islandjs-rails 0.4.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3efc622c722a226faf6ab715f92302e3476aa46be3c186dabd7ec8e51cf49166
-  data.tar.gz: 5c6fa3546df97f4c8430e6b9c06b320a6cd06432b6493025bc05a5c4242f88e9
+  metadata.gz: 161513f810a18384f6f80fd33826774b01027e0a3167e7cdfea5af2903419ccc
+  data.tar.gz: 756c73ddf0f8347c4ca86c484fff6c62cb01600304a04abc84f54b693555062b
 SHA512:
-  metadata.gz: ec382c1d892648a353afed3dec2420b895bf14eae349f3b4a2877aade87bcf8dd2954f3bf1715aa93c6e9fd1f4b3ffed2089c86c356957b0b830aca71387fa03
-  data.tar.gz: 6fd2a2440a750bf0b284452b6faf5835d6a5635e5fef7e4213eb439d77ae95d7667e934eec36e5ff077ea7f1e58d9fbe2d60c140d49ec3c795eae7fe429fe9ad
+  metadata.gz: 3ca585f21d6501f6fca88792b125fdd9f70ed839867509445a59eca25f521919a6918554168f834d3deb36d9e9e7eb39c05d36c32222e8d354f7442ea4ca394e
+  data.tar.gz: 6f6eacf4afa87d6f130a71c88724deaa0e17d9d8e06cde38cb883b2a1bc35253604b5163e8d40580fbe0c40e8811fd723c424b3f769c96a495962a38ff3aedda

data/CHANGELOG.md

@@ -5,10 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0] - 2025-10-24
+
+- **React 19 Support Added**
+- **Enhanced version parsing** in `cdn_package_name` with nil/empty string handling and exception safety
+- **SSL certificate issues** with improved fallback mechanism for CDN downloads
+
+## [0.5.0] - 2025-09-29
+
+### Added
+- **CSP support for script tags**: All IslandJS-generated `<script>` tags now automatically include a CSP nonce when one is present in the Rails request.  
+- **Flexible script attributes**: Helpers (`react_component`, `vue_component`, etc.) now support passing standard script attributes (`nonce`, `defer`, `async`, `crossorigin`, `integrity`).
+
 ## [0.4.0] - 2025-08-10
 
 ### Added
-- Add ENV flag to control the dev UMD bundle info footer. The floating footer is now disabled by default and only shows in development when `ISLANDJS_RAILS_SHOW_UMD_DEBUG` is truthy.
+- Add ENV flag to control the dev UMD bundle info footer. The floating footer is disabled by default and only shows in development when `ISLANDJS_RAILS_SHOW_UMD_DEBUG` is truthy.
 
 ## [0.3.0] - 2025-08-09
 

data/README.md

@@ -3,8 +3,8 @@
 **Launch quickly:** *upgrade with vite only if necessary (MYAGNI).*
 
 [![CI](https://github.com/praxis-emergent/islandjs-rails/actions/workflows/github-actions-demo.yml/badge.svg)](https://github.com/praxis-emergent/islandjs-rails/actions/workflows/github-actions-demo.yml)
-[![Test Coverage](https://img.shields.io/badge/coverage-89.09%25-brightgreen.svg)](coverage/index.html)
-[![RSpec Tests](https://img.shields.io/badge/tests-162%20passing-brightgreen.svg)](spec/)
+[![Test Coverage](https://img.shields.io/badge/coverage-86.63%25-brightgreen.svg)](coverage/index.html)
+[![RSpec Tests](https://img.shields.io/badge/tests-367%20passing-brightgreen.svg)](spec/)
 [![Rails 8 Ready](https://img.shields.io/badge/Rails%208-Ready-brightgreen.svg)](#rails-8-ready)
 
 IslandJS Rails supports the development of React islands in Rails apps by synchronizing `package.json` dependencies with UMD libraries served in `public/islands/vendor`.
@@ -31,8 +31,8 @@ rails islandjs:init
 
