RubyGems - ideasbugs - Versions diffs - 0.5.1 → 0.5.3 - Mend

ideasbugs 0.5.1 → 0.5.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

checksums.yaml +4 -4
data/CHANGELOG.md +29 -0
data/app/controllers/ideasbugs/widgets_controller.rb +26 -0
data/config/routes.rb +3 -0
data/lib/ideasbugs/version.rb +1 -1
data/lib/ideasbugs/widget.js +30 -1
data/lib/ideasbugs/widget.rb +21 -8
metadata +2 -1

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 04077c3c3deaf5d2f5591f78dd1e1de8086474289b9a31d4168c84fb0eb9f1f6
-  data.tar.gz: 2882e9f33d9664088738c5b6bf953df30b3da4a1ac7416316b7c2fdeabd91759
+  metadata.gz: 29449ba188f3e7da8299dd22ff9f03795cd5b645734596619eb5318535c8a809
+  data.tar.gz: 6d5853b6e7db868f7caa5203575d09fef1d1fde2a9823ee32e09e6dbf82f9f05
 SHA512:
-  metadata.gz: c397a6cd994a8bd4af419a91433db814da8520e7c627e697dfac5ae7225214c4751eee22fa5260017d2e3cda335a8ef5014e4be6310aa2bd0919553ee0cbc2c3
-  data.tar.gz: b566747ad2b0fbda18e9d572ff031ff1c0f3f0142134d9af38e270ba41c94439ff3aca94fdbf5e8ae990aca706630a5a4bb7716b4d320ae03184d50e90042543
+  metadata.gz: 7fbd87765283a0c53e058c50d8a94318b0ddd79b4abb43c14fcf4782b1041c6b984bb4740e927f5d4fb8a9451718a3676afa42dfb4d1ffb686cb20afb981cee2
+  data.tar.gz: 60fc9116964d2035b5640201eedbfa4ffefd766c517f89fb0a1aab03e2178365bfc53856f220706631638be6f6b09e9e345fc881a82daf869c8774c694ca1a59

data/CHANGELOG.md CHANGED Viewed

@@ -1,5 +1,34 @@
 # Changelog
+## 0.5.3 (2026-07-25)
+- The widget's dynamic messages are now announced to screen readers: the
+  validation/save error paragraph is a `role="alert"` region created before
+  any text lands in it, and the post-submit thanks note is an
+  `aria-live="polite"` status region inserted empty and then filled, so the
+  announcement actually fires.
+- The page behind the open widget dialog no longer scrolls: opening the
+  dialog locks `<html>` overflow and closing it restores the previous value.
+  Because the lock lives on `<html>` (which survives Turbo body swaps), the
+  per-visit render step also releases a stale lock whenever the overlay is
+  no longer in the DOM.
+## 0.5.2 (2026-07-25)
+- **Fixed: the widget went dead after Turbo Drive navigations under a
+  nonce-based CSP.** The widget code used to be inlined as a nonce'd
+  `<script>` block. Turbo Drive soft visits swap the `<body>` and re-execute
+  body scripts against the *original* page's CSP header, so the freshly
+  minted inline nonce was refused and the widget never booted — until the
+  user hard-reloaded. The code is now served by the engine as a same-origin,
+  content-fingerprinted script (`<mount_path>/widget.js?v=<md5>`), which
+  `script-src 'self'` covers on every visit, first or soft. The fingerprinted
+  URL is immutable (new code means a new URL) and is cached publicly for a
+  year; any other `?v` only ETag-revalidates. The `nonce` attribute is still
+  stamped on the tag for hosts whose `script-src` has no `'self'`. The config
+  `type="application/json"` block is unchanged and stays inline — it is data,
+  not code, and needs no nonce.
 ## 0.5.1 (2026-07-25)
 - The widget dialog is now full-screen on mobile (≤ 480px): edge-to-edge,

