ideasbugs 0.7.8 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9875f27cec0e4396ed1c2b269cea94335852c1a4776850fd0944bf9e52f5d154
-  data.tar.gz: c2301f7df468b8659b99cafb8e4f52e118b0f23f70c983359a1d236368e75121
+  metadata.gz: 19b7014d62b42ad3b3a763edf8907a7e1e0d2a67ab7b5ae1001d1f3440cc0d67
+  data.tar.gz: 0f327125389c6ccc2d57f180b09d24607f383d03ac1d70ad13c9c250d3670842
 SHA512:
-  metadata.gz: dd3615cbda1b4455a49a345ec5c0620a810547220a44ead6434c1a912f308fad963b4f022b5e9ea3c78140c72d33365420e43c893cb4330975d929ebd9ded36b
-  data.tar.gz: b29d7052738b06accc692290f3973c88ef7537fa26cdd5d728da46036267bc581310012600b18d1f20fe9113abd162f733f4b1045867f793f0ae9452ed0276ce
+  metadata.gz: f1f27d97cda7c058c8d12c4498e30a57a9bc3899ce61aca61cb4cb5b542c4359b48e69d7a00c8867ddddc421cb561fb843039d6ac36bce4b164d9c140229e421
+  data.tar.gz: 9bca34a90ac4d1e4f15ddfb8263a0e8690aa61cb669f1519e83c43481e5e64c05133ec5317c4432b02484af66fdf2123f4574fbdb9710930bd1c0cdb94d3ed0f

data/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.8.0
+
+- **`config.admin_layout` now works on its own.** The dashboard's stylesheet was
+  declared in the gem's layout, so replacing that layout dropped it and the
+  dashboard rendered unstyled. It moves into the views, so every layout gets it
+  with nothing asked of the host.
+- **The dashboard stylesheet no longer claims selectors it does not own.** It
+  styled bare `*`, `body` and `a`, and its `.container`, `.card` and `.tabs` are
+  names other frameworks use too. Component rules now nest inside an
+  `.ib-dashboard` wrapper the views render, and every custom property is `--ib-`
+  prefixed — that collision ran both ways, so a host defining `--bg` recoloured
+  the dashboard just as easily.
+- **Added `config.base_controller_class`.** Name the controller your own admin
+  inherits from and the dashboard adopts its layout, helpers, authentication and
+  request context. Default is unchanged.
+- **`create` moved to `Ideasbugs::SubmissionsController`.** One controller served
+  both the widget's write endpoint and the triage actions, so
+  `base_controller_class` would have put staff authentication in front of every
+  bug report. `POST /feedbacks` now routes there; the URL is unchanged. If you
+  referenced `Ideasbugs::FeedbacksController#create`, that is the breaking change
+  in this release. The per-IP rate limiter moved with the action.
+- **Migrations follow the host's `primary_key_type`,** the same
+  `Rails.configuration.generators` lookup Rails' own Active Storage migration
+  does. A uuid-keyed app has a uuid `active_storage_attachments.record_id`, so a
+  bigint table here could never hold a screenshot: `attach` raised
+  `NotNullViolation`. A host that set nothing gets an identical migration.
+- A `BackboneTest` now fails the build on any of the above regressing.
+
 ## 0.7.8
 
 - Adds `AGENTS.md`: install and integration instructions written for coding

data/README.md

@@ -102,6 +102,8 @@ Everything is optional — a fresh install works with zero config. In
 | Option                | Default                     | What it does                                        |
 | --------------------- | --------------------------- | --------------------------------------------------- |
 | `authorize_admin`     | development only            | **Who can read the dashboard.** Override before deploying |
+| `base_controller_class` | `ActionController::Base` | Controller the dashboard inherits — name your admin's and it adopts its layout, helpers and auth |
+| `admin_layout`        | the gem's own               | Just the shell, if you don't want the whole controller |
 | `enabled`             | everyone                    | Who can send feedback. `false` hides the widget and rejects posts |
 | `current_user`        | `nil`                       | Attribute a submission to a user. Receives the request |
 | `author_label`        | the user's `email`          | Short label stored and shown in the dashboard        |

data/app/controllers/concerns/ideasbugs/request_context.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Ideasbugs
+  # Who is asking, which tenant they are in, and the gates that answer both.
+  #
+  # A concern rather than inherited behaviour because the engine has two
+  # controller roots: the public endpoints hang off ActionController::Base, and
+  # the dashboard hangs off whatever the host set as `base_controller_class`.
+  module RequestContext
+    extend ActiveSupport::Concern
+
+    private
+
+    def ideasbugs_admin_layout
+      Ideasbugs.config.admin_layout
+    end
+
+    def current_author
+      return @current_author if defined?(@current_author)
+
+      @current_author = Ideasbugs.config.current_user.call(request)
+    end
+
+    # The tenant for this request (nil = the single global board). Every read
+    # and write scopes to it, so a resolved-tenant admin only ever sees and
+    # writes their own tenant's feedback.
+    def current_tenant
+      return @current_tenant if defined?(@current_tenant)
+
+      @current_tenant = Ideasbugs.tenant(request)
+    end
+
+    def require_enabled
+      head :forbidden unless Ideasbugs.enabled?(request)
+    end
+
+    # Server-side gate for the dashboard. Default: development only.
+    def require_admin
+      return if Ideasbugs.admin?(request)
+
+      render plain: 'Forbidden. Set Ideasbugs.config.authorize_admin to grant access.',
+             status: :forbidden
+    end
+
+    # Every dashboard query starts here, so an admin can only ever load,
+    # triage, or delete feedback in their own tenant — a cross-tenant id 404s.
+    def tenant_scope
+      Feedback.for_tenant(current_tenant)
+    end
+  end
+end

data/app/controllers/ideasbugs/application_controller.rb

@@ -1,28 +1,16 @@
 # frozen_string_literal: true
 
 module Ideasbugs
+  # Root of the engine's PUBLIC surface: widget.js and the submission endpoint.
+  # These stay on a plain ActionController::Base deliberately — someone filing a
+  # bug report must not be routed through a host's admin controller, which would
+  # demand a staff session for the widget.
+  #
+  # The dashboard's root is DashboardController, and that is where
+  # `config.base_controller_class` applies.
   class ApplicationController < ActionController::Base
-    protect_from_forgery with: :exception
-
-    private
-
-    def ideasbugs_admin_layout
-      Ideasbugs.config.admin_layout
-    end
-
-    def current_author
-      return @current_author if defined?(@current_author)
+    include RequestContext
 
-      @current_author = Ideasbugs.config.current_user.call(request)
-    end
-
-    # The tenant for this request (nil = the single global board). Every read
-    # and write scopes to it, so a resolved-tenant admin only ever sees and
-    # writes their own tenant's feedback.
-    def current_tenant
-      return @current_tenant if defined?(@current_tenant)
-
-      @current_tenant = Ideasbugs.tenant(request)
-    end
+    protect_from_forgery with: :exception
   end
 end

data/app/controllers/ideasbugs/dashboard_controller.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Ideasbugs
+  # Root of the STAFF surface: the triage queue and the screenshot proxy.
+  #
+  # Inherits from `config.base_controller_class` — by default a plain
+  # ActionController::Base, which is why `authorize_admin` exists. Point it at
+  # the controller your own admin already inherits from and the dashboard picks
+  # up that stack wholesale: your layout, your helpers, your authentication, and
+  # whatever request context your before_actions establish.
+  #
+  # Only the dashboard hangs off it. The widget's endpoint stays on
+  # ApplicationController, so wiring an admin base controller here can never
+  # demand a staff session from someone filing a report.
+  class DashboardController < Ideasbugs.base_controller
+    include RequestContext
+
+    # A host base controller brings its own layout, and declaring one here would
+    # override it. So the gem only claims the layout when it owns the decision:
+    # no host base controller, or a host that named an `admin_layout` explicitly.
+    layout :ideasbugs_admin_layout unless superclass != ActionController::Base &&
+                                          Ideasbugs.config.admin_layout == Configuration::DEFAULT_ADMIN_LAYOUT
+
+    before_action :require_admin
+
+    # A host base controller has configured CSRF already; declaring it twice
+    # would run the check twice.
+    protect_from_forgery with: :exception if superclass == ActionController::Base
+  end
+end

data/app/controllers/ideasbugs/feedbacks_controller.rb

@@ -1,27 +1,12 @@
 # frozen_string_literal: true
 
 module Ideasbugs
-  class FeedbacksController < ApplicationController
+  class FeedbacksController < DashboardController
     PER_PAGE = 50
 