 ### Install React
 ```bash
-rails "islandjs:install[react,18.3.1]"
-rails "islandjs:install[react-dom,18.3.1]"
+rails "islandjs:install[react,19.2.0]"
+rails "islandjs:install[react-dom,19.2.0]"
 ```
 
 ### Run Yarn In Development
@@ -115,7 +115,7 @@ Modern Rails developers face a painful choice:
 ### The IslandJS Rails Solution
 ```bash
 # Instead of complex vite/webpack configuration:
-rails "islandjs:install[react,18.3.1]"
+rails "islandjs:install[react,19.2.0]"
 rails "islandjs:install[react-beautiful-dnd]"
 rails "islandjs:install[quill]"
 rails "islandjs:install[recharts]"
@@ -132,7 +132,7 @@ const quill = new window.Quill("#editor", {
 });
 ```
 
-**Important Note:** IslandJS Rails works with packages that ship UMD builds. Many popular packages have UMD builds, but some modern packages do not — React 19+ removed UMD builds entirely. Future versions of IslandJS Rails will support local UMD generation for some packages (such as [React 19+](https://github.com/lofcz/umd-react)).
+**Important Note:** IslandJS Rails works with packages that ship UMD builds. Many popular packages have UMD builds, but some modern packages do not. Starting with **React 19**, official UMD builds were removed, but IslandJS Rails now automatically fetches React 19+ UMD builds from the community-maintained [`umd-react`](https://github.com/lofcz/umd-react) package. No manual setup needed.
 
 If you absolutely need a package that doesn't ship UMD builds, you have a few options:
 
@@ -170,12 +170,12 @@ rails islandjs:init
 
 # Install packages (adds to package.json + saves to vendor directory)
 rails "islandjs:install[react]"
-rails "islandjs:install[react,18.3.1]"       # With specific version
+rails "islandjs:install[react,19.2.0]"       # With specific version
 rails "islandjs:install[lodash]"
 
 # Update packages (updates package.json + refreshes vendor files)
 rails "islandjs:update[react]"
-rails "islandjs:update[react,18.3.1]"       # To specific version
+rails "islandjs:update[react,19.2.0]"       # To specific version
 
 # Remove packages (removes from package.json + deletes vendor files)
 rails "islandjs:remove[react]"
@@ -354,7 +354,7 @@ rails "islandjs:install[@solana/web3]"     # ❌ Wrong
 | Command | What it does | Example |
 |---------|--------------|---------|
 | `install` | Adds package via yarn + downloads UMD + saves to vendor | `rails islandjs:install[react]` |
-| `update` | Updates package version + refreshes UMD | `rails islandjs:update[react,18.3.1]` |
+| `update` | Updates package version + refreshes UMD | `rails islandjs:update[react,19.2.0]` |
 | `remove` | Removes package via yarn + deletes vendor files | `rails islandjs:remove[react]` |
 | `clean` | Removes ALL vendor files (destructive!) | `rails islandjs:clean` |
 
@@ -420,6 +420,7 @@ Renders a React component with Turbo-compatible lifecycle and optional placehold
 - `class`: CSS class for container
 - `placeholder_class`: CSS class for placeholder content
 - `placeholder_style`: Inline styles for placeholder content
+- Script attributes: `nonce` (auto-detected for CSP), `defer`, `async`, `crossorigin`, `integrity`
 
 ## Placeholder Support
 

data/lib/islandjs_rails/configuration.rb

@@ -27,6 +27,20 @@ module IslandjsRails
       '@babel/preset-env' => 'babel-preset-env',
       '@babel/preset-react' => 'babel-preset-react'
     }.freeze
+    
+    # Maps packages to alternate CDN names (e.g., React 19+ → umd-react).
+    def cdn_package_name(package_name, version)
+      # Handle nil or empty version strings
+      return package_name if version.nil? || version.empty?
+      
+      # Check if React 19+ to use community-maintained umd-react package
+      if ['react', 'react-dom'].include?(package_name)
+        major_version = version.split('.').first.to_i rescue 0
+        return 'umd-react' if major_version >= 19
+      end
+      
+      package_name
+    end
 
