ideasbugs 0.10.1 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d3b0669f68f65a7cef3986dac6a2ca57938b1d38942338283593e026003e2688
-  data.tar.gz: ed01d83195291ee4cdc81bbf43f043d520c772155780c14a9e070fe0c1e4a2a4
+  metadata.gz: 76f8be375e72b7a33a5f0f5b6bc0fc895ced476aeb3b5325a950fa0a7bd01475
+  data.tar.gz: 565e8e8d07ea9c2604748e88774ebe67bec1473648110b97f0c797911b72127d
 SHA512:
-  metadata.gz: 866b49d6047d00eaef7b79bf419fd8d0762e7ab1a5c1ea45c04b6cb121aa7f929c7049ca41bd9dfe7759bedf2fb46d69d6b8b017cf5e612a6be5046008472217
-  data.tar.gz: 8f25c5e661173324bce15de5ab9ca6e077d04da693231e3df9cf4e46f5a053062e678a2a8c82caedb2e1b47d2539b81036c97c496eb489f32888b2b1c2b0be4a
+  metadata.gz: a9623c31745f085489bf222390b964324391f63396d87f3cfa32714a4cbc29180a2703350571840006cc81121e92541a06224a7d831cdb407e7027f6afa9d56a
+  data.tar.gz: eb8cade7b5bed11612632d95e83cc828c831351721df1dfbb43ea0c54f11dbe7d6ee5f24b79c123f6b6bfcee215a1d3d2140fbd9a3b9c17fb1bdaab883dab58e

data/AGENTS.md

@@ -5,7 +5,7 @@ Instructions for coding agents. Two audiences:
 - **[Installing ideasbugs into a Rails app](#installing-into-a-rails-app)** — you are working in a host app and were asked to add product feedback, bug reports, or a feature-request board.
 - **[Working on the gem itself](#working-on-the-gem-itself)** — you are working in this repository.
 
-Requirements: Ruby >= 3.2, Rails >= 7.1. Active Storage only for screenshots. The widget needs the CSRF token from `csrf_meta_tags`, which a standard Rails layout already has.
+Requirements: Ruby >= 3.2, Rails >= 7.1 and < 9. Active Storage only for screenshots. The widget needs the CSRF token from `csrf_meta_tags`, which a standard Rails layout already has.
 
 If you are in a host app and this file is not in front of you, it ships inside the gem: `cat "$(bundle show ideasbugs)/AGENTS.md"`.
 
@@ -161,6 +161,11 @@ Everything is optional; a fresh install works with zero config. Full list with c
 