-    layout :ideasbugs_admin_layout, except: :create
-
     # The widget posts here; everything else is the triage dashboard.
-    before_action :require_enabled, only: :create
-    before_action :require_admin, except: :create
     before_action :set_feedback, only: %i[show update destroy]
 
-    # Throttle the public endpoint per IP so one user or bot can't flood the
-    # table (each submission may carry megabytes of screenshots). Uses the
-    # rate limiter built into Rails 7.2+ (backed by Rails.cache); on Rails 7.1
-    # this is a no-op. Tune or disable via config.rate_limit — read once at
-    # boot, after the host's initializer.
-    if respond_to?(:rate_limit) && Ideasbugs.config.rate_limit
-      rate_limit(**Ideasbugs.config.rate_limit,
-                 only: :create,
-                 with: -> { render json: { errors: [t_error(:error_rate_limited)] }, status: :too_many_requests })
-    end
-
     def index
       @status = Feedback::STATUSES.include?(params[:status]) ? params[:status] : 'open'
       @kind = Ideasbugs.config.kinds.map(&:to_s).include?(params[:kind]) ? params[:kind] : nil
@@ -46,23 +31,6 @@ module Ideasbugs
 
     def show; end
 
-    def create
-      feedback = Feedback.new(feedback_params)
-      feedback.user_agent = request.user_agent
-      feedback.tenant = current_tenant
-      attribute_author(feedback)
-
-      error = attach_screenshots(feedback)
-      return render json: { errors: [error] }, status: :unprocessable_entity if error
-
-      if feedback.save
-        notify_host(feedback)
-        head :created
-      else
-        render json: { errors: feedback.errors.full_messages }, status: :unprocessable_entity
-      end
-    end
-
     def update
       @feedback.update!(params.require(:feedback).permit(:status))
       redirect_back fallback_location: feedback_path(@feedback), status: :see_other
@@ -75,28 +43,10 @@ module Ideasbugs
 
     private
 
-    def require_enabled
-      head :forbidden unless Ideasbugs.enabled?(request)
-    end
-
-    # Server-side gate for the dashboard. Default: development only.
-    def require_admin
-      return if Ideasbugs.admin?(request)
-
-      render plain: 'Forbidden. Set Ideasbugs.config.authorize_admin to grant access.',
-             status: :forbidden
-    end
-
     def set_feedback
       @feedback = tenant_scope.find(params[:id])
     end
 
-    # Every dashboard query starts here, so an admin can only ever load,
-    # triage, or delete feedback in their own tenant — a cross-tenant id 404s.
-    def tenant_scope
-      Feedback.for_tenant(current_tenant)
-    end
-
     # Case-insensitive match on the free-text columns. LOWER() keeps it
     # portable across SQLite/PostgreSQL/MySQL, and the explicit ESCAPE makes
     # the sanitized backslash escapes work on SQLite, which has no default
@@ -109,62 +59,5 @@ module Ideasbugs
         q: pattern
       )
     end
-
-    # The host's hook must never turn a saved submission into a 500 — the
-    # feedback is in the database; notification failures are the host's logs'
-    # problem.
-    def notify_host(feedback)
-      Ideasbugs.config.on_submit.call(feedback)
-    rescue StandardError => e
-      Rails.logger.error("ideasbugs: on_submit hook raised #{e.class}: #{e.message}")
-    end
-
-    def feedback_params
-      params.require(:feedback).permit(:kind, :section, :message, :page_url)
-    end
-
-    def attribute_author(feedback)
-      author = current_author
-      return unless author
-
-      feedback.author_id = author.id.to_s if author.respond_to?(:id)
-      feedback.author_label = Ideasbugs.config.author_label.call(author)
-    end
-
-    # Validates and attaches uploads. Returns an error message, or nil when
-    # everything (including "no screenshots at all") is fine.
-    def attach_screenshots(feedback)
-      files = Array(params.dig(:feedback, :screenshots)).reject(&:blank?)
-      return nil if files.empty?
-      return t_error(:error_save) unless Ideasbugs.config.screenshots_enabled?
-      return t_error(:error_too_many, count: Ideasbugs.config.max_screenshots) if too_many?(files)
-      return t_error(:error_too_large, size: max_size_mb) if files.any? { |f| f.size > max_size }
-      return t_error(:error_save) unless files.all? { |f| f.content_type.to_s.start_with?('image/') }
-
-      feedback.screenshots.attach(files)
-      nil
-    end
-
-    def too_many?(files)
-      files.size > Ideasbugs.config.max_screenshots
-    end
-
-    def max_size
-      Ideasbugs.config.max_screenshot_size
-    end
-
-    def max_size_mb
-      max_size / (1024 * 1024)
-    end
-
-    def t_error(key, **args)
-      defaults = {
-        error_save: 'Could not send feedback. Please try again.',
-        error_too_many: 'Too many screenshots (max %{count}).',
-        error_too_large: 'A screenshot is too large (max %{size} MB).',
-        error_rate_limited: 'Too many submissions. Please wait a moment and try again.'
-      }
-      I18n.t(key, scope: :ideasbugs, default: defaults[key], **args)
-    end
   end
 end

data/app/controllers/ideasbugs/screenshots_controller.rb

@@ -6,9 +6,7 @@ module Ideasbugs
   # screenshots can contain anything a user's screen showed, so they must never
   # be reachable without passing the same gate as the dashboard — regardless of
   # how the host app configures (or doesn't configure) blob access.
-  class ScreenshotsController < ApplicationController
-    before_action :require_admin
-
+  class ScreenshotsController < DashboardController
     def show
       screenshot = Feedback.for_tenant(current_tenant)
                            .find(params[:feedback_id]).screenshots.find(params[:id])