     # Vendor file helper methods
     def vendor_manifest_path

data/lib/islandjs_rails/core.rb

@@ -63,8 +63,8 @@ module IslandjsRails
       
       puts "\n🎉 IslandjsRails initialized successfully!"
       puts "\n📋 Next steps:"
-      puts "1. Install libraries:  rails \"islandjs:install[react,18.3.1]\""
-      puts "                       rails \"islandjs:install[react-dom,18.3.1]\"  "
+      puts "1. Install libraries:  rails \"islandjs:install[react,19.2.0]\""
+      puts "                       rails \"islandjs:install[react-dom,19.2.0]\"  "
       puts "2. Start dev:          yarn watch"
       puts "3. Use components:     <%= react_component('HelloWorld') %>"
       puts "4. Build for prod:     yarn build"
@@ -281,6 +281,9 @@ module IslandjsRails
       version ||= version_for(package_name)
       return nil unless version
       
+      # Use cdn_package_name to handle React 19+ mapping to umd-react
+      cdn_package = configuration.cdn_package_name(package_name, version)
+      
       # Use original package name for URL, but get clean name for {name} substitution
       clean_name = (Configuration::SCOPED_PACKAGE_MAPPINGS[package_name] || package_name).split('/').last
       
@@ -292,8 +295,7 @@ module IslandjsRails
                  else
                    pattern  # Use pattern as-is for fixed filenames like IIFE
                  end
-          url = "#{cdn_base}/#{package_name}@#{version}/#{path}"
-
+          url = "#{cdn_base}/#{cdn_package}@#{version}/#{path}"
           
           if url_accessible?(url)
             puts "✓ Found island: #{url}"
@@ -306,20 +308,6 @@ module IslandjsRails
       nil
     end
 
-    def download_umd_content(url)
-      require 'net/http'
-      require 'uri'
-      
-      uri = URI(url)
-      response = Net::HTTP.get_response(uri)
-      
-      unless response.code == '200'
-        raise IslandjsRails::Error, "Failed to download UMD from #{url}: #{response.code}"
-      end
-      
-      response.body
-    end
-
     def find_working_umd_url(package_name, version)
       puts "  🔍 Searching for UMD build..."
       
@@ -334,7 +322,7 @@ module IslandjsRails
                  else
                    pattern  # Use pattern as-is for fixed filenames like IIFE
                  end
-          url = "#{cdn_base}/#{package_name}@#{version}/#{path}"
+          url = "#{cdn_base}/#{configuration.cdn_package_name(package_name, version)}@#{version}/#{path}"
 
           
           if url_accessible?(url)
@@ -353,18 +341,6 @@ module IslandjsRails
     end
 
     private
-
-    # Check if a URL is accessible (returns 200 status)
-    def url_accessible?(url)
-      require 'net/http'
-      require 'uri'
-      
-      uri = URI(url)
-      response = Net::HTTP.get_response(uri)
-      response.code == '200'
-    rescue => e
-      false
-    end
     
     # Check if a package has a partial file
     def has_partial?(package_name)

data/lib/islandjs_rails/core_methods.rb

@@ -37,8 +37,16 @@ module IslandjsRails
         return
       end
       
+      # Skip prompt in non-interactive mode
+      unless STDIN.tty?
+        puts "\n💡 To render your HelloWorld component:"
+        puts "   In any view: <%= react_component('HelloWorld') %>"
+        puts "   Don't forget to: yarn build && rails server"
+        return
+      end
+      
       print "\n❓ Would you like to create a demo route at /islandjs/react to showcase your HelloWorld component? (y/n): "
-      answer = STDIN.gets.chomp.downcase
+      answer = STDIN.gets&.chomp&.downcase
       
       if answer == 'y' || answer == 'yes'
         create_demo_route!
@@ -393,15 +401,36 @@ module IslandjsRails
       create_partial_file(package_name, umd_content, global_name)
     end
 
