islandjs-rails 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3efc622c722a226faf6ab715f92302e3476aa46be3c186dabd7ec8e51cf49166
-  data.tar.gz: 5c6fa3546df97f4c8430e6b9c06b320a6cd06432b6493025bc05a5c4242f88e9
+  metadata.gz: 80cbddb05a05365fd47474178fd2fb2b403f69c597169fe16bcb93e558dbabb7
+  data.tar.gz: f342dd7687658b6c8df47cfa7566f2061517112eb248719c997b20ea2634d5bf
 SHA512:
-  metadata.gz: ec382c1d892648a353afed3dec2420b895bf14eae349f3b4a2877aade87bcf8dd2954f3bf1715aa93c6e9fd1f4b3ffed2089c86c356957b0b830aca71387fa03
-  data.tar.gz: 6fd2a2440a750bf0b284452b6faf5835d6a5635e5fef7e4213eb439d77ae95d7667e934eec36e5ff077ea7f1e58d9fbe2d60c140d49ec3c795eae7fe429fe9ad
+  metadata.gz: 5e3ed8b8c57007f2011c9b875cef7a84b4b4f262038bc2f9c92cc7e98ebfd9ed66b73c2b0fd7e9a1da9bee499b2a036f0c9ed48dd34dd9fdc99e680d82dae908
+  data.tar.gz: ec2afebea06a97b95b7c22b71596c30b704e44bbf5c5a8b0579a497b5b44f89056efcdc5dbf2179564d74b921301740e4feef340d8257c3adbd7c72203c9b703

data/CHANGELOG.md

@@ -5,10 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.0] - 2025-09-29
+
+### Added
+- **CSP support for script tags**: All IslandJS-generated `<script>` tags now automatically include a CSP nonce when one is present in the Rails request.  
+- **Flexible script attributes**: Helpers (`react_component`, `vue_component`, etc.) now support passing standard script attributes (`nonce`, `defer`, `async`, `crossorigin`, `integrity`).
+
 ## [0.4.0] - 2025-08-10
 
 ### Added
-- Add ENV flag to control the dev UMD bundle info footer. The floating footer is now disabled by default and only shows in development when `ISLANDJS_RAILS_SHOW_UMD_DEBUG` is truthy.
+- Add ENV flag to control the dev UMD bundle info footer. The floating footer is disabled by default and only shows in development when `ISLANDJS_RAILS_SHOW_UMD_DEBUG` is truthy.
 
 ## [0.3.0] - 2025-08-09
 

data/README.md

@@ -420,6 +420,7 @@ Renders a React component with Turbo-compatible lifecycle and optional placehold
 - `class`: CSS class for container
 - `placeholder_class`: CSS class for placeholder content
 - `placeholder_style`: Inline styles for placeholder content
+- Script attributes: `nonce` (auto-detected for CSP), `defer`, `async`, `crossorigin`, `integrity`
 
 ## Placeholder Support
 

data/lib/islandjs_rails/rails_helpers.rb

@@ -1,10 +1,13 @@
 module IslandjsRails
   module RailsHelpers
+    # Script attributes that can be passed through options
+    SCRIPT_ATTRIBUTES = %i[nonce defer async crossorigin integrity].freeze
+
     # Main helper method that combines all IslandJS functionality
-    def islands
+    def islands(**attributes)
       output = []
       output << island_partials  # Now uses vendor UMD partial
-      output << island_bundle_script
+      output << island_bundle_script(**attributes)
       output << umd_versions_debug if umd_debug_enabled?
       output.compact.join("\n").html_safe
     end
@@ -22,29 +25,32 @@ module IslandjsRails
     end
 
     # Render the main IslandJS bundle script tag
-    def island_bundle_script
+    def island_bundle_script(**attributes)
       manifest_path = Rails.root.join('public', 'islands_manifest.json')
       bundle_path = '/islands_bundle.js'
-      
+
+      # Get formatted HTML attributes with defaults (including auto-nonce and defer)
+      html_attributes = script_html_attributes(defer: true, **attributes)
+
       unless File.exist?(manifest_path)
         # Fallback to direct bundle path when no manifest
-        return html_safe_string("<script src=\"#{bundle_path}\" defer></script>")
+        return html_safe_string("<script src=\"#{bundle_path}\"#{html_attributes}></script>")
       end
-      
+
       begin
         manifest = JSON.parse(File.read(manifest_path))
         # Look for islands_bundle.js in manifest
         bundle_file = manifest['islands_bundle.js']
-        
+
         if bundle_file
-          html_safe_string("<script src=\"#{bundle_file}\" defer></script>")
+          html_safe_string("<script src=\"#{bundle_file}\"#{html_attributes}></script>")
         else
           # Fallback to direct bundle path
-          html_safe_string("<script src=\"#{bundle_path}\" defer></script>")
+          html_safe_string("<script src=\"#{bundle_path}\"#{html_attributes}></script>")
         end
       rescue JSON::ParserError
         # Fallback to direct bundle path on manifest parse error
-        html_safe_string("<script src=\"#{bundle_path}\" defer></script>")
+        html_safe_string("<script src=\"#{bundle_path}\"#{html_attributes}></script>")
       end
     end
 