data/app/controllers/ideasbugs/submissions_controller.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+module Ideasbugs
+  # The widget's write endpoint: POST /feedbacks.
+  #
+  # Public, so it stays on ApplicationController and never inherits a host's
+  # admin base controller — someone filing a bug report must not be asked for a
+  # staff session. The triage actions live in FeedbacksController, which does
+  # inherit it.
+  class SubmissionsController < ApplicationController
+    before_action :require_enabled
+
+    # Throttle the public endpoint per IP so one user or bot can't flood the
+    # table (each submission may carry megabytes of screenshots). Uses the
+    # rate limiter built into Rails 7.2+ (backed by Rails.cache); on Rails 7.1
+    # this is a no-op. Tune or disable via config.rate_limit — read once at
+    # boot, after the host's initializer.
+    if respond_to?(:rate_limit) && Ideasbugs.config.rate_limit
+      rate_limit(**Ideasbugs.config.rate_limit,
+                 only: :create,
+                 with: -> { render json: { errors: [t_error(:error_rate_limited)] }, status: :too_many_requests })
+    end
+
+    def create
+      feedback = Feedback.new(feedback_params)
+      feedback.user_agent = request.user_agent
+      feedback.tenant = current_tenant
+      attribute_author(feedback)
+
+      error = attach_screenshots(feedback)
+      return render json: { errors: [error] }, status: :unprocessable_entity if error
+
+      if feedback.save
+        notify_host(feedback)
+        head :created
+      else
+        render json: { errors: feedback.errors.full_messages }, status: :unprocessable_entity
+      end
+    end
+
+    private
+
+    # The host's hook must never turn a saved submission into a 500 — the
+    # feedback is in the database; notification failures are the host's logs'
+    # problem.
+    def notify_host(feedback)
+      Ideasbugs.config.on_submit.call(feedback)
+    rescue StandardError => e
+      Rails.logger.error("ideasbugs: on_submit hook raised #{e.class}: #{e.message}")
+    end
+
+    def feedback_params
+      params.require(:feedback).permit(:kind, :section, :message, :page_url)
+    end
+
+    def attribute_author(feedback)
+      author = current_author
+      return unless author
+
+      feedback.author_id = author.id.to_s if author.respond_to?(:id)
+      feedback.author_label = Ideasbugs.config.author_label.call(author)
+    end
+
+    # Validates and attaches uploads. Returns an error message, or nil when
+    # everything (including "no screenshots at all") is fine.
+    def attach_screenshots(feedback)
+      files = Array(params.dig(:feedback, :screenshots)).reject(&:blank?)
+      return nil if files.empty?
+      return t_error(:error_save) unless Ideasbugs.config.screenshots_enabled?
+      return t_error(:error_too_many, count: Ideasbugs.config.max_screenshots) if too_many?(files)
+      return t_error(:error_too_large, size: max_size_mb) if files.any? { |f| f.size > max_size }
+      return t_error(:error_save) unless files.all? { |f| f.content_type.to_s.start_with?('image/') }
+
+      feedback.screenshots.attach(files)
+      nil
+    end
+
+    def too_many?(files)
+      files.size > Ideasbugs.config.max_screenshots
+    end
+
+    def max_size_mb
+      max_size / (1024 * 1024)
+    end
+
+    def max_size
+      Ideasbugs.config.max_screenshot_size
+    end
+
+    def t_error(key, **args)
+      defaults = {
+        error_save: 'Could not send feedback. Please try again.',
+        error_too_many: 'Too many screenshots (max %{count}).',
+        error_too_large: 'A screenshot is too large (max %{size} MB).',
+        error_rate_limited: 'Too many submissions. Please wait a moment and try again.'
+      }
+      I18n.t(key, scope: :ideasbugs, default: defaults[key], **args)
+    end
+  end
+end

data/app/views/ideasbugs/feedbacks/index.html.erb

@@ -1,99 +1,101 @@
 <% content_for :body_class, 'ib-index' %>
 
-<h1><%= t('ideasbugs.dashboard.title', default: 'IdeasBugs') %></h1>
+<%= render layout: 'ideasbugs/shared/dashboard' do %>
+  <h1><%= t('ideasbugs.dashboard.title', default: 'IdeasBugs') %></h1>
 
-<div class="triage-shell <%= 'has-selected' if @selected_feedback %>">
-  <aside class="triage-sidebar" aria-label="<%= t('ideasbugs.dashboard.feedback', default: 'Feedback') %>">
-    <div class="tabs">
-      <% Ideasbugs::Feedback::STATUSES.each do |status| %>
-        <%= link_to feedbacks_path(status: status, kind: @kind, q: @query),
-                    class: ('active' if status == @status) do %>
-          <%= t("ideasbugs.statuses.#{status}", default: status.humanize) %>
-          <span class="count"><%= @counts.fetch(status, 0) %></span>
+  <div class="triage-shell <%= 'has-selected' if @selected_feedback %>">
+    <aside class="triage-sidebar" aria-label="<%= t('ideasbugs.dashboard.feedback', default: 'Feedback') %>">
+      <div class="tabs">
+        <% Ideasbugs::Feedback::STATUSES.each do |status| %>
+          <%= link_to feedbacks_path(status: status, kind: @kind, q: @query),
+                      class: ('active' if status == @status) do %>
+            <%= t("ideasbugs.statuses.#{status}", default: status.humanize) %>
+            <span class="count"><%= @counts.fetch(status, 0) %></span>
+          <% end %>
         <% end %>
-      <% end %>
-    </div>
+      </div>
 
-    <form class="filters" method="get">
-      <input type="hidden" name="status" value="<%= @status %>">
-      <select name="kind" onchange="this.form.submit()">
-        <option value=""><%= t('ideasbugs.dashboard.all_kinds', default: 'All types') %></option>
-        <% Ideasbugs.config.kinds.each do |kind| %>
-          <option value="<%= kind %>" <%= 'selected' if kind.to_s == @kind %>>
-            <%= t("ideasbugs.kinds.#{kind}", default: kind.to_s.humanize) %>
-          </option>
-        <% end %>
-      </select>
-      <input type="search" name="q" value="<%= @query %>"
-             placeholder="<%= t('ideasbugs.dashboard.search_placeholder', default: 'Search message, author, section…') %>"
-             aria-label="<%= t('ideasbugs.dashboard.search', default: 'Search') %>">
-      <button><%= t('ideasbugs.dashboard.search', default: 'Search') %></button>
-    </form>
+      <form class="filters" method="get">
+        <input type="hidden" name="status" value="<%= @status %>">
+        <select name="kind" onchange="this.form.submit()">
+          <option value=""><%= t('ideasbugs.dashboard.all_kinds', default: 'All types') %></option>
+          <% Ideasbugs.config.kinds.each do |kind| %>
+            <option value="<%= kind %>" <%= 'selected' if kind.to_s == @kind %>>
+              <%= t("ideasbugs.kinds.#{kind}", default: kind.to_s.humanize) %>
+            </option>
+          <% end %>
+        </select>
+        <input type="search" name="q" value="<%= @query %>"
+               placeholder="<%= t('ideasbugs.dashboard.search_placeholder', default: 'Search message, author, section…') %>"
+               aria-label="<%= t('ideasbugs.dashboard.search', default: 'Search') %>">
+        <button><%= t('ideasbugs.dashboard.search', default: 'Search') %></button>
+      </form>
 