-    def download_umd_content(url)
+    def download_umd_content(url, use_ssl_verification = true)
+      require 'openssl'
       uri = URI(url)
-      response = Net::HTTP.get_response(uri)
       
-      if response.code == '200'
+      http_options = {
+        use_ssl: uri.scheme == 'https',
+        verify_mode: use_ssl_verification ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
+      }
+      
+      begin
+        body = Net::HTTP.start(uri.host, uri.port, **http_options) do |http|
+          request = Net::HTTP::Get.new(uri.request_uri)
+          response = http.request(request)
+          
+          if response.code == '200'
+            response.body
+          else
+            raise IslandjsRails::Error, "Failed to download UMD from #{url}: #{response.code}"
+          end
+        end
+        
         # Force UTF-8 encoding to avoid encoding errors when writing to file
-        response.body.force_encoding('UTF-8')
-      else
-        raise IslandjsRails::Error, "Failed to download UMD from #{url}: #{response.code}"
+        body.force_encoding('UTF-8')
+      rescue OpenSSL::SSL::SSLError => ssl_error
+        if use_ssl_verification
+          $stderr.puts "⚠️  SSL verification failed, retrying without verification: #{ssl_error.message}"
+          return download_umd_content(url, false)
+        else
+          raise IslandjsRails::Error, "Failed to download UMD from #{url}: #{ssl_error.message}"
+        end
       end
     end
 
@@ -536,10 +565,45 @@ module IslandjsRails
       copy_template_file('webpack.config.js', configuration.webpack_config_path)
     end
 
-    def url_accessible?(url)
+    def url_accessible?(url, limit = 5, use_ssl_verification = true)
+      require 'openssl'
+      return false if limit == 0
+      
       uri = URI(url)
-      response = Net::HTTP.get_response(uri)
-      response.code == '200'
+      
+      # Use proper SSL verification by default, but allow fallback for certificate issues
+      http_options = {
+        use_ssl: uri.scheme == 'https',
+        verify_mode: use_ssl_verification ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
+      }
+      
+      begin
+        Net::HTTP.start(uri.host, uri.port, **http_options) do |http|
+          request = Net::HTTP::Get.new(uri.request_uri)
+          response = http.request(request)
+          
+          case response
+          when Net::HTTPSuccess
+            return true
+          when Net::HTTPRedirection
+            # Follow redirects
+            location = response['location']
+            return url_accessible?(location, limit - 1, use_ssl_verification)
+          else
+            return false
+          end
+        end
+      rescue OpenSSL::SSL::SSLError => ssl_error
+        # If SSL verification fails and we're using verification, try once without it
+        # This handles local certificate store issues while still attempting security first
+        if use_ssl_verification
+          $stderr.puts "⚠️  SSL verification failed, retrying without verification: #{ssl_error.message}"
+          return url_accessible?(url, limit, false)
+        else
+          # Already tried without verification, give up
+          false
+        end
+      end
     rescue => e
       false
     end

data/lib/islandjs_rails/rails_helpers.rb

@@ -1,10 +1,13 @@
 module IslandjsRails
   module RailsHelpers
+    # Script attributes that can be passed through options
+    SCRIPT_ATTRIBUTES = %i[nonce defer async crossorigin integrity].freeze
+
     # Main helper method that combines all IslandJS functionality
-    def islands
+    def islands(**attributes)
       output = []
       output << island_partials  # Now uses vendor UMD partial
-      output << island_bundle_script
+      output << island_bundle_script(**attributes)
       output << umd_versions_debug if umd_debug_enabled?
       output.compact.join("\n").html_safe
     end
@@ -22,29 +25,32 @@ module IslandjsRails
     end
 
