ideasbugs 0.10.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 383c2bf2c3fc0168a96e1e418398bc643b19c4364440604912d1e546543fc62a
-  data.tar.gz: c40e84232ccc55b2394adbe9421f297a3c93e6cdff98c8d31e50f7c40e8e9148
+  metadata.gz: 61cbcd9d82d7ea0e24313084b45e017ec6c4448c7851d2f94c48adf7604b05b3
+  data.tar.gz: 1fce4b379cc43bdb594cfbfef919cf37bfb485293c698106001e814fdd412dbb
 SHA512:
-  metadata.gz: 32f3a5e503b09ae996a87890f4aceb11ab337db5bae30a711d019d834e1a639ee985e7a71cb380038d7ef2799e3df4d5b9e4d06b686021ac19bab7411ad1c329
-  data.tar.gz: 0d11c01642ba6dea041d336461bcb69a65184190dcc28d544ca605a6827107a4fa7729f36fb71865ab6c07d251d4f3ae4af912feed8ac790614ed757778005a2
+  metadata.gz: c2a99f724a3f3ff162f0ffc64d8ee8fe42b37bf16a62ee24533ba0e607a6689969f45f009e34faf7ec272ffe475e8d98b1e1ea5b1af5ace6488e06ed524000fc
+  data.tar.gz: b592e770c7f666372239c72d76a7796ef24fe62fcd4e7227ea464d70bd0421c3d7f5a233d3af113e695e24932fc4a191e9082c9d300356b1a6a7757fdb167fcb

data/AGENTS.md

@@ -5,7 +5,7 @@ Instructions for coding agents. Two audiences:
 - **[Installing ideasbugs into a Rails app](#installing-into-a-rails-app)** — you are working in a host app and were asked to add product feedback, bug reports, or a feature-request board.
 - **[Working on the gem itself](#working-on-the-gem-itself)** — you are working in this repository.
 
-Requirements: Ruby >= 3.2, Rails >= 7.1. Active Storage only for screenshots. The widget needs the CSRF token from `csrf_meta_tags`, which a standard Rails layout already has.
+Requirements: Ruby >= 3.2, Rails >= 7.1 and < 9. Active Storage only for screenshots. The widget needs the CSRF token from `csrf_meta_tags`, which a standard Rails layout already has.
 
 If you are in a host app and this file is not in front of you, it ships inside the gem: `cat "$(bundle show ideasbugs)/AGENTS.md"`.
 
@@ -161,6 +161,11 @@ Everything is optional; a fresh install works with zero config. Full list with c
 