-    <div class="feedback-list">
-      <% if @feedbacks.any? %>
-        <% @feedbacks.each do |feedback| %>
-          <%= link_to feedbacks_path(status: @status, kind: @kind, q: @query, page: @page,
-                                     feedback_id: feedback.id),
-                      class: ['feedback-row', ('active' if @selected_feedback&.id == feedback.id)].compact do %>
-            <span class="feedback-main">
-              <span class="feedback-topline">
-                <span class="badge kind-<%= feedback.kind.to_s.parameterize %>">
-                  <%= t("ideasbugs.kinds.#{feedback.kind}", default: feedback.kind.humanize) %>
+      <div class="feedback-list">
+        <% if @feedbacks.any? %>
+          <% @feedbacks.each do |feedback| %>
+            <%= link_to feedbacks_path(status: @status, kind: @kind, q: @query, page: @page,
+                                       feedback_id: feedback.id),
+                        class: ['feedback-row', ('active' if @selected_feedback&.id == feedback.id)].compact do %>
+              <span class="feedback-main">
+                <span class="feedback-topline">
+                  <span class="badge kind-<%= feedback.kind.to_s.parameterize %>">
+                    <%= t("ideasbugs.kinds.#{feedback.kind}", default: feedback.kind.humanize) %>
+                  </span>
+                  <span class="badge status-<%= feedback.status %>">
+                    <%= t("ideasbugs.statuses.#{feedback.status}", default: feedback.status.humanize) %>
+                  </span>
+                  <span class="muted feedback-time" title="<%= feedback.created_at %>">
+                    <%= time_ago_in_words(feedback.created_at) %>
+                  </span>
                 </span>
-                <span class="badge status-<%= feedback.status %>">
-                  <%= t("ideasbugs.statuses.#{feedback.status}", default: feedback.status.humanize) %>
+                <span class="feedback-message"><%= truncate(feedback.message, length: 120) %></span>
+                <span class="muted feedback-meta">
+                  <span>#<%= feedback.id %></span>
+                  <% if @show_section && feedback.section.present? %>
+                    <span class="feedback-section"><%= feedback.section %></span>
+                  <% end %>
+                  <% if feedback.author_label.present? %>
+                    <span><%= feedback.author_label %></span>
+                  <% end %>
                 </span>
-                <span class="muted feedback-time" title="<%= feedback.created_at %>">
-                  <%= time_ago_in_words(feedback.created_at) %>
-                </span>
-              </span>
-              <span class="feedback-message"><%= truncate(feedback.message, length: 120) %></span>
-              <span class="muted feedback-meta">
-                <span>#<%= feedback.id %></span>
-                <% if @show_section && feedback.section.present? %>
-                  <span class="feedback-section"><%= feedback.section %></span>
-                <% end %>
-                <% if feedback.author_label.present? %>
-                  <span><%= feedback.author_label %></span>
-                <% end %>
               </span>
-            </span>
-            <% if feedback.screenshots? %>
-              <span class="muted attachment-count">📎 <%= feedback.screenshots.count %></span>
+              <% if feedback.screenshots? %>
+                <span class="muted attachment-count">📎 <%= feedback.screenshots.count %></span>
+              <% end %>
             <% end %>
           <% end %>
+        <% else %>
+          <div class="empty"><%= t('ideasbugs.dashboard.empty', default: 'Nothing here yet.') %></div>
         <% end %>
-      <% else %>
-        <div class="empty"><%= t('ideasbugs.dashboard.empty', default: 'Nothing here yet.') %></div>
-      <% end %>
-    </div>
-
-    <div class="pager">
-      <% if @page > 1 %>
-        <%= link_to t('ideasbugs.dashboard.newer', default: '← Newer'),
-                    feedbacks_path(status: @status, kind: @kind, q: @query, page: @page - 1) %>
-      <% end %>
-      <% if @more %>
-        <%= link_to t('ideasbugs.dashboard.older', default: 'Older →'),
-                    feedbacks_path(status: @status, kind: @kind, q: @query, page: @page + 1) %>
-      <% end %>
-    </div>
-  </aside>
+      </div>
 
-  <main class="triage-detail" aria-label="<%= t('ideasbugs.dashboard.current_feedback', default: 'Current feedback') %>">
-    <% if @selected_feedback %>
-      <p class="mobile-back">
-        <%= link_to t('ideasbugs.dashboard.back', default: '← All feedback'),
-                    feedbacks_path(status: @status, kind: @kind, q: @query, page: @page) %>
-      </p>
-      <%= render 'feedback_panel', feedback: @selected_feedback %>
-    <% else %>
-      <div class="empty-state">
-        <h2><%= t('ideasbugs.dashboard.select_feedback', default: 'Select feedback') %></h2>
-        <p class="muted"><%= t('ideasbugs.dashboard.select_feedback_hint',
-                               default: 'Open an item from the list to triage it without leaving the queue.') %></p>
+      <div class="pager">
+        <% if @page > 1 %>
+          <%= link_to t('ideasbugs.dashboard.newer', default: '← Newer'),
+                      feedbacks_path(status: @status, kind: @kind, q: @query, page: @page - 1) %>
+        <% end %>
+        <% if @more %>
+          <%= link_to t('ideasbugs.dashboard.older', default: 'Older →'),
+                      feedbacks_path(status: @status, kind: @kind, q: @query, page: @page + 1) %>
+        <% end %>
       </div>
-    <% end %>
-  </main>
-</div>
+    </aside>
+
+    <main class="triage-detail" aria-label="<%= t('ideasbugs.dashboard.current_feedback', default: 'Current feedback') %>">
+      <% if @selected_feedback %>
+        <p class="mobile-back">
+          <%= link_to t('ideasbugs.dashboard.back', default: '← All feedback'),
+                      feedbacks_path(status: @status, kind: @kind, q: @query, page: @page) %>
+        </p>
+        <%= render 'feedback_panel', feedback: @selected_feedback %>
+      <% else %>
+        <div class="empty-state">
+          <h2><%= t('ideasbugs.dashboard.select_feedback', default: 'Select feedback') %></h2>
+          <p class="muted"><%= t('ideasbugs.dashboard.select_feedback_hint',
+                                 default: 'Open an item from the list to triage it without leaving the queue.') %></p>
+        </div>
+      <% end %>
+    </main>
+  </div>
+<% end %>

data/app/views/ideasbugs/feedbacks/show.html.erb

@@ -1,8 +1,10 @@
 <% content_for :body_class, 'ib-show' %>
 
-<div class="breadcrumb">
-  <%= link_to t('ideasbugs.dashboard.title', default: 'IdeasBugs'), root_path %>
-  / #<%= @feedback.id %>
-</div>
+<%= render layout: 'ideasbugs/shared/dashboard' do %>
+  <div class="breadcrumb">
+    <%= link_to t('ideasbugs.dashboard.title', default: 'IdeasBugs'), root_path %>
+    / #<%= @feedback.id %>
+  </div>
 
-<%= render 'feedback_panel', feedback: @feedback %>
+  <%= render 'feedback_panel', feedback: @feedback %>
+<% end %>

data/app/views/ideasbugs/shared/_dashboard.html.erb

@@ -0,0 +1,13 @@
+<%# The dashboard's own shell, rendered by the views rather than the layout.
+    That is deliberate: `config.admin_layout` and `config.base_controller_class`
+    both let a host replace the layout, and a stylesheet declared in a layout the
+    host replaces simply vanishes — the dashboard then renders unstyled.
+    Declaring it here means every layout works, host or gem.
+
+    The `ib-dashboard` wrapper is what scopes dashboard.css (see the comment at
+    the top of that file), so it has to enclose the content, not precede it. %>
+<%= stylesheet_link_tag "#{dashboard_stylesheet_path}?v=#{Ideasbugs::Widget.dashboard_stylesheet_fingerprint}",
+                        'data-turbo-track': 'reload' %>
+<div class="ib-dashboard">
+  <%= yield %>
+</div>

data/app/views/layouts/ideasbugs/application.html.erb

@@ -5,12 +5,15 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <%= csrf_meta_tags %>
   <%= csp_meta_tag %>
-  <%= stylesheet_link_tag "#{dashboard_stylesheet_path}?v=#{Ideasbugs::Widget.dashboard_stylesheet_fingerprint}",
-                          'data-turbo-track': 'reload' %>
+  <%# The dashboard's stylesheet is declared by the views
+      (ideasbugs/shared/_dashboard), not here, so it survives a host replacing
+      this layout via config.admin_layout or config.base_controller_class. %>
 </head>
-<body class="<%= content_for?(:body_class) ? yield(:body_class) : '' %>">
-  <div class="container">
-    <%= yield %>
+<body class="ib-page <%= content_for?(:body_class) ? yield(:body_class) : '' %>">
+  <div class="ib-dashboard">
+    <div class="container">
+      <%= yield %>
+    </div>
   </div>
 </body>
 </html>

data/config/routes.rb

@@ -5,8 +5,12 @@ Ideasbugs::Engine.routes.draw do
   get 'widget.js', to: 'widgets#show', as: :widget
   get 'dashboard.css', to: 'widgets#dashboard_stylesheet', as: :dashboard_stylesheet
 
-  # create is the public widget endpoint; the rest is the triage dashboard.
-  resources :feedbacks, only: %i[create index show update destroy] do
+  # POST goes to SubmissionsController, not to this resource: the widget's write
+  # endpoint is public and the rest is staff-only, and only the staff half
+  # inherits config.base_controller_class. Sharing one controller would put a
+  # host's admin authentication in front of someone filing a report.
+  post 'feedbacks', to: 'submissions#create', as: :submissions
+  resources :feedbacks, only: %i[index show update destroy] do
     # Screenshots stream through the dashboard's own gate, never via public
     # Active Storage blob URLs.
     resources :screenshots, only: :show

data/lib/generators/ideasbugs/install/install_generator.rb

@@ -2,11 +2,13 @@
 
 require 'rails/generators'
 require 'rails/generators/active_record'
+require_relative '../migration_helpers'
 
 module Ideasbugs
   module Generators
     class InstallGenerator < Rails::Generators::Base
       include ActiveRecord::Generators::Migration
+      include MigrationHelpers
 
       source_root File.expand_path('templates', __dir__)
 