     # Render the main IslandJS bundle script tag
-    def island_bundle_script
+    def island_bundle_script(**attributes)
       manifest_path = Rails.root.join('public', 'islands_manifest.json')
       bundle_path = '/islands_bundle.js'
-      
+
+      # Get formatted HTML attributes with defaults (including auto-nonce and defer)
+      html_attributes = script_html_attributes(defer: true, **attributes)
+
       unless File.exist?(manifest_path)
         # Fallback to direct bundle path when no manifest
-        return html_safe_string("<script src=\"#{bundle_path}\" defer></script>")
+        return html_safe_string("<script src=\"#{bundle_path}\"#{html_attributes}></script>")
       end
-      
+
       begin
         manifest = JSON.parse(File.read(manifest_path))
         # Look for islands_bundle.js in manifest
         bundle_file = manifest['islands_bundle.js']
-        
+
         if bundle_file
-          html_safe_string("<script src=\"#{bundle_file}\" defer></script>")
+          html_safe_string("<script src=\"#{bundle_file}\"#{html_attributes}></script>")
         else
           # Fallback to direct bundle path
-          html_safe_string("<script src=\"#{bundle_path}\" defer></script>")
+          html_safe_string("<script src=\"#{bundle_path}\"#{html_attributes}></script>")
         end
       rescue JSON::ParserError
         # Fallback to direct bundle path on manifest parse error
-        html_safe_string("<script src=\"#{bundle_path}\" defer></script>")
+        html_safe_string("<script src=\"#{bundle_path}\"#{html_attributes}></script>")
       end
     end
 
@@ -66,7 +72,11 @@ module IslandjsRails
       # Handle placeholder options
       placeholder_class = options[:placeholder_class]
       placeholder_style = options[:placeholder_style]
-      
+
+      # Extract script attributes from options
+      script_attributes = options.slice(*SCRIPT_ATTRIBUTES)
+      script_attributes.compact!
+
       # For turbo-cache compatibility, store initial state as JSON in data attribute
       initial_state_json = props.to_json
       
@@ -91,7 +101,7 @@ module IslandjsRails
       end
       
       # Generate the mounting script - pass container_id as the only prop for turbo-cache pattern
-      mount_script = generate_react_mount_script(component_name, component_id, namespace, namespace_with_optional)
+      mount_script = generate_react_mount_script(component_name, component_id, namespace, namespace_with_optional, **script_attributes)
       
       # Return the container div with data-initial-state and script
       data_part = data_attrs.empty? ? '' : " #{data_attrs}"
@@ -133,9 +143,13 @@ module IslandjsRails
       # Extract options
       tag_name = options[:tag] || 'div'
       css_class = options[:class] || ''
-      
+
+      # Extract script attributes from options
+      script_attributes = options.slice(*SCRIPT_ATTRIBUTES)
+      script_attributes.compact!
+
       # Generate the mounting script
-      mount_script = generate_vue_mount_script(component_name, component_id, props_json)
+      mount_script = generate_vue_mount_script(component_name, component_id, props_json, **script_attributes)
       
       # Return the container div and script
       container_html = "<#{tag_name} id=\"#{component_id}\" class=\"#{css_class}\"></#{tag_name}>"
@@ -237,6 +251,37 @@ module IslandjsRails
 
     private
 
+    # Format HTML attributes into a string
+    # Returns a string like ' nonce="abc123" defer' or empty string if no attributes
+    def format_html_attributes(**attributes)
+      return '' if attributes.empty?
+
+      attributes.filter_map do |key, value|
+        next if value.nil? || value == false
+        key_str = key.to_s.tr('_', '-')
+        value == true ? " #{key_str}" : " #{key_str}=\"#{value}\""
+      end.join
+    end
+
+    # Get default script attributes with auto-nonce detection
+    def default_script_attributes(**user_attributes)
+      attributes = {}
+
+      # Auto-add nonce if CSP is enabled and not explicitly provided
+      if !user_attributes.key?(:nonce) && respond_to?(:content_security_policy_nonce)
+        nonce = content_security_policy_nonce
+        attributes[:nonce] = nonce if nonce
+      end
+
+      attributes.merge(user_attributes)
+    end
+
+    # Get formatted HTML attributes string for script tags
+    def script_html_attributes(**attributes)
+      script_attributes = default_script_attributes(**attributes)
+      format_html_attributes(**script_attributes)
+    end
+
     # Whether the floating UMD versions debug footer should render
     def umd_debug_enabled?
       return false unless Rails.env.development?
@@ -274,9 +319,11 @@ module IslandjsRails
     end
 