 ## Working on the gem itself
 
+The development toolchain is pinned to Ruby 4.0.5 in `mise.toml`. Do not use
+macOS's `/usr/bin/ruby`. In shells, hooks, or automation where mise activation
+is uncertain, explicitly prepend the configured Ruby, for example
+`PATH="$(mise where ruby)/bin:$PATH" bundle exec rake test`.
+
 ```bash
 bundle exec rake test            # minitest, dummy app under test/dummy
 bundle exec rake test:system     # browser tests, separate task

data/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## [Unreleased]
+
+## [1.0.0] - 2026-08-11
+
+- **The documented integration surface is now the stable 1.x contract.**
+  `Ideasbugs.configure`, every generated configuration option,
+  `mount_ideasbugs`, `ideasbugs_tag`, `data-ideasbugs-open`,
+  `Ideasbugs::Feedback`'s documented fields/status helpers/scopes, tenant
+  helpers, gated screenshots, and `on_submit` will follow semantic versioning.
+  `Feedback` is intentional domain language and will not be renamed to `Post`.
+  Engine controllers, partials, CSS classes and widget internals remain private.
+- **The three documented status scopes now exist.** `Feedback.open`,
+  `.in_review`, and `.resolved` return ordinary relations and compose with
+  `for_tenant`/`newest_first`. They remain hand-written scopes rather than an
+  enum because `open` would collide with `Kernel#open` in enum machinery.
+- **Hosts that load Action View from an initializer boot normally.**
+  `WidgetHelper` is required from `lib` before the engine registers its Action
+  View hook. A dummy-host initializer reproduces that early load on every test
+  boot. The helper constant and `ideasbugs_tag` API are unchanged.
+- Supported combinations are Ruby 3.2 through 4.0 and Rails 7.1 through 8.1.
+  Rails now has a `< 9` upper bound: future Rails majors must pass the suite
+  before Bundler treats them as supported.
+- Added a security policy and explicit privacy, retention, and deletion guidance
+  for feedback, host-provided attribution, page context, and screenshots.
+  Upgrading from 0.10.1 requires no migration or initializer change.
+- Release validation now runs the normal and browser suites, RuboCop, the widget
+  syntax check and gem build on Ruby 4.0; it verifies RubyGems indexing and
+  creates the GitHub Release. Generator tests now write only under ignored root
+  `tmp/`, so running tests before lint no longer leaves generated files in
+  RuboCop's input tree.
+
+## 0.10.1
+
+- **The demo inbox now teaches the Ideasbugs workflow.** Its open, in-review,
+  and resolved records form a short path through captured request context,
+  triage, kinds and sections, search, production authorization, attribution,
+  and gated screenshots instead of posing as unrelated customer reports.
+- `ideasbugs:seed_demo` keeps the existing demo identities, so rerunning it
+  upgrades those three rows in place. That also means it overwrites edits made
+  to the gem-owned demo rows; real feedback is not touched.
+
 ## 0.10.0
 
 - **Triage is one switch now.** Open, In review and Resolved sit in a single pill

data/README.md

@@ -61,7 +61,7 @@ duplicating them.
 > The dashboard defaults to **development only**. Set `authorize_admin` before
 > you deploy — see [Configure](#configure).
 
-Ruby >= 3.2 · Rails >= 7.1 · Active Storage only if you want screenshots ·
+Ruby >= 3.2 · Rails >= 7.1 and < 9 · Active Storage only if you want screenshots ·
 CSRF token comes from `csrf_meta_tags`, already in a standard Rails layout.
 
 Installing with a coding agent? Point it at [AGENTS.md](AGENTS.md) — the same
@@ -269,6 +269,26 @@ nothing changes until you set `config.tenant`.
 
 </details>
 
+## Compatibility and public API
+
+The following are the model and integration contracts that 1.x will keep
+stable under semantic versioning:
+
+- `Ideasbugs::Feedback`, including `kind`, `section`, `message`, `status`,
+  `page_url`, `user_agent`, `tenant`, `author_id`, `author_label`, timestamps,
+  `STATUSES`, status helpers/scopes, `newest_first`, `for_tenant`, and gated
+  `screenshots`.
+- `has_feedback` and the host-model collection it defines.
+- `Ideasbugs.configure` and the documented configuration options.
+- `mount_ideasbugs`, `ideasbugs_tag`, and `data-ideasbugs-open`.
+- `config.on_submit`, called with the saved `Ideasbugs::Feedback`.
+
+`Feedback` is intentional domain language and will not be renamed to a generic