@@ -31,12 +33,6 @@ module Ideasbugs
         say 'Optional: run `bin/rails ideasbugs:seed_demo` for sample feedback.'
         say "Browse submissions at /feedback (development only until you set config.authorize_admin).\n"
       end
-
-      private
-
-      def migration_version
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
     end
   end
 end

data/lib/generators/ideasbugs/install/templates/create_ideasbugs_feedbacks.rb.tt

@@ -2,7 +2,7 @@
 
 class CreateIdeasbugsFeedbacks < ActiveRecord::Migration<%= migration_version %>
   def change
-    create_table :ideasbugs_feedbacks do |t|
+    create_table :ideasbugs_feedbacks<%= primary_key_type_option %> do |t|
       t.string :kind, null: false, default: 'other'
       t.string :section
       t.text :message, null: false

data/lib/generators/ideasbugs/install/templates/initializer.rb

@@ -11,6 +11,14 @@ Ideasbugs.configure do |config|
   #
   # Render the dashboard inside your app's admin layout. Default: the gem's
   # standalone dashboard layout.
+  # Two ways to put the dashboard inside an admin you already have.
+  #
+  # The whole stack — your layout, helpers, authentication and any request
+  # context your before_actions set up. Only the dashboard inherits it; the
+  # widget's endpoint stays public, so this cannot gate a bug report.
+  # config.base_controller_class = "Admin::BaseController"
+  #
+  # Or the layout alone:
   # config.admin_layout = "admin/application"
 
   # Attribute feedback to a user (optional). Return an object responding to

data/lib/generators/ideasbugs/migration_helpers.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Ideasbugs
+  module Generators
+    # Shared bits every migration-writing generator needs.
+    module MigrationHelpers
+      private
+
+      def migration_version
+        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
+      end
+
+      # Follow the host's own key type instead of forcing bigint. An app that
+      # keys its models with uuids has a uuid
+      # `active_storage_attachments.record_id`, so a bigint table here could
+      # never take a screenshot: the foreign key has nowhere to point and
+      # `attach` raises NotNullViolation.
+      #
+      # Same lookup Rails' own Active Storage, Action Text and Action Mailbox
+      # migrations do, so a host that set it once gets consistent tables from
+      # all of them.
+      #
+      # Rendered as a `create_table` option rather than a bare value, because a
+      # template is expanded at generate time: emitting the method name would
+      # put `id: primary_key_type` in the migration, where nothing defines it.
+      def primary_key_type_option
+        config = Rails.configuration.generators
+        type = config.options[config.orm][:primary_key_type]
+        type ? ", id: :#{type}" : ''
+      end
+    end
+  end
+end

data/lib/generators/ideasbugs/tenant/tenant_generator.rb

@@ -2,6 +2,7 @@
 
 require 'rails/generators'
 require 'rails/generators/active_record'
+require_relative '../migration_helpers'
 
 module Ideasbugs
   module Generators
@@ -14,6 +15,7 @@ module Ideasbugs
     #   bin/rails generate ideasbugs:tenant && bin/rails db:migrate
     class TenantGenerator < Rails::Generators::Base
       include ActiveRecord::Generators::Migration
+      include MigrationHelpers
 
       source_root File.expand_path('templates', __dir__)
 
@@ -28,12 +30,6 @@ module Ideasbugs
         say "\ntenant column queued. Run `rails db:migrate`, then set", :green
         say 'config.tenant in config/initializers/ideasbugs.rb to scope per tenant.'
       end
-
-      private
-
-      def migration_version
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
     end
   end
 end

data/lib/ideasbugs/configuration.rb

@@ -5,6 +5,10 @@ module Ideasbugs
   # works with zero configuration; the hooks below let an app decide who can
   # send feedback, who can read it, and how submissions are attributed.
   class Configuration
+    # The gem's own dashboard layout. Compared against, so DashboardController
+    # can tell "the host left this alone" from "the host chose this".
+    DEFAULT_ADMIN_LAYOUT = 'ideasbugs/application'
+
     # Per-request gate for the widget and the submission endpoint. Return false
     # to hide the widget and reject submissions for this request. Receives the
     # request. Defaults to everyone — feedback collection is meant for real
@@ -20,6 +24,21 @@ module Ideasbugs
     # inside your app's admin shell, e.g. "admin/application".
     attr_accessor :admin_layout
 
+    # The controller the DASHBOARD inherits from, as a String so it resolves
+    # lazily rather than at config time. Default: a plain
+    # 'ActionController::Base', where `authorize_admin` is the only gate.
+    #
+    # Name the controller your own admin already inherits from and the dashboard
+    # adopts that whole stack — layout, helpers, authentication, and any request
+    # context your before_actions set up. `admin_layout` covers only the layout,
+    # which leaves a host layout calling its own helpers to raise NameError under
+    # the engine's isolated namespace.
+    #
+    # Only the dashboard uses it. The widget's endpoint stays on the engine's own
+    # public controller, so an admin base controller here can never demand a
+    # staff session from someone filing a report.
+    attr_accessor :base_controller_class
+
     # Resolve the current user for attribution (optional). Return an object
     # responding to #id, or nil. Receives the request.
     attr_accessor :current_user
@@ -83,7 +102,8 @@ module Ideasbugs
     def initialize
       @enabled = ->(_request) { true }
       @authorize_admin = ->(_request) { Rails.env.development? }
-      @admin_layout = 'ideasbugs/application'
+      @admin_layout = DEFAULT_ADMIN_LAYOUT
+      @base_controller_class = 'ActionController::Base'
       @current_user = ->(_request) {}
       @tenant = ->(_request) {}
       @author_label = ->(user) { user.respond_to?(:email) ? user.email : user&.to_s }