 ## Working on the gem itself
 
+The development toolchain is pinned to Ruby 4.0.5 in `mise.toml`. Do not use
+macOS's `/usr/bin/ruby`. In shells, hooks, or automation where mise activation
+is uncertain, explicitly prepend the configured Ruby, for example
+`PATH="$(mise where ruby)/bin:$PATH" bundle exec rake test`.
+
 ```bash
 bundle exec rake test            # minitest, dummy app under test/dummy
 bundle exec rake test:system     # browser tests, separate task

data/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## [Unreleased]
+
+## [1.0.1] - 2026-08-11
+
+- **Screenshot responses now stream privately through the gated engine route.**
+  Responses are marked `private, no-store` and `nosniff`, so sensitive screen
+  captures are not buffered or left cacheable by the browser.
+- **Stored page context is now privacy-filtered.** Only bounded HTTP(S) URLs
+  without credentials, query strings, or fragments are retained.
+
+## [1.0.0] - 2026-08-11
+
+- **The documented integration surface is now the stable 1.x contract.**
+  `Ideasbugs.configure`, every generated configuration option,
+  `mount_ideasbugs`, `ideasbugs_tag`, `data-ideasbugs-open`,
+  `Ideasbugs::Feedback`'s documented fields/status helpers/scopes, tenant
+  helpers, gated screenshots, and `on_submit` will follow semantic versioning.
+  `Feedback` is intentional domain language and will not be renamed to `Post`.
+  Engine controllers, partials, CSS classes and widget internals remain private.
+- **The three documented status scopes now exist.** `Feedback.open`,
+  `.in_review`, and `.resolved` return ordinary relations and compose with
+  `for_tenant`/`newest_first`. They remain hand-written scopes rather than an
+  enum because `open` would collide with `Kernel#open` in enum machinery.
+- **Hosts that load Action View from an initializer boot normally.**
+  `WidgetHelper` is required from `lib` before the engine registers its Action
+  View hook. A dummy-host initializer reproduces that early load on every test
+  boot. The helper constant and `ideasbugs_tag` API are unchanged.
+- Supported combinations are Ruby 3.2 through 4.0 and Rails 7.1 through 8.1.
+  Rails now has a `< 9` upper bound: future Rails majors must pass the suite
+  before Bundler treats them as supported.
+- Added a security policy and explicit privacy, retention, and deletion guidance
+  for feedback, host-provided attribution, page context, and screenshots.
+  Upgrading from 0.10.1 requires no migration or initializer change.
+- Release validation now runs the normal and browser suites, RuboCop, the widget
+  syntax check and gem build on Ruby 4.0; it verifies RubyGems indexing and
+  creates the GitHub Release. Generator tests now write only under ignored root
+  `tmp/`, so running tests before lint no longer leaves generated files in
+  RuboCop's input tree.
+
 ## 0.10.1
 
 - **The demo inbox now teaches the Ideasbugs workflow.** Its open, in-review,

data/README.md

@@ -61,7 +61,7 @@ duplicating them.
 > The dashboard defaults to **development only**. Set `authorize_admin` before
 > you deploy — see [Configure](#configure).
 
-Ruby >= 3.2 · Rails >= 7.1 · Active Storage only if you want screenshots ·
+Ruby >= 3.2 · Rails >= 7.1 and < 9 · Active Storage only if you want screenshots ·
 CSRF token comes from `csrf_meta_tags`, already in a standard Rails layout.
 
 Installing with a coding agent? Point it at [AGENTS.md](AGENTS.md) — the same
@@ -269,6 +269,26 @@ nothing changes until you set `config.tenant`.
 
 </details>
 
+## Compatibility and public API
+
+The following are the model and integration contracts that 1.x will keep
+stable under semantic versioning:
+
+- `Ideasbugs::Feedback`, including `kind`, `section`, `message`, `status`,
+  `page_url`, `user_agent`, `tenant`, `author_id`, `author_label`, timestamps,
+  `STATUSES`, status helpers/scopes, `newest_first`, `for_tenant`, and gated
+  `screenshots`.
+- `has_feedback` and the host-model collection it defines.
+- `Ideasbugs.configure` and the documented configuration options.
+- `mount_ideasbugs`, `ideasbugs_tag`, and `data-ideasbugs-open`.
+- `config.on_submit`, called with the saved `Ideasbugs::Feedback`.
+
+`Feedback` is intentional domain language and will not be renamed to a generic
+`Post` during 1.x. Engine controllers, partials, CSS classes, generated HTML,
+and widget implementation objects are private. Incompatible changes to the