+`Post` during 1.x. Engine controllers, partials, CSS classes, generated HTML,
+and widget implementation objects are private. Incompatible changes to the
+public list above wait for a new major version; a deprecation normally ships
+first.
+
 ## Localization
 
 Every string resolves through Rails I18n under `ideasbugs.*` and follows the
@@ -305,6 +325,10 @@ to `kind.humanize`.
 
 ## Security
 
+See [SECURITY.md](https://github.com/yshmarov/ideasbugs/blob/main/SECURITY.md)
+for supported versions, private vulnerability reporting, the complete
+stored-data boundary, and deletion/retention guidance.
+
 - **Both gates run server-side**, on every request. The dashboard denies
   everything outside development until you configure `authorize_admin`.
 - **Screenshots stream through the dashboard's own gate** — never public Active
@@ -320,6 +344,10 @@ to `kind.humanize`.
   survives Turbo visits.
 - **No foreign key into your user table.** Attribution is loose fields, so the
   gem never couples to your user model.
+- **The host owns retention and deletion.** Feedback can contain personal data,
+  and screenshots can contain anything visible on the user's screen. Delete a
+  row with `Ideasbugs::Feedback.find(id).destroy!`, then apply your object-store,
+  backup, cache, and export retention policies separately.
 
 ## Development
 
@@ -332,7 +360,8 @@ bundle exec rubocop
 
 Tests run against a dummy Rails app in `test/dummy`; the widget is covered by
 Capybara system tests in a real browser. CI runs Rails 7.1 / 7.2 / 8.0 / 8.1
-against Ruby 3.2–3.4 (per-version Gemfiles in `gemfiles/`).
+against Ruby 3.2–4.0 (per-version Gemfiles in `gemfiles/`). Rails 9 is outside
+the 1.x dependency contract until it passes the suite.
 
 ## One family
 

data/SECURITY.md

@@ -0,0 +1,44 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are released for the latest 1.x version. If a report also
+affects the newest 0.x release, a backport may be published when the fix is
+small and the affected application cannot upgrade immediately.
+
+## Reporting a vulnerability
+
+Please do not open a public issue for a vulnerability. Use
+[GitHub private vulnerability reporting](https://github.com/yshmarov/ideasbugs/security/advisories/new)
+and include the affected version, a minimal reproduction, impact, and any known
+workaround. Credentials, session cookies, private application URLs, customer
+feedback, screenshots, and production database contents should not be included.
+
+Public disclosure should wait until a fixed version is available and affected
+users have had a reasonable opportunity to upgrade.
+
+## Data and deployment boundary
+
+The submission endpoint is available to requests allowed by `config.enabled`,
+which defaults to everyone because production feedback collection is the gem's
+purpose. Hosts decide whether to narrow that gate. The dashboard is separately
+protected by `authorize_admin` and fails closed outside development until the
+host explicitly grants access.
+
+A feedback record can store its kind, section, message, status, page URL, user
+agent, timestamps, an opaque tenant key, optional host-provided author id and
+label, and Active Storage screenshots. A screenshot can contain any data the
+user's screen displayed. Screenshots stream through the dashboard gate rather
+than public blob URLs, but hosts still own the storage service, bucket policy,
+backups, retention period, access controls, and incident response.
+
+Delete feedback with ordinary Active Record when a user request or application
+policy requires erasure:
+
+```ruby
+Ideasbugs::Feedback.find(id).destroy!
+```
+
+That removes the record and lets Rails apply the configured Active Storage
+attachment lifecycle. Confirm deletion separately in object storage, replicas,
+backups, caches, and exports; deleting the live row does not rewrite them.

data/app/models/ideasbugs/feedback.rb

@@ -29,6 +29,7 @@ module Ideasbugs
     scope :newest_first, -> { order(id: :desc) }
 
     STATUSES.each do |status|
+      scope status, -> { where(status:) }
       define_method(:"#{status}?") { self.status == status }
     end
 

data/lib/ideasbugs/seeds.rb

@@ -6,29 +6,35 @@ module Ideasbugs
       {
         seed_id: 'checkout-error',
         kind: 'bug',
-        section: 'Checkout',
-        message: 'The payment form shows "Something went wrong" after entering a valid card.',
+        section: '1. Try triage',