data/lib/ideasbugs/dashboard.css

@@ -1,143 +1,164 @@
-    :root {
+/* Dashboard styles.
+ *
+ * Three layers, and the split is what lets a host replace the layout:
+ *
+ *   :root            custom properties, all `--ib-` prefixed so they can
+ *                    neither overwrite a host's nor be overwritten by them.
+ *   .ib-page          the page frame (was bare html/body). Only the gem's own
+ *                    layout puts this class on <body>, so inside a host admin
+ *                    these rules simply do not apply.
+ *   .ib-dashboard     everything else, nested. Names like .container, .card
+ *                    and .tabs are confined to the dashboard's own markup, so
+ *                    loading this file inside a host cannot restyle its chrome.
+ *
+ * Nothing here styles a bare `body`, `a`, `table` or `*` at the top level.
+ */
+
+
+:root {
       color-scheme: light dark;
-      --bg: #f6f7f9; --surface: #fff; --text: #1c2024; --muted: #6b7280;
-      --border: #e5e7eb; --accent: #2563eb; --accent-text: #fff;
-      --bug: #dc2626; --feature: #16a34a; --other: #6b7280;
-      --open: #2563eb; --in_review: #d97706; --resolved: #16a34a;
-    }
-    @media (prefers-color-scheme: dark) {
-      :root {
-        --bg: #111418; --surface: #1a1f26; --text: #e6e8ea; --muted: #9aa2ab;
-        --border: #2a313a; --accent: #3b82f6;
-      }
-    }
-    * { box-sizing: border-box; }
-    body { margin: 0; background: var(--bg); color: var(--text);
-           font: 15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; }
-    a { color: var(--accent); text-decoration: none; }
-    a:hover { text-decoration: underline; }
-    .container { max-width: 960px; margin: 0 auto; padding: 24px 16px 64px; }
-    h1 { font-size: 22px; margin: 0 0 16px; }
-    .tabs { display: flex; gap: 4px; border-bottom: 1px solid var(--border); margin-bottom: 16px; flex-wrap: wrap; }
-    .tabs a { padding: 8px 14px; border-radius: 8px 8px 0 0; color: var(--muted); }
-    .tabs a.active { color: var(--text); font-weight: 600; border: 1px solid var(--border);
-                     border-bottom: 2px solid var(--surface); background: var(--surface); margin-bottom: -1px; }
-    .tabs a:hover { text-decoration: none; color: var(--text); }
-    .count { display: inline-block; min-width: 20px; padding: 0 6px; margin-left: 4px; border-radius: 999px;
-             background: var(--border); font-size: 12px; text-align: center; }
-    .filters { margin-bottom: 16px; display: flex; gap: 8px; align-items: center; }
-    .filters select, .filters input[type=search] { padding: 6px 8px; border: 1px solid var(--border);
-                      border-radius: 8px; background: var(--surface); color: var(--text); font: inherit; }
-    .filters input[type=search] { flex: 1; max-width: 320px; }
-    .card { background: var(--surface); border: 1px solid var(--border); border-radius: 12px; overflow: hidden; }
-    .card.pad { padding: 16px; }
-    table { width: 100%; border-collapse: collapse; }
-    th, td { padding: 10px 14px; text-align: left; vertical-align: top; }
-    th { font-size: 12px; text-transform: uppercase; letter-spacing: .04em; color: var(--muted);
-         border-bottom: 1px solid var(--border); }
-    tr + tr td { border-top: 1px solid var(--border); }
-    .badge { display: inline-block; padding: 2px 10px; border-radius: 999px; font-size: 12px; font-weight: 600;
-             color: #fff; white-space: nowrap; }
-    .badge.kind-bug { background: var(--bug); }
-    .badge.kind-feature { background: var(--feature); }
-    .badge.kind-other, .badge.kind-default { background: var(--other); }
-    .badge.status-open { background: var(--open); }
-    .badge.status-in_review { background: var(--in_review); }
-    .badge.status-resolved { background: var(--resolved); }
-    .muted { color: var(--muted); font-size: 13px; }
-    .pager { margin-top: 16px; display: flex; gap: 16px; }
-    .actions { display: flex; gap: 8px; flex-wrap: wrap; margin: 16px 0; }
-    .actions form { display: inline; }
-    button, .button { padding: 8px 14px; border: 1px solid var(--border); border-radius: 8px; cursor: pointer;
-                      background: var(--surface); color: var(--text); font: inherit; }
-    button.primary { background: var(--accent); border-color: var(--accent); color: var(--accent-text); }
-    button.danger { color: var(--bug); }
-    .message { margin: 0; white-space: pre-wrap; overflow-wrap: anywhere; }
-    dl { display: grid; grid-template-columns: max-content 1fr; gap: 6px 16px; margin: 0; }
-    dt { color: var(--muted); }
-    dd { margin: 0; overflow-wrap: anywhere; }
-    .shots { display: flex; gap: 12px; flex-wrap: wrap; margin-top: 8px; }
-    .shots img { max-width: 280px; max-height: 200px; border: 1px solid var(--border); border-radius: 8px; }
-    .empty { padding: 48px 16px; text-align: center; color: var(--muted); }
-    .breadcrumb { margin-bottom: 12px; font-size: 13px; }
-    .case-id { color: var(--muted); font-weight: 400; font-size: 15px; }
-    .panel-head { flex: 0 0 auto; }
-    .panel-head h1 { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; margin-bottom: 12px; }
-    .detail-scroll { display: flex; flex-direction: column; gap: 12px; min-height: 0; }
-    .feedback-panel { min-width: 0; display: flex; flex-direction: column; }
-    .feedback-panel .actions { flex: 0 0 auto; }
-    .feedback-panel .detail-scroll > .actions { margin: 0; }
+      --ib-bg: #f6f7f9; --ib-surface: #fff; --ib-text: #1c2024; --ib-muted: #6b7280;
+      --ib-border: #e5e7eb; --ib-accent: #2563eb; --ib-accent-text: #fff;
+      --ib-bug: #dc2626; --ib-feature: #16a34a; --ib-other: #6b7280;
+      --ib-open: #2563eb; --in_review: #d97706; --ib-resolved: #16a34a;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+        --ib-bg: #111418; --ib-surface: #1a1f26; --ib-text: #e6e8ea; --ib-muted: #9aa2ab;
+        --ib-border: #2a313a; --ib-accent: #3b82f6;
+}
+}
+@media (max-width: 760px) {
+  .ib-page { font-size: 14px; }
+  .ib-index, .ib-show { overflow-x: hidden; }
+  .ib-index { overflow-y: auto; overflow-x: hidden; }
+  .ib-index, .ib-index .container { min-height: 100vh; height: auto; }
+  .ib-index .container { padding-bottom: 10px; }
+  .ib-dashboard {
+  & .container { padding: 14px 10px 24px; }
+  & .feedback-panel,
+  & .detail-scroll,
+  & .card,
+  & dl,
+  & dd { min-width: 0; max-width: 100%; }
+  & .feedback-panel .card { width: calc(100vw - 20px); }
+  & .message,
+  & dd,
+  & .muted { max-width: calc(100vw - 54px); }
+  & .triage-shell { display: block; min-height: calc(100vh - 62px); }
+  & .triage-sidebar,
+  & .triage-detail { min-height: calc(100vh - 62px); }
+  & .triage-shell.has-selected .triage-sidebar { display: none; }
+  & .triage-shell:not(.has-selected) .triage-detail { display: none; }
+  & .feedback-list { overflow: visible; }
+  & .feedback-row { padding: 12px; }
+  & .feedback-meta { display: none; }
+  & .triage-detail .feedback-panel { min-height: calc(100vh - 64px); }
+  & .mobile-back { display: block; flex: 0 0 auto; margin: 10px 10px 0; font-size: 13px; }
+  & .panel-head h1 { font-size: 18px; }
+  & dl { grid-template-columns: 1fr; gap: 3px; }
+  }
+}
 
