koderift-rails 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9c83f5ae85e74957769db72695555fbdd39aebef940ecb97b7cf1dda72d75c0
-  data.tar.gz: d27d1449f36d00606d187eed46783a6cbcd6df03ad1f2ee8cf515f834d294735
+  metadata.gz: b77962b847bf6127f3029ab4cab2eb3f71ae3cf0d0041c6d2df6ad1108449c7e
+  data.tar.gz: cc0a1ab9373ca3544bf3d9b48bf08ea1afa269236d4385e9873a139ea258fb0f
 SHA512:
-  metadata.gz: 43e553f25047fc9501be705793df7e7d9b82ec5ecd17850ca8b45b07baacb4e52dd954611a11b580284aedfb6abc070a9ad139482aba6210b63432ceee3c6c11
-  data.tar.gz: e55b1666a9e531b7a4ca9e1f02acaeb4086ef17b65cd0aee6750fd3d641106b248e5027fa083d0f11f95797409688fff9618ed09d8a886e20b6e12ac71e98009
+  metadata.gz: 274e3e08f2d325ef30063547658668b955eb32607c6705829c5de531b8ac40d63701d199a3fffb9d537f3298a29816dd491ba897a0ec93dc0237eebaa2964b24
+  data.tar.gz: d409cd77d3f77b28d86fb526ddff9b096314b8b12e4af3e1e687b281a98d811fabcb775b164eed5a785433ee6455697faabd1a25c3cb5953a8c8fadd3ccb1425

data/CHANGELOG.md

@@ -6,6 +6,38 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 Releases before 1.3.4 were installed from git and were never published to
 RubyGems; they are listed for continuity.
 
+## [2.1.0] - 2026-11-06
+
+Security fix: the Browser RUM meta tag no longer publishes your project token.
+
+### Security
+- `koderift_rum_meta_tag` used to render `config.project_token` into page HTML.
+  That token is the log agent's ingest secret, so anyone reading your page
+  source could use it to send log lines to your Koderift project, including
+  lines that count against its log quota. The tag now renders only the new
+  `config.rum_token`, a public token that can only send browser RUM data.
+- If you rendered the RUM tag on 2.0 or older, treat your project token as
+  public. Once this version is deployed with `rum_token` set, rotate the ingest
+  token in Koderift (Log Analytics settings, "Rotate ingest token"), then update
+  `webhook_url` in the agent's `agent.yml` and `KODERIFT_PROJECT_TOKEN` in your
+  app, and restart the agent.
+
+### Added
+- `config.rum_token`: your project's public RUM token, from the Log Analytics
+  setup page in Koderift. It starts with `rum_`.
+
+### Changed
+- **Action needed if you use Browser RUM:** set `config.rum_token`. Without it
+  the meta tag renders nothing, and the gem logs one warning per process the
+  first time a page renders it. There is deliberately no fallback to
+  `project_token`. The tag also refuses a `rum_token` equal to `project_token`.
+
+### Notes
+- Koderift keeps accepting RUM data sent with the old token until
+  1 February 2027, so pages not yet upgraded keep reporting until then.
+- `project_token` is still required to turn the gem on. The gem never sends it
+  anywhere; the log agent uses its own copy in `agent.yml`.
+
 ## [2.0.0] - 2026-11-04
 
 Manual error reporting, with a Sentry-compatible API.

data/README.md

@@ -12,7 +12,7 @@ Requires Ruby >= 2.7 and Rails 7.1-8.x.
 Add to your `Gemfile`:
 
 ```ruby
-gem 'koderift-rails', '~> 2.0'
+gem 'koderift-rails', '~> 2.1'
 ```
 