data/app/controllers/ideasbugs/widgets_controller.rb ADDED Viewed

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+module Ideasbugs
+  # Serves the widget JavaScript as a plain same-origin script. Same-origin
+  # matters: under a `script-src 'self'` (or nonce-based) CSP, an external
+  # script from the app's own host is always allowed — including when Turbo
+  # Drive swaps the <body> and re-runs body scripts under the *original*
+  # page's CSP header, where a freshly minted inline nonce would be refused.
+  class WidgetsController < ApplicationController
+    # The script is static and carries no user data; without this, Rails'
+    # cross-origin JavaScript guard refuses to serve it to a plain
+    # <script src> request.
+    skip_forgery_protection
+    # The script URL carries a content fingerprint (?v=<md5>), so stale code
+    # is structurally impossible: new code means a new URL. The canonical
+    # fingerprinted URL is immutable and gets long-lived caching; anything
+    # else only ETag-revalidates.
+    def show
+      expires_in 1.year, public: true if params[:v] == Widget.fingerprint
+      return unless stale?(etag: [Ideasbugs::VERSION, Widget.fingerprint])
+      render plain: Widget.javascript, content_type: 'text/javascript'
+    end
+  end
+end

data/config/routes.rb CHANGED Viewed

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 Ideasbugs::Engine.routes.draw do
+  # The widget code, served same-origin (see WidgetsController for why).
+  get 'widget.js', to: 'widgets#show', as: :widget
   # create is the public widget endpoint; the rest is the triage dashboard.
   resources :feedbacks, only: %i[create index show update destroy] do
     # Screenshots stream through the dashboard's own gate, never via public

data/lib/ideasbugs/version.rb CHANGED Viewed

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 module Ideasbugs
-  VERSION = '0.5.1'
+  VERSION = '0.5.3'
 end

data/lib/ideasbugs/widget.js CHANGED Viewed

@@ -20,6 +20,20 @@
   var Z = 2147483000;
   var overlay = null;
   var lastFocused = null;
+  var savedOverflow = null;
+  // The lock lives on <html>, which survives Turbo body swaps — so a swap can
+  // drop the overlay without closeForm() running; render() releases it then.
+  function lockScroll() {
+    savedOverflow = document.documentElement.style.overflow;
+    document.documentElement.style.overflow = "hidden";
+  }
+  function unlockScroll() {
+    if (savedOverflow === null) return;
+    document.documentElement.style.overflow = savedOverflow;
+    savedOverflow = null;
+  }
   function ready(fn) {
     if (document.readyState === "loading") {
@@ -55,6 +69,10 @@
     // Re-read on each visit: the config block is data (not an executed
     // script), so it reflects the page Turbo just rendered.
     config = readConfig() || config;
+    if (overlay && !document.body.contains(overlay)) {
+      overlay = null;
+      unlockScroll();
+    }
     injectStyles();
     if (config.showButton !== false) buildButton();
   }
@@ -108,6 +126,7 @@
     dialog.appendChild(form());
     overlay.appendChild(dialog);
     document.body.appendChild(overlay);
+    lockScroll();
     // Keep Tab (and Shift+Tab) cycling inside the dialog while it is open.
     overlay.addEventListener("keydown", trapFocus);
@@ -120,6 +139,7 @@
     if (!overlay) return;
     overlay.remove();
     overlay = null;
+    unlockScroll();
     if (lastFocused && lastFocused.focus) lastFocused.focus();
   }
@@ -172,6 +192,9 @@
     var error = document.createElement("p");
     error.className = "idb-error";
+    // The alert region exists (empty) before any text lands in it, so
+    // screen readers announce the message showError() later drops in.
+    error.setAttribute("role", "alert");
     error.hidden = true;
     form.appendChild(error);
@@ -331,8 +354,14 @@
     dialog.textContent = "";
     var note = document.createElement("p");
     note.className = "idb-thanks";
-    note.textContent = config.labels.thanks;
+    // Success is a status, not an alert. Insert the region empty and fill it
+    // afterwards: screen readers announce text landing in an existing polite
+    // region, but may skip a node that arrives already carrying its text.
+    note.setAttribute("aria-live", "polite");
     dialog.appendChild(note);
+    setTimeout(function () {
+      note.textContent = config.labels.thanks;
+    }, 0);
     setTimeout(closeForm, 1600);
   }

