inline_forms 8.1.53 → 8.1.55

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 698cbe91c323804016404aed86eda2e03d171b2a5df33ab775d3cca68f3d4341
-  data.tar.gz: 7ea3231464409d606c023f4b34aeeb2212d293abeaefc7a876e5ec488f6dcc8b
+  metadata.gz: 7fff4c0c21d69de2e6836a1a6a16e1e293b8c740fe0615a429ab6775f89fd59a
+  data.tar.gz: 479db5cb0c201625bc4c5561f1a3188d3e87ce128387c6a7e08c708d749600b2
 SHA512:
-  metadata.gz: b2c7081ad209dcb79cc50ffa9cd61eaa920a9e44b609d4460a70df0aecfc65532ade283e4335836d0f824714e76107aa888931992d52f777e96868a28336ca4b
-  data.tar.gz: 0b7dc0db8f243a6d06467fa353d423252a97c8c33b14940f24264c99aa3d851253d8580a78e2ce0265d856925ae06753da1cb1d8b793c6716014262b03e093eb
+  metadata.gz: 20499e3a0edf5819e20dc5a2d6893835acb72a08039df25190f184136c93d8c8904de2c5f6def7d3746dd7a1804eb01f51cc3560bd70d5d196e4a95be62911bf
+  data.tar.gz: 809595fc167bab2e5c9015fb034dcc10be2ff6d5dde3b958d24cdf2ae96ed027ed56577342e5e56f4d5e3f6a02311cb7662a736dfe89636456f96961442bb5bb

data/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to this project are documented in this file.
 
 ## [Unreleased]
 
+## [8.1.55] - 2026-10-04
+
+### Fixed
+
+- **Published gems were unreadable for other users.** RubyGems packages each file with its on-disk mode, and `gem install` restores it. The release checkout is group-only (`rw-rw----`), so every file in the published 8.1.53 gems was `0660`. After `gem install` only the installing user and group could read them: for anyone else `require "inline_forms"` failed silently (Bundler swallows that LoadError), so the app died at boot with `uninitialized constant InlineForms`. A Docker image that installs gems as root and runs as another user could not boot at all. Gem builds now package every file as `0644`, or `0755` when the owner may execute it, whatever the checkout's modes: `InlineFormsGemFiles` wraps `Gem::Package#add_files`, and all three gemspecs in this repo load it, so `gem build`, `rake build` and the CI full gate are all covered. validation_hints 8.1.55 has the same fix. 8.1.53 cannot be republished (RubyGems never accepts a version twice), so apps on 8.1.53 should move to 8.1.55.
+
+### Tests
+
+- Gem: `test/gem_package_modes_test.rb`: group-only files on disk are packaged `0644`/`0755`, and the inline_forms, inline_forms_installer and inline_forms_schema_edit gemspecs build with every file world-readable.
+
+### Lockstep
+
+- validation_hints 8.1.55, inline_forms_installer 8.1.55, inline_forms_schema_edit 8.1.55.
+
+## [8.1.54] - 2026-10-04
+
+### Fixed
+
+- **"Forgot your password?" and the password reset page raised.** Devise 5 removed `devise_error_messages!`, and the gem's `devise/passwords/new` and `devise/passwords/edit` still called it, so both pages failed with `undefined method 'devise_error_messages!'` in every generated app. They now render Devise's own `devise/shared/error_messages` partial (`render "devise/shared/error_messages", resource: resource`).
+- **`devise/shared/_header_and_errors`** (not rendered by the gem's own views; kept for host apps that render it). It looked up a translation named after the app (`t application_name`, which renders a translation_missing span), called the removed `devise_error_messages!`, and looked up `inline_forms.devise.` when `@default_message` was unset. It now shows `t('application_name', default: application_name)` like the `inline_forms` layout's title, Devise's error list when the resource has errors, and the `inline_forms.devise.<@default_message>` text only when `@default_message` is set.
+
+### Tests
+
+- Example app: `example_app_devise_passwords_test.rb`: the forgot-password and reset-password pages render, an unknown email re-renders the form with Devise's error list, and `_header_and_errors` shows the app name and the resource errors. The engine's dummy app has no Devise, so these tests live in the example app only.
+
+### Lockstep
+
+- validation_hints 8.1.54, inline_forms_installer 8.1.54, inline_forms_schema_edit 8.1.54.
+
 ## [8.1.53] - 2026-10-04
 