@@ -66,7 +72,11 @@ module IslandjsRails
       # Handle placeholder options
       placeholder_class = options[:placeholder_class]
       placeholder_style = options[:placeholder_style]
-      
+
+      # Extract script attributes from options
+      script_attributes = options.slice(*SCRIPT_ATTRIBUTES)
+      script_attributes.compact!
+
       # For turbo-cache compatibility, store initial state as JSON in data attribute
       initial_state_json = props.to_json
       
@@ -91,7 +101,7 @@ module IslandjsRails
       end
       
       # Generate the mounting script - pass container_id as the only prop for turbo-cache pattern
-      mount_script = generate_react_mount_script(component_name, component_id, namespace, namespace_with_optional)
+      mount_script = generate_react_mount_script(component_name, component_id, namespace, namespace_with_optional, **script_attributes)
       
       # Return the container div with data-initial-state and script
       data_part = data_attrs.empty? ? '' : " #{data_attrs}"
@@ -133,9 +143,13 @@ module IslandjsRails
       # Extract options
       tag_name = options[:tag] || 'div'
       css_class = options[:class] || ''
-      
+
+      # Extract script attributes from options
+      script_attributes = options.slice(*SCRIPT_ATTRIBUTES)
+      script_attributes.compact!
+
       # Generate the mounting script
-      mount_script = generate_vue_mount_script(component_name, component_id, props_json)
+      mount_script = generate_vue_mount_script(component_name, component_id, props_json, **script_attributes)
       
       # Return the container div and script
       container_html = "<#{tag_name} id=\"#{component_id}\" class=\"#{css_class}\"></#{tag_name}>"
@@ -237,6 +251,37 @@ module IslandjsRails
 
     private
 
+    # Format HTML attributes into a string
+    # Returns a string like ' nonce="abc123" defer' or empty string if no attributes
+    def format_html_attributes(**attributes)
+      return '' if attributes.empty?
+
+      attributes.filter_map do |key, value|
+        next if value.nil? || value == false
+        key_str = key.to_s.tr('_', '-')
+        value == true ? " #{key_str}" : " #{key_str}=\"#{value}\""
+      end.join
+    end
+
+    # Get default script attributes with auto-nonce detection
+    def default_script_attributes(**user_attributes)
+      attributes = {}
+
+      # Auto-add nonce if CSP is enabled and not explicitly provided
+      if !user_attributes.key?(:nonce) && respond_to?(:content_security_policy_nonce)
+        nonce = content_security_policy_nonce
+        attributes[:nonce] = nonce if nonce
+      end
+
+      attributes.merge(user_attributes)
+    end
+
+    # Get formatted HTML attributes string for script tags
+    def script_html_attributes(**attributes)
+      script_attributes = default_script_attributes(**attributes)
+      format_html_attributes(**script_attributes)
+    end
+
     # Whether the floating UMD versions debug footer should render
     def umd_debug_enabled?
       return false unless Rails.env.development?
@@ -274,9 +319,11 @@ module IslandjsRails
     end
 
     # Generate React component mounting script with Turbo compatibility
-    def generate_react_mount_script(component_name, component_id, namespace, namespace_with_optional)
+    def generate_react_mount_script(component_name, component_id, namespace, namespace_with_optional, **attributes)
+      html_attributes = script_html_attributes(**attributes)
+
       <<~JAVASCRIPT
-        <script>
+        <script#{html_attributes}>
           (function() {
             function mount#{component_name}() {
               const container = document.getElementById('#{component_id}');
@@ -360,9 +407,11 @@ module IslandjsRails
     end
 
     # Generate Vue component mounting script with Turbo compatibility
-    def generate_vue_mount_script(component_name, component_id, props_json)
+    def generate_vue_mount_script(component_name, component_id, props_json, **attributes)
+      html_attributes = script_html_attributes(**attributes)
+
       <<~JAVASCRIPT
-        <script>
+        <script#{html_attributes}>
           (function() {
             let vueApp = null;
             

data/lib/islandjs_rails/version.rb

@@ -1,3 +1,3 @@
 module IslandjsRails
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: islandjs-rails
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Eric Arnold