data/lib/ideasbugs/widget.rb CHANGED Viewed

@@ -1,15 +1,16 @@
 # frozen_string_literal: true
 require 'json'
+require 'digest'
 module Ideasbugs
   # Serves the self-contained browser widget. The JavaScript is plain ES (no
   # framework, no build step) and styles itself inline, so it drops into any
-  # Rails app regardless of its CSS or JS setup. It is inlined into the page
-  # rather than served as a separate asset to avoid any dependency on the
-  # host's asset pipeline — and it lives under lib/ (not app/assets/) so a
-  # host that *does* run a pipeline never ingests it either: nothing lands in
-  # the host's asset namespace or precompiled output.
+  # Rails app regardless of its CSS or JS setup. It is served by the engine's
+  # own controller rather than through the host's asset pipeline, so there is
+  # no dependency on it — and it lives under lib/ (not app/assets/) so a host
+  # that *does* run a pipeline never ingests it either: nothing lands in the
+  # host's asset namespace or precompiled output.
   module Widget
     SOURCE = File.expand_path('widget.js', __dir__)
@@ -22,6 +23,13 @@ module Ideasbugs
         @javascript ||= File.read(SOURCE)
       end
+      # Content fingerprint for the cache-busting script URL: a changed file
+      # is a changed URL, so no browser can ever run stale widget code —
+      # Safari has been caught ignoring must-revalidate on same-URL scripts.
+      def fingerprint
+        @fingerprint ||= Digest::MD5.hexdigest(javascript)
+      end
       # The two <script> tags the helper renders.
       #
       # The config rides in a `type="application/json"` block: it is *data*,
@@ -29,8 +37,12 @@ module Ideasbugs
       # re-run it on a soft visit — which means it needs no CSP nonce and the
       # widget can re-read the *current* page's config on every `turbo:load`.
       #
-      # `nonce:` stamps only the widget script (the code), so it runs under a
-      # nonce-based Content-Security-Policy; pass nil when the app has no nonce.
+      # The code is a same-origin `src` script served by the engine — NOT
+      # inlined. Under a nonce-based CSP, Turbo Drive body swaps re-run body
+      # scripts against the *original* page's CSP header, so a fresh inline
+      # nonce gets refused; a same-origin src is covered by `'self'` on every
+      # visit. `nonce:` is still stamped for hosts whose script-src has no
+      # 'self'; pass nil when the app has no nonce.
       def snippet(endpoint:, locale:, nonce: nil)
         config = {
           endpoint: endpoint,
@@ -46,9 +58,10 @@ module Ideasbugs
         # Escape "</" so a value can't close the <script> block early.
         json = config.to_json.gsub('</', '<\/')
         nonce_attr = nonce ? %( nonce="#{nonce}") : ''
+        src = "#{Ideasbugs.config.mount_path.chomp('/')}/widget.js?v=#{fingerprint}"
         %(<script type="application/json" data-ideasbugs-config>#{json}</script>) +
-          %(<script data-ideasbugs-widget#{nonce_attr}>#{javascript}</script>)
+          %(<script src="#{src}" defer#{nonce_attr} data-ideasbugs-widget></script>)
       end
       private

metadata CHANGED Viewed

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ideasbugs
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.5.3
 platform: ruby
 authors:
 - Yaroslav Shmarov
@@ -41,6 +41,7 @@ files:
 - app/controllers/ideasbugs/application_controller.rb
 - app/controllers/ideasbugs/feedbacks_controller.rb
 - app/controllers/ideasbugs/screenshots_controller.rb
+- app/controllers/ideasbugs/widgets_controller.rb
 - app/helpers/ideasbugs/widget_helper.rb
 - app/models/ideasbugs/application_record.rb
 - app/models/ideasbugs/feedback.rb