 ### Fixed

data/app/views/devise/passwords/edit.html.erb

@@ -18,7 +18,7 @@
                                   }
                 ) do |f| %>
 
-      <%= devise_error_messages! %>
+      <%= render "devise/shared/error_messages", resource: resource %>
       <%= f.hidden_field :reset_password_token %>
 
       <div class="row">

data/app/views/devise/passwords/new.html.erb

@@ -18,7 +18,7 @@
                                   }
                 ) do |f| %>
 
-      <%= devise_error_messages! %>
+      <%= render "devise/shared/error_messages", resource: resource %>
 
       <div class="row">
         <div class="columns">

data/app/views/devise/shared/_header_and_errors.html.erb

@@ -1,4 +1,11 @@
-<div id="large_title"><%= t application_name -%></div>
+<%# Unused by the gem's own devise views; kept for host apps that render it. %>
+<%# Same title source as layouts/inline_forms; Devise 5 dropped %>
+<%# devise_error_messages!, so errors use Devise's own error_messages partial. %>
+<div id="large_title"><%= t('application_name', default: application_name) %></div>
 <div id="flash_message">
-  <%= devise_error_messages!.empty? ? t("inline_forms.devise.#{@default_message}") : devise_error_messages! -%>
+  <% if resource.errors.any? %>
+    <%= render "devise/shared/error_messages", resource: resource %>
+  <% elsif @default_message.present? %>
+    <%= t("inline_forms.devise.#{@default_message}") %>
+  <% end %>
 </div>

data/lib/inline_forms/gem_files.rb

@@ -1,5 +1,8 @@
 # -*- encoding: utf-8 -*-
 
+require "delegate"
+require "rubygems/package"
+
 module InlineFormsGemFiles
   INSTALLER_FILE_PREFIXES = %w[
     bin/inline_forms
@@ -68,4 +71,33 @@ module InlineFormsGemFiles
       include_installer ? !installer_file : installer_file
     end
   end
+
+  # Mode a file gets inside the .gem: 0755 if the owner may execute it,
+  # else 0644. RubyGems packages each file's on-disk mode (File.lstat) and
+  # `gem install` restores it, and this checkout is group-only (rw-rw----),
+  # so 8.1.53 shipped every file as 0660: only the installing user and group
+  # could read the installed gem, `require "inline_forms"` failed silently
+  # for anyone else (Bundler swallows the LoadError), and a Docker image that
+  # installs as root and runs as another user could not boot.
+  def packaged_mode(mode)
+    (mode & 0o100).zero? ? 0o644 : 0o755
+  end
+
+  # Wraps the tar writer Gem::Package#add_files writes to, so every file
+  # goes in with packaged_mode instead of its on-disk mode.
+  class ReadableTar < SimpleDelegator
+    def add_file_simple(name, mode, size, &block)
+      __getobj__.add_file_simple(name, InlineFormsGemFiles.packaged_mode(mode), size, &block)
+    end
+  end
+
+  module ReadablePackage
+    def add_files(tar)
+      super(ReadableTar.new(tar))
+    end
+  end
 end
+
+# Loaded by every gemspec in this repo, so `gem build`, `rake build` and the
+# CI full gate all package world-readable files whatever the checkout's modes.
+Gem::Package.prepend(InlineFormsGemFiles::ReadablePackage) unless Gem::Package <= InlineFormsGemFiles::ReadablePackage