 Run `bundle install`. Lograge is a dependency of this gem and is installed
@@ -32,7 +32,37 @@ end
 ```
 
 Set `KODERIFT_PROJECT_TOKEN` in your environment to the token from your
-project's Log Analytics settings page in Koderift.
+project's Log Analytics settings page in Koderift. It is the log agent's
+ingest secret: keep it out of your repository and your page HTML.
+
+## Browser RUM
+
+To collect Core Web Vitals and JS error counts from real browsers, set your
+project's public RUM token (from the Log Analytics setup page; it starts with
+`rum_`) and add the meta tag and snippet inside your layout's `<head>`:
+
+```ruby
+Koderift::Rails.configure do |config|
+  config.project_token = ENV['KODERIFT_PROJECT_TOKEN']
+  config.rum_token     = 'rum_...'
+end
+```
+
+```erb
+<%= koderift_rum_meta_tag %>
+<script src="https://<your Koderift host>/ingest/rum.js" async defer></script>
+```
+
+The meta tag publishes `rum_token` only. It can only send browser RUM data, so
+it is safe in page HTML and safe to commit. The gem never renders
+`project_token`, and it refuses a `rum_token` equal to it. Without a
+`rum_token` the tag renders nothing and the gem logs one warning per process.
+Set `config.rum_enabled = false` for API-only apps.
+
+Upgrading from 2.0 or older with RUM in use? Those versions published
+`project_token` in the meta tag. Set `rum_token`, deploy, then rotate the
+ingest token in Koderift (Log Analytics settings) and update `webhook_url` in
+the agent's `agent.yml`. See the [changelog](CHANGELOG.md).
 
 ## What it captures
 

data/lib/koderift/rails/configuration.rb

@@ -7,6 +7,14 @@ module Koderift
       # Set from an environment variable in the initializer.
       attr_accessor :project_token
 
+      # Public token for Browser RUM, rendered into page HTML by
+      # koderift_rum_meta_tag. It can only send browser RUM data, so it is safe
+      # to publish (and to commit). Copy it from your project's Log Analytics
+      # setup page in Koderift; it starts with "rum_". Never set it to
+      # project_token: that is the log agent's ingest secret, and anyone who
+      # reads it from your page source can send log lines to your project.
+      attr_accessor :rum_token
+
       # Lambda called with the controller instance to get the current user.
       # Default tries common patterns. Override if your app is different.
       # Example: ->(controller) { controller.current_user }
@@ -65,6 +73,7 @@ module Koderift
 
       def initialize
         @project_token     = nil
+        @rum_token         = nil
         @current_user      = default_current_user
         @filter_params     = %w[
           password password_confirmation

data/lib/koderift/rails/rum_helper.rb

@@ -3,6 +3,18 @@
 module Koderift
   module Rails
     module RumHelper
+      MISSING_RUM_TOKEN_WARNING =
+        '[Koderift] Browser RUM is off: koderift_rum_meta_tag renders nothing until ' \
+        'config.rum_token is set. Since koderift-rails 2.1 the tag no longer publishes ' \
+        'config.project_token, which is a secret. Copy the public RUM token (it starts ' \
+        "with rum_) from your project's Log Analytics setup page in Koderift, or set " \
+        'config.rum_enabled = false.'
+
+      SECRET_RUM_TOKEN_WARNING =
+        '[Koderift] Browser RUM is off: config.rum_token is set to your project token, ' \
+        'which is a secret and must not appear in page HTML. Use the public RUM token ' \
+        "(it starts with rum_) from your project's Log Analytics setup page in Koderift."
+
       # Renders the meta tag that rum.js reads for initialisation.
       # Place once inside <head> in your application layout.
       #
@@ -11,24 +23,68 @@ module Koderift
       #
       # Renders:
       #   <meta name="koderift-rum-token"
-      #         content="abc123"
+      #         content="rum_abc123"
       #         data-rum-sampling-rate="0.1"
       #         data-environment="production">
       #
-      # Returns an empty string when RUM is disabled or no token is configured.
+      # Publishes config.rum_token only, never config.project_token. Returns an
+      # empty string when RUM is disabled or there is no publishable token.
       def koderift_rum_meta_tag
         config = Koderift::Rails.configuration
-        return ''.html_safe unless config.rum_enabled && config.project_token.present?
+        return ''.html_safe unless config.rum_enabled
+
+        token = RumHelper.publishable_rum_token(config)
+        return ''.html_safe unless token
 
         tag.meta(
           name:    'koderift-rum-token',
-          content: config.project_token,
+          content: token,
           data: {
             rum_sampling_rate: config.rum_sampling_rate.to_f,
             environment:       (defined?(::Rails) && ::Rails.respond_to?(:env) ? ::Rails.env.to_s : 'production')
           }
         )
       end
+
+      class << self
+        # The token the meta tag may publish, or nil. Up to 2.0 the tag published
+        # project_token, the log agent's ingest secret. It never does now, and a
+        # rum_token equal to it is refused for the same reason. There is
+        # deliberately no fallback: an app that set up RUM before 2.1 and has
+        # not set rum_token gets one warning per process instead.
+        def publishable_rum_token(config)
+          token  = config.rum_token.to_s
+          secret = config.project_token.to_s
+
+          if token.empty?
+            warn_once(MISSING_RUM_TOKEN_WARNING) unless secret.empty?
+            return nil
+          end
+
+          if token == secret
+            warn_once(SECRET_RUM_TOKEN_WARNING)
+            return nil
+          end
+
+          token
+        end
+
+        def reset_warnings!
+          @warned = false
+        end
+
+        private
+
+        def warn_once(message)
+          return if @warned
+
+          @warned = true
+          logger = defined?(::Rails) && ::Rails.respond_to?(:logger) ? ::Rails.logger : nil
+          logger&.warn(message)
+        rescue StandardError
+          nil
+        end
+      end
     end
   end
 end

data/lib/koderift/rails/version.rb

@@ -2,6 +2,6 @@
 
 module Koderift
   module Rails
-    VERSION = '2.0.0'
+    VERSION = '2.1.0'
   end
 end

data/lib/koderift/rails.rb

@@ -29,6 +29,7 @@ module Koderift
         Capture.reset_rate_limiter!
         Scope.reset!
         Breadcrumbs.clear
+        RumHelper.reset_warnings!
       end
 
       # ---------------------------------------------------------------- capture

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: koderift-rails
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
 - Koderift