-    /* Desktop triage: list on the left, selected feedback on the right. */
-    .ib-index, .ib-index .container { height: 100vh; height: 100dvh; }
-    .ib-index { overflow: hidden; }
-    .ib-index .container { max-width: 1280px; display: flex; flex-direction: column; padding-bottom: 16px; }
-    .ib-index .container > h1 { flex: 0 0 auto; margin-bottom: 14px; }
-    .triage-shell { flex: 1 1 auto; min-height: 0; display: grid; grid-template-columns: minmax(320px, 400px) 1fr;
-                    gap: 16px; }
-    .triage-sidebar { min-width: 0; min-height: 0; display: flex; flex-direction: column;
-                      background: var(--surface); border: 1px solid var(--border);
-                      border-radius: 8px; overflow: hidden; }
-    .triage-sidebar .tabs { flex: 0 0 auto; margin: 12px 12px 0; padding: 0; background: transparent;
-                            border: 0; border-radius: 0; gap: 6px; flex-wrap: nowrap; }
-    .triage-sidebar .tabs a { flex: 1 1 0; position: relative; display: flex; align-items: center;
-                              justify-content: center; gap: 6px; min-height: 34px; padding: 5px 10px 8px;
-                              border-radius: 8px; color: var(--muted); font-weight: 600; }
-    .triage-sidebar .tabs a.active { color: var(--text); border: 0; background: transparent; box-shadow: none; margin: 0; }
-    .triage-sidebar .tabs a.active::after { content: ""; position: absolute; left: 20px; right: 20px; bottom: 0;
-                                            height: 2px; border-radius: 999px; background: var(--accent); }
-    .triage-sidebar .tabs a:not(.active):hover { text-decoration: none; color: var(--text); background: var(--bg); }
-    .triage-sidebar .tabs .count { margin-left: 0; background: color-mix(in srgb, var(--muted) 14%, transparent); }
-    .triage-sidebar .tabs a.active .count { background: var(--border); }
-    .triage-sidebar .filters { flex: 0 0 auto; display: grid; grid-template-columns: minmax(0, 1fr) auto;
-                               margin: 0; padding: 12px; border-bottom: 1px solid var(--border); }
-    .triage-sidebar .filters select { grid-column: 1 / -1; width: 100%; }
-    .triage-sidebar .filters input[type=search] { min-width: 0; max-width: none; }
-    .feedback-list { flex: 1 1 auto; min-height: 0; overflow-y: auto; }
-    .feedback-row { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 12px; padding: 13px 14px;
-                    color: var(--text); border-bottom: 1px solid var(--border); }
-    .feedback-row:hover { text-decoration: none; background: var(--bg); }
-    .feedback-row.active { background: color-mix(in srgb, var(--accent) 9%, var(--surface));
-                           box-shadow: inset 3px 0 0 var(--accent); }
-    .feedback-main { min-width: 0; display: flex; flex-direction: column; gap: 5px; }
-    .feedback-topline, .feedback-meta { display: flex; align-items: center; gap: 8px; min-width: 0; }
-    .feedback-message, .feedback-meta span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-    .feedback-message { display: block; font-weight: 600; }
-    .feedback-time { margin-left: auto; white-space: nowrap; }
-    .attachment-count { align-self: start; white-space: nowrap; }
-    .triage-sidebar .pager { flex: 0 0 auto; margin: 0; padding: 10px 12px; border-top: 1px solid var(--border); }
-    .triage-detail { min-width: 0; min-height: 0; display: flex; flex-direction: column; overflow: hidden; }
-    .triage-detail .feedback-panel { flex: 1 1 auto; min-height: 0; }
-    .triage-detail .detail-scroll { flex: 1 1 auto; overflow-y: auto; padding-right: 2px; }
-    .triage-detail .actions { margin-bottom: 0; }
-    .empty-state { margin: auto; max-width: 320px; padding: 24px; text-align: center; }
-    .empty-state h2 { margin: 0 0 6px; font-size: 18px; }
-    .empty-state p { margin: 0; }
-    .mobile-back { display: none; }
+/* Page frame — the gem's own layout only. */
+.ib-page { margin: 0; background: var(--ib-bg); color: var(--ib-text); font: 15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; }
+.ib-index { overflow: hidden; }
+.ib-index .container { max-width: 1280px; display: flex; flex-direction: column; padding-bottom: 16px; }
+.ib-index .container > h1 { flex: 0 0 auto; margin-bottom: 14px; }
+.ib-show .feedback-panel { gap: 0; }
+.ib-show .detail-scroll { overflow: visible; }
 