+public list above wait for a new major version; a deprecation normally ships
+first.
+
 ## Localization
 
 Every string resolves through Rails I18n under `ideasbugs.*` and follows the
@@ -305,6 +325,10 @@ to `kind.humanize`.
 
 ## Security
 
+See [SECURITY.md](https://github.com/yshmarov/ideasbugs/blob/main/SECURITY.md)
+for supported versions, private vulnerability reporting, the complete
+stored-data boundary, and deletion/retention guidance.
+
 - **Both gates run server-side**, on every request. The dashboard denies
   everything outside development until you configure `authorize_admin`.
 - **Screenshots stream through the dashboard's own gate** — never public Active
@@ -320,6 +344,10 @@ to `kind.humanize`.
   survives Turbo visits.
 - **No foreign key into your user table.** Attribution is loose fields, so the
   gem never couples to your user model.
+- **The host owns retention and deletion.** Feedback can contain personal data,
+  and screenshots can contain anything visible on the user's screen. Delete a
+  row with `Ideasbugs::Feedback.find(id).destroy!`, then apply your object-store,
+  backup, cache, and export retention policies separately.
 
 ## Development
 
@@ -332,7 +360,8 @@ bundle exec rubocop
 
 Tests run against a dummy Rails app in `test/dummy`; the widget is covered by
 Capybara system tests in a real browser. CI runs Rails 7.1 / 7.2 / 8.0 / 8.1
-against Ruby 3.2–3.4 (per-version Gemfiles in `gemfiles/`).
+against Ruby 3.2–4.0 (per-version Gemfiles in `gemfiles/`). Rails 9 is outside
+the 1.x dependency contract until it passes the suite.
 
 ## One family
 

data/SECURITY.md

@@ -0,0 +1,44 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are released for the latest 1.x version. If a report also
+affects the newest 0.x release, a backport may be published when the fix is
+small and the affected application cannot upgrade immediately.
+
+## Reporting a vulnerability
+
+Please do not open a public issue for a vulnerability. Use
+[GitHub private vulnerability reporting](https://github.com/yshmarov/ideasbugs/security/advisories/new)
+and include the affected version, a minimal reproduction, impact, and any known
+workaround. Credentials, session cookies, private application URLs, customer
+feedback, screenshots, and production database contents should not be included.
+
+Public disclosure should wait until a fixed version is available and affected
+users have had a reasonable opportunity to upgrade.
+
+## Data and deployment boundary
+
+The submission endpoint is available to requests allowed by `config.enabled`,
+which defaults to everyone because production feedback collection is the gem's
+purpose. Hosts decide whether to narrow that gate. The dashboard is separately
+protected by `authorize_admin` and fails closed outside development until the
+host explicitly grants access.
+
+A feedback record can store its kind, section, message, status, page URL, user
+agent, timestamps, an opaque tenant key, optional host-provided author id and
+label, and Active Storage screenshots. A screenshot can contain any data the
+user's screen displayed. Screenshots stream through the dashboard gate rather
+than public blob URLs, but hosts still own the storage service, bucket policy,
+backups, retention period, access controls, and incident response.
+
+Delete feedback with ordinary Active Record when a user request or application
+policy requires erasure:
+
+```ruby
+Ideasbugs::Feedback.find(id).destroy!
+```
+
+That removes the record and lets Rails apply the configured Active Storage
+attachment lifecycle. Confirm deletion separately in object storage, replicas,
+backups, caches, and exports; deleting the live row does not rewrite them.

data/app/controllers/concerns/ideasbugs/request_context.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'uri'
+
 module Ideasbugs
   # Who is asking, which tenant they are in, and the gates that answer both.
   #
@@ -47,5 +49,23 @@ module Ideasbugs
     def tenant_scope
       Feedback.for_tenant(current_tenant)
     end
+
+    # Browser URLs can carry password-reset tokens, signed ids, and campaign
+    # details in their query or fragment. Store only a bounded HTTP(S) location
+    # without credentials before it reaches the feedback table.
+    def clean_page_url(value)
+      raw = value.to_s
+      return if raw.blank? || raw.length > 2_048