     # Generate React component mounting script with Turbo compatibility
-    def generate_react_mount_script(component_name, component_id, namespace, namespace_with_optional)
+    def generate_react_mount_script(component_name, component_id, namespace, namespace_with_optional, **attributes)
+      html_attributes = script_html_attributes(**attributes)
+
       <<~JAVASCRIPT
-        <script>
+        <script#{html_attributes}>
           (function() {
             function mount#{component_name}() {
               const container = document.getElementById('#{component_id}');
@@ -307,13 +354,13 @@ module IslandjsRails
               const element = React.createElement(#{namespace_with_optional}.#{component_name}, props);
               
               try {
-                // Use React 18 createRoot if available, fallback to React 17 render
+                // Use React 19 createRoot if available, fallback to React 17 render
                 if (window.ReactDOM.createRoot) {
                   if (!container._reactRoot) {
                     container._reactRoot = window.ReactDOM.createRoot(container);
                   }
                   container._reactRoot.render(element);
-                  // React 18 automatically clears container - no manual cleanup needed
+                  // React 19 automatically clears container - no manual cleanup needed
                 } else {
                   // React 17 - render is synchronous and clears container automatically
                   window.ReactDOM.render(element, container);
@@ -328,7 +375,7 @@ module IslandjsRails
               const container = document.getElementById('#{component_id}');
               if (!container) return;
               
-              // React 18 unmount
+              // React 19 unmount
               if (container._reactRoot) {
                 container._reactRoot.unmount();
                 container._reactRoot = null;
@@ -360,9 +407,11 @@ module IslandjsRails
     end
 
     # Generate Vue component mounting script with Turbo compatibility
-    def generate_vue_mount_script(component_name, component_id, props_json)
+    def generate_vue_mount_script(component_name, component_id, props_json, **attributes)
+      html_attributes = script_html_attributes(**attributes)
+
       <<~JAVASCRIPT
-        <script>
+        <script#{html_attributes}>
           (function() {
             let vueApp = null;
             

data/lib/islandjs_rails/tasks.rb

@@ -13,7 +13,7 @@ namespace :islandjs do
     
     if package_name.nil?
       puts "❌ Package name is required"
-      puts "Usage: rails \"islandjs:install[react,18.3.1]\""
+      puts "Usage: rails \"islandjs:install[react,19.2.0]\""
       exit 1
     end
     
@@ -27,7 +27,7 @@ namespace :islandjs do
     
     if package_name.nil?
       puts "❌ Package name is required"
-      puts "Usage: rails \"islandjs:update[react,18.3.1]\""
+      puts "Usage: rails \"islandjs:update[react,19.2.0]\""
       exit 1
     end
     

data/lib/islandjs_rails/version.rb

@@ -1,3 +1,3 @@
 module IslandjsRails
-  VERSION = "0.4.0"
+  VERSION = "0.6.0"
 end

data/lib/islandjs_rails.rb

@@ -22,6 +22,8 @@ module IslandjsRails
     'umd/{name}.production.min.js',
     'umd/{name}.development.js',
     'umd/{name}.min.js',
+    'umd/{name}.js',
+    'dist/{name}.production.min.js',
     'umd/{name}.js', 
     'dist/{name}.min.js',
     'dist/{name}.js',

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: islandjs-rails
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Eric Arnold