading/tag_helper.rb
44
45
  - app/models/i18n_proofreading/application_record.rb
45
46
  - app/models/i18n_proofreading/suggestion.rb