+
+      uri = URI.parse(raw)
+      return unless %w[http https].include?(uri.scheme&.downcase)
+      return if uri.host.blank? || uri.userinfo.present?
+
+      uri.query = nil
+      uri.fragment = nil
+      uri.to_s.first(255)
+    rescue URI::InvalidURIError
+      nil
+    end
   end
 end

data/app/controllers/ideasbugs/screenshots_controller.rb

@@ -7,14 +7,15 @@ module Ideasbugs
   # be reachable without passing the same gate as the dashboard — regardless of
   # how the host app configures (or doesn't configure) blob access.
   class ScreenshotsController < DashboardController
+    include ActiveStorage::Streaming if defined?(::ActiveStorage::Streaming)
+
     def show
       screenshot = Feedback.for_tenant(current_tenant)
                            .find(params[:feedback_id]).screenshots.find(params[:id])
 
-      send_data screenshot.download,
-                filename: screenshot.filename.to_s,
-                type: screenshot.content_type,
-                disposition: 'inline'
+      response.headers['X-Content-Type-Options'] = 'nosniff'
+      response.headers['Cache-Control'] = 'private, no-store'
+      send_blob_stream screenshot.blob, disposition: 'inline'
     end
 
     private

data/app/controllers/ideasbugs/submissions_controller.rb

@@ -23,6 +23,7 @@ module Ideasbugs
 
     def create
       feedback = Feedback.new(feedback_params)
+      feedback.page_url = clean_page_url(feedback.page_url)
       feedback.user_agent = request.user_agent
       feedback.tenant = current_tenant
       attribute_author(feedback)

data/app/models/ideasbugs/feedback.rb

@@ -29,6 +29,7 @@ module Ideasbugs
     scope :newest_first, -> { order(id: :desc) }
 
     STATUSES.each do |status|
+      scope status, -> { where(status:) }
       define_method(:"#{status}?") { self.status == status }
     end
 

data/lib/ideasbugs/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Ideasbugs
-  VERSION = '0.10.1'
+  VERSION = '1.0.1'
 end

data/{app/helpers → lib}/ideasbugs/widget_helper.rb

@@ -3,7 +3,10 @@
 module Ideasbugs
   # Included into the host's ActionView. Drop `<%= ideasbugs_tag %>`
   # before </body> in your layout; it renders nothing unless feedback is
-  # enabled for the request.
+  # enabled for the request. This lives under lib and is required before the
+  # engine registers its Action View load hook: a host initializer may load
+  # Action View before Rails sets up application autoloaders, when an
+  # app/helpers constant cannot be resolved yet.
   module WidgetHelper
     def ideasbugs_tag
       return unless Ideasbugs.enabled?(request)

data/lib/ideasbugs.rb

@@ -3,6 +3,7 @@
 require 'ideasbugs/version'
 require 'ideasbugs/configuration'
 require 'ideasbugs/widget'
+require 'ideasbugs/widget_helper'
 require 'ideasbugs/has_feedback'
 require 'ideasbugs/seeds'
 require 'ideasbugs/engine'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ideasbugs
 version: !ruby/object:Gem::Version
-  version: 0.10.1
+  version: 1.0.1
 platform: ruby
 authors:
 - Yaroslav Shmarov
@@ -16,6 +16,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -23,6 +26,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
 description: |
   A mountable Rails engine that adds a "Send feedback" widget to your app —
   bug reports, feature requests, screenshots — and stores submissions in your
@@ -39,6 +45,7 @@ files:
 - MIT-LICENSE
 - README.md
 - Rakefile
+- SECURITY.md
 - app/controllers/concerns/ideasbugs/request_context.rb
 - app/controllers/ideasbugs/application_controller.rb
 - app/controllers/ideasbugs/dashboard_controller.rb
@@ -46,7 +53,6 @@ files:
 - app/controllers/ideasbugs/screenshots_controller.rb
 - app/controllers/ideasbugs/submissions_controller.rb
 - app/controllers/ideasbugs/widgets_controller.rb
-- app/helpers/ideasbugs/widget_helper.rb
 - app/models/ideasbugs/application_record.rb
 - app/models/ideasbugs/feedback.rb
 - app/views/ideasbugs/feedbacks/_feedback_panel.html.erb
@@ -96,6 +102,7 @@ files:
 - lib/ideasbugs/version.rb
 - lib/ideasbugs/widget.js
 - lib/ideasbugs/widget.rb
+- lib/ideasbugs/widget_helper.rb
 - lib/tasks/ideasbugs_tasks.rake
 homepage: https://github.com/yshmarov/ideasbugs
 licenses:
@@ -120,7 +127,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: 'In-app product feedback collection for Rails: a drop-in widget and a built-in
   triage dashboard.'