+        message: 'Start here: this open bug shows what the widget captures — kind, section, page URL, ' \
+                 'browser context, and an author when you configure one. Move it to In review as your ' \
+                 'first triage action.',
         status: 'open',
-        page_url: '/checkout',
-        author_label: 'Demo Customer'
+        page_url: '/checkout?demo=ideasbugs',
+        author_label: 'Demo customer · open this first'
       },
       {
         seed_id: 'saved-filters',
         kind: 'feature',
-        section: 'Reports',
-        message: 'It would save time if I could save this report filter and reuse it next week.',
+        section: '2. Shape the inbox',
+        message: 'This feature request is already In review so you can compare workflow states. Set ' \
+                 'config.sections to your product areas, adjust config.kinds if needed, then use the board ' \
+                 'filters and search to keep recurring themes visible.',
         status: 'in_review',
-        page_url: '/reports/revenue',
-        author_label: 'Demo Product Manager'
+        page_url: '/reports?demo=ideasbugs',
+        author_label: 'Demo product manager · compare states'
       },
       {
         seed_id: 'export-confusing',
         kind: 'other',
-        section: 'Settings',
-        message: 'The CSV export worked, but I expected the button to say when the file was ready.',
+        section: '3. Ship safely',
+        message: 'This resolved item is your launch checklist: render ideasbugs_tag, set authorize_admin ' \
+                 'before production, and configure current_user plus author_label when you want attributed ' \
+                 'feedback. Screenshots remain behind the dashboard gate.',
         status: 'resolved',
-        page_url: '/settings/exports',
-        author_label: 'Demo Admin'
+        page_url: '/settings?demo=ideasbugs',
+        author_label: 'Demo admin · launch checklist'
       }
     ].freeze
 

data/lib/ideasbugs/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Ideasbugs
-  VERSION = '0.10.0'
+  VERSION = '1.0.0'
 end

data/{app/helpers → lib}/ideasbugs/widget_helper.rb

@@ -3,7 +3,10 @@
 module Ideasbugs
   # Included into the host's ActionView. Drop `<%= ideasbugs_tag %>`
   # before </body> in your layout; it renders nothing unless feedback is
-  # enabled for the request.
+  # enabled for the request. This lives under lib and is required before the
+  # engine registers its Action View load hook: a host initializer may load
+  # Action View before Rails sets up application autoloaders, when an
+  # app/helpers constant cannot be resolved yet.
   module WidgetHelper
     def ideasbugs_tag
       return unless Ideasbugs.enabled?(request)

data/lib/ideasbugs.rb

@@ -3,6 +3,7 @@
 require 'ideasbugs/version'
 require 'ideasbugs/configuration'
 require 'ideasbugs/widget'
+require 'ideasbugs/widget_helper'
 require 'ideasbugs/has_feedback'
 require 'ideasbugs/seeds'
 require 'ideasbugs/engine'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ideasbugs
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Yaroslav Shmarov
@@ -16,6 +16,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -23,6 +26,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
 description: |
   A mountable Rails engine that adds a "Send feedback" widget to your app —
   bug reports, feature requests, screenshots — and stores submissions in your
@@ -39,6 +45,7 @@ files:
 - MIT-LICENSE
 - README.md
 - Rakefile
+- SECURITY.md
 - app/controllers/concerns/ideasbugs/request_context.rb
 - app/controllers/ideasbugs/application_controller.rb
 - app/controllers/ideasbugs/dashboard_controller.rb
@@ -46,7 +53,6 @@ files:
 - app/controllers/ideasbugs/screenshots_controller.rb
 - app/controllers/ideasbugs/submissions_controller.rb
 - app/controllers/ideasbugs/widgets_controller.rb
-- app/helpers/ideasbugs/widget_helper.rb
 - app/models/ideasbugs/application_record.rb
 - app/models/ideasbugs/feedback.rb
 - app/views/ideasbugs/feedbacks/_feedback_panel.html.erb
@@ -96,6 +102,7 @@ files:
 - lib/ideasbugs/version.rb
 - lib/ideasbugs/widget.js
 - lib/ideasbugs/widget.rb
+- lib/ideasbugs/widget_helper.rb
 - lib/tasks/ideasbugs_tasks.rake
 homepage: https://github.com/yshmarov/ideasbugs
 licenses:
@@ -120,7 +127,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: 'In-app product feedback collection for Rails: a drop-in widget and a built-in
   triage dashboard.'