-    /* Standalone show pages keep normal page scrolling. */
+/* Dashboard components — any layout. */
+.ib-dashboard {
+  & * { box-sizing: border-box; }
+  & a { color: var(--ib-accent); text-decoration: none; }
+  & a:hover { text-decoration: underline; }
+  & .container { max-width: 960px; margin: 0 auto; padding: 24px 16px 64px; }
+  & h1 { font-size: 22px; margin: 0 0 16px; }
+  & .tabs { display: flex; gap: 4px; border-bottom: 1px solid var(--ib-border); margin-bottom: 16px; flex-wrap: wrap; }
+  & .tabs a { padding: 8px 14px; border-radius: 8px 8px 0 0; color: var(--ib-muted); }
+  & .tabs a.active { color: var(--ib-text); font-weight: 600; border: 1px solid var(--ib-border); border-bottom: 2px solid var(--ib-surface); background: var(--ib-surface); margin-bottom: -1px; }
+  & .tabs a:hover { text-decoration: none; color: var(--ib-text); }
+  & .count { display: inline-block; min-width: 20px; padding: 0 6px; margin-left: 4px; border-radius: 999px; background: var(--ib-border); font-size: 12px; text-align: center; }
+  & .filters { margin-bottom: 16px; display: flex; gap: 8px; align-items: center; }
+  & .filters select,
+  & .filters input[type=search] { padding: 6px 8px; border: 1px solid var(--ib-border); border-radius: 8px; background: var(--ib-surface); color: var(--ib-text); font: inherit; }
+  & .filters input[type=search] { flex: 1; max-width: 320px; }
+  & .card { background: var(--ib-surface); border: 1px solid var(--ib-border); border-radius: 12px; overflow: hidden; }
+  & .card.pad { padding: 16px; }
+  & table { width: 100%; border-collapse: collapse; }
+  & th,
+  & td { padding: 10px 14px; text-align: left; vertical-align: top; }
+  & th { font-size: 12px; text-transform: uppercase; letter-spacing: .04em; color: var(--ib-muted); border-bottom: 1px solid var(--ib-border); }
+  & tr + tr td { border-top: 1px solid var(--ib-border); }
+  & .badge { display: inline-block; padding: 2px 10px; border-radius: 999px; font-size: 12px; font-weight: 600; color: #fff; white-space: nowrap; }
+  & .badge.kind-bug { background: var(--ib-bug); }
+  & .badge.kind-feature { background: var(--ib-feature); }
+  & .badge.kind-other,
+  & .badge.kind-default { background: var(--ib-other); }
+  & .badge.status-open { background: var(--ib-open); }
+  & .badge.status-in_review { background: var(--in_review); }
+  & .badge.status-resolved { background: var(--ib-resolved); }
+  & .muted { color: var(--ib-muted); font-size: 13px; }
+  & .pager { margin-top: 16px; display: flex; gap: 16px; }
+  & .actions { display: flex; gap: 8px; flex-wrap: wrap; margin: 16px 0; }
+  & .actions form { display: inline; }
+  & button,
+  & .button { padding: 8px 14px; border: 1px solid var(--ib-border); border-radius: 8px; cursor: pointer; background: var(--ib-surface); color: var(--ib-text); font: inherit; }
+  & button.primary { background: var(--ib-accent); border-color: var(--ib-accent); color: var(--ib-accent-text); }
+  & button.danger { color: var(--ib-bug); }
+  & .message { margin: 0; white-space: pre-wrap; overflow-wrap: anywhere; }
+  & dl { display: grid; grid-template-columns: max-content 1fr; gap: 6px 16px; margin: 0; }
+  & dt { color: var(--ib-muted); }
+  & dd { margin: 0; overflow-wrap: anywhere; }
+  & .shots { display: flex; gap: 12px; flex-wrap: wrap; margin-top: 8px; }
+  & .shots img { max-width: 280px; max-height: 200px; border: 1px solid var(--ib-border); border-radius: 8px; }
+  & .empty { padding: 48px 16px; text-align: center; color: var(--ib-muted); }
+  & .breadcrumb { margin-bottom: 12px; font-size: 13px; }
+  & .case-id { color: var(--ib-muted); font-weight: 400; font-size: 15px; }
+  & .panel-head { flex: 0 0 auto; }
+  & .panel-head h1 { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; margin-bottom: 12px; }
+  & .detail-scroll { display: flex; flex-direction: column; gap: 12px; min-height: 0; }
+  & .feedback-panel { min-width: 0; display: flex; flex-direction: column; }
+  & .feedback-panel .actions { flex: 0 0 auto; }
+  & .feedback-panel .detail-scroll > .actions { margin: 0; }
+  & /* Desktop triage: list on the left,
+  & selected feedback on the right. */
+    .ib-index,
+  & .ib-index .container { height: 100vh; height: 100dvh; }
+  & .triage-shell { flex: 1 1 auto; min-height: 0; display: grid; grid-template-columns: minmax(320px, 400px) 1fr; gap: 16px; }
+  & .triage-sidebar { min-width: 0; min-height: 0; display: flex; flex-direction: column; background: var(--ib-surface); border: 1px solid var(--ib-border); border-radius: 8px; overflow: hidden; }
+  & .triage-sidebar .tabs { flex: 0 0 auto; margin: 12px 12px 0; padding: 0; background: transparent; border: 0; border-radius: 0; gap: 6px; flex-wrap: nowrap; }
+  & .triage-sidebar .tabs a { flex: 1 1 0; position: relative; display: flex; align-items: center; justify-content: center; gap: 6px; min-height: 34px; padding: 5px 10px 8px; border-radius: 8px; color: var(--ib-muted); font-weight: 600; }
+  & .triage-sidebar .tabs a.active { color: var(--ib-text); border: 0; background: transparent; box-shadow: none; margin: 0; }
+  & .triage-sidebar .tabs a.active::after { content: ""; position: absolute; left: 20px; right: 20px; bottom: 0; height: 2px; border-radius: 999px; background: var(--ib-accent); }
+  & .triage-sidebar .tabs a:not(.active):hover { text-decoration: none; color: var(--ib-text); background: var(--ib-bg); }
+  & .triage-sidebar .tabs .count { margin-left: 0; background: color-mix(in srgb, var(--ib-muted) 14%, transparent); }
+  & .triage-sidebar .tabs a.active .count { background: var(--ib-border); }
+  & .triage-sidebar .filters { flex: 0 0 auto; display: grid; grid-template-columns: minmax(0, 1fr) auto; margin: 0; padding: 12px; border-bottom: 1px solid var(--ib-border); }
+  & .triage-sidebar .filters select { grid-column: 1 / -1; width: 100%; }
+  & .triage-sidebar .filters input[type=search] { min-width: 0; max-width: none; }
+  & .feedback-list { flex: 1 1 auto; min-height: 0; overflow-y: auto; }
+  & .feedback-row { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 12px; padding: 13px 14px; color: var(--ib-text); border-bottom: 1px solid var(--ib-border); }
+  & .feedback-row:hover { text-decoration: none; background: var(--ib-bg); }
+  & .feedback-row.active { background: color-mix(in srgb, var(--ib-accent) 9%, var(--ib-surface)); box-shadow: inset 3px 0 0 var(--ib-accent); }
+  & .feedback-main { min-width: 0; display: flex; flex-direction: column; gap: 5px; }
+  & .feedback-topline,
+  & .feedback-meta { display: flex; align-items: center; gap: 8px; min-width: 0; }
+  & .feedback-message,
+  & .feedback-meta span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  & .feedback-message { display: block; font-weight: 600; }
+  & .feedback-time { margin-left: auto; white-space: nowrap; }
+  & .attachment-count { align-self: start; white-space: nowrap; }
+  & .triage-sidebar .pager { flex: 0 0 auto; margin: 0; padding: 10px 12px; border-top: 1px solid var(--ib-border); }
+  & .triage-detail { min-width: 0; min-height: 0; display: flex; flex-direction: column; overflow: hidden; }
+  & .triage-detail .feedback-panel { flex: 1 1 auto; min-height: 0; }
+  & .triage-detail .detail-scroll { flex: 1 1 auto; overflow-y: auto; padding-right: 2px; }
+  & .triage-detail .actions { margin-bottom: 0; }
+  & .empty-state { margin: auto; max-width: 320px; padding: 24px; text-align: center; }
+  & .empty-state h2 { margin: 0 0 6px; font-size: 18px; }
+  & .empty-state p { margin: 0; }
+  & .mobile-back { display: none; }
+  & /* Standalone show pages keep normal page scrolling. */
     .ib-show { min-height: 100vh; overflow: auto; }
-    .ib-show .feedback-panel { gap: 0; }
-    .ib-show .detail-scroll { overflow: visible; }
-    @media (max-width: 760px) {
-      body { font-size: 14px; }
-      .container { padding: 14px 10px 24px; }
-      .ib-index, .ib-show { overflow-x: hidden; }
-      .feedback-panel, .detail-scroll, .card, dl, dd { min-width: 0; max-width: 100%; }
-      .feedback-panel .card { width: calc(100vw - 20px); }
-      .message, dd, .muted { max-width: calc(100vw - 54px); }
-      .ib-index { overflow-y: auto; overflow-x: hidden; }
-      .ib-index, .ib-index .container { min-height: 100vh; height: auto; }
-      .ib-index .container { padding-bottom: 10px; }
-      .triage-shell { display: block; min-height: calc(100vh - 62px); }
-      .triage-sidebar, .triage-detail { min-height: calc(100vh - 62px); }
-      .triage-shell.has-selected .triage-sidebar { display: none; }
-      .triage-shell:not(.has-selected) .triage-detail { display: none; }
-      .feedback-list { overflow: visible; }
-      .feedback-row { padding: 12px; }
-      .feedback-meta { display: none; }
-      .triage-detail .feedback-panel { min-height: calc(100vh - 64px); }
-      .mobile-back { display: block; flex: 0 0 auto; margin: 10px 10px 0; font-size: 13px; }
-      .panel-head h1 { font-size: 18px; }
-      dl { grid-template-columns: 1fr; gap: 3px; }
-    }
+}

data/lib/ideasbugs/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Ideasbugs
-  VERSION = '0.7.8'
+  VERSION = '0.8.0'
 end

data/lib/ideasbugs.rb

@@ -29,6 +29,13 @@ module Ideasbugs
 
     # Can this request browse and triage feedback? Checked by every dashboard
     # action.
+    # The class Ideasbugs::DashboardController inherits from. Resolved on every
+    # call rather than memoized, so a host that reassigns base_controller_class
+    # in a reloadable initializer is not pinned to a stale, unloaded constant.
+    def base_controller
+      config.base_controller_class.to_s.constantize
+    end
+
     def admin?(request)
       !!config.authorize_admin.call(request)
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ideasbugs
 version: !ruby/object:Gem::Version
-  version: 0.7.8
+  version: 0.8.0
 platform: ruby
 authors:
 - Yaroslav Shmarov
@@ -39,9 +39,12 @@ files:
 - MIT-LICENSE
 - README.md
 - Rakefile
+- app/controllers/concerns/ideasbugs/request_context.rb
 - app/controllers/ideasbugs/application_controller.rb
+- app/controllers/ideasbugs/dashboard_controller.rb
 - app/controllers/ideasbugs/feedbacks_controller.rb
 - app/controllers/ideasbugs/screenshots_controller.rb
+- app/controllers/ideasbugs/submissions_controller.rb
 - app/controllers/ideasbugs/widgets_controller.rb
 - app/helpers/ideasbugs/widget_helper.rb
 - app/models/ideasbugs/application_record.rb
@@ -49,6 +52,7 @@ files:
 - app/views/ideasbugs/feedbacks/_feedback_panel.html.erb
 - app/views/ideasbugs/feedbacks/index.html.erb
 - app/views/ideasbugs/feedbacks/show.html.erb
+- app/views/ideasbugs/shared/_dashboard.html.erb
 - app/views/layouts/ideasbugs/application.html.erb
 - config/locales/ideasbugs.ar.yml
 - config/locales/ideasbugs.bg.yml
@@ -80,6 +84,7 @@ files:
 - lib/generators/ideasbugs/install/install_generator.rb
 - lib/generators/ideasbugs/install/templates/create_ideasbugs_feedbacks.rb.tt
 - lib/generators/ideasbugs/install/templates/initializer.rb
+- lib/generators/ideasbugs/migration_helpers.rb
 - lib/generators/ideasbugs/tenant/templates/add_tenant_to_ideasbugs_feedbacks.rb.tt
 - lib/generators/ideasbugs/tenant/tenant_generator.rb
 - lib/ideasbugs.rb