data/lib/inline_forms/version.rb

@@ -1,5 +1,5 @@
 # -*- encoding : utf-8 -*-
 
 module InlineForms
-  VERSION = "8.1.53"
+  VERSION = "8.1.55"
 end

data/test/gem_package_modes_test.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+$LOAD_PATH.unshift File.expand_path("../lib", __dir__)
+
+require "minitest/autorun"
+require "tmpdir"
+require "zlib"
+require "inline_forms/gem_files"
+
+# 8.1.53 shipped every file as 0660 (the checkout's group-only modes), so an
+# installed gem was unreadable for anyone outside the installing user and
+# group. Gem builds now package 0644 / 0755 whatever the on-disk modes.
+class GemPackageModesTest < Minitest::Test
+  REPO_ROOT = File.expand_path("..", __dir__)
+
+  def packaged_modes(gem_path)
+    modes = {}
+    File.open(gem_path, "rb") do |io|
+      Gem::Package::TarReader.new(io).each do |entry|
+        next unless entry.full_name == "data.tar.gz"
+
+        Gem::Package::TarReader.new(Zlib::GzipReader.new(entry)).each do |file|
+          modes[file.full_name] = file.header.mode & 0o777
+        end
+      end
+    end
+    modes
+  end
+
+  def build(spec, dir, gem_dir)
+    gem_path = File.join(gem_dir, "#{spec.full_name}.gem")
+    Dir.chdir(dir) do
+      package = Gem::Package.new(gem_path)
+      package.spec = spec
+      Gem::DefaultUserInteraction.use_ui(Gem::SilentUI.new) { package.build(true) }
+    end
+    gem_path
+  end
+
+  def test_packaged_mode_keeps_only_the_owner_execute_bit
+    assert_equal 0o644, InlineFormsGemFiles.packaged_mode(0o100660)
+    assert_equal 0o644, InlineFormsGemFiles.packaged_mode(0o100600)
+    assert_equal 0o755, InlineFormsGemFiles.packaged_mode(0o100770)
+    assert_equal 0o755, InlineFormsGemFiles.packaged_mode(0o100700)
+  end
+
+  def test_group_only_files_are_packaged_world_readable
+    Dir.mktmpdir do |src|
+      Dir.mktmpdir do |out|
+        File.write(File.join(src, "plain.rb"), "# plain\n")
+        File.write(File.join(src, "tool"), "#!/bin/sh\n")
+        File.chmod(0o660, File.join(src, "plain.rb"))
+        File.chmod(0o700, File.join(src, "tool"))
+
+        spec = Gem::Specification.new do |s|
+          s.name = "modes_probe"
+          s.version = "0.0.1"
+          s.summary = "probe"
+          s.authors = ["probe"]
+          s.files = %w[plain.rb tool]
+        end
+
+        modes = packaged_modes(build(spec, src, out))
+
+        assert_equal({ "plain.rb" => 0o644, "tool" => 0o755 }, modes)
+      end
+    end
+  end
+
+  def test_every_gemspec_in_the_repo_packages_world_readable_files
+    %w[inline_forms.gemspec inline_forms_installer.gemspec
+       inline_forms_schema_edit/inline_forms_schema_edit.gemspec].each do |gemspec|
+      path = File.join(REPO_ROOT, gemspec)
+      spec = Gem::Specification.load(path)
+      refute_nil spec, gemspec
+
+      Dir.mktmpdir do |out|
+        modes = packaged_modes(build(spec, File.dirname(path), out))
+
+        refute_empty modes, gemspec
+        unreadable = modes.reject { |_, mode| (mode & 0o444) == 0o444 }
+        assert_empty unreadable, "#{gemspec}: not world-readable in the .gem"
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: inline_forms
 version: !ruby/object:Gem::Version
-  version: 8.1.53
+  version: 8.1.55
 platform: ruby
 authors:
 - Ace Suares
@@ -308,6 +308,7 @@ files:
 - test/dummy/config/initializers/paper_trail_yaml_safe_load.rb
 - test/dummy/config/routes.rb
 - test/form_element_from_callee_test.rb
+- test/gem_package_modes_test.rb
 - test/inline_edit_polymorphic_path_test.rb
 - test/inline_forms_addto_generator_test.rb
 - test/inline_forms_generator_test.rb
@@ -388,6 +389,7 @@ test_files:
 - test/dummy/config/initializers/paper_trail_yaml_safe_load.rb
 - test/dummy/config/routes.rb
 - test/form_element_from_callee_test.rb
+- test/gem_package_modes_test.rb
 - test/inline_edit_polymorphic_path_test.rb
 - test/inline_forms_addto_generator_test.rb
 - test/inline_forms_generator_test.rb