livechat 0.7.2 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 57a8fc1c73b96c5e4d063c004d7d9e22eb90f888a38bbdd11d568c9088cb2660
-  data.tar.gz: 6a1d40df302ab6ad64c6f94b5c98c8e29a9d2c7f4bc6f53e036a0a2fce5d5ea8
+  metadata.gz: 6007e2a9721aeb42f80cee9f9e5609adff1ae7edd787f9329efd74d1d92f94b5
+  data.tar.gz: 0d9769f92ead60fbb908447204bc7a9dabbf33f2ef8b1eb4b4f501e0df29e7b5
 SHA512:
-  metadata.gz: e366d6123965f80394da3fee7555d6f312dda5ff315887b168e3cc0eccd2beb89771c9da864d8eead4983b841cb1852566196a32680890e08112f44cf7779022
-  data.tar.gz: 216f73d82310d38bcb53345f95dfe3d3b0b22a38785ba8b2ab05f2d8dce2877cd2e22e77fc2b8e1da567fa2db0ca5c74524ba1f40056898172a7a60906fadd2b
+  metadata.gz: ebfe7ab9b60281cb8199960e5cd3a60e5a9af4ee6b0222b8039e3e0103d25e69ea567548f3dcd9252cd881aec235bb4d0187a72f714f402cb84b972b441bd5c4
+  data.tar.gz: f1018b0d5775439bd90f87520a4a22ba44c1703e8b2a163940403f656ebcb793945e8a99a640267f31bf1215c517d4cf7925d7c6ed9be1a05ca8baa5ca8280c7

data/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.8.0
+
+- **`config.agent_layout` now works on its own.** The inbox's stylesheet and
+  script were declared in the gem's layout, so replacing that layout dropped
+  both: unstyled inbox with its thread polling and keyboard submit dead. They
+  move into the views, so every layout gets them with nothing asked of the host.
+- **The dashboard stylesheet no longer claims selectors it does not own.** It
+  styled bare `*`, `body` and `a`, and its `.container`, `.card` and `.tabs` are
+  names other frameworks use too. Component rules now nest inside a
+  `.lvc-dashboard` wrapper the views render, and every custom property is
+  `--lvc-` prefixed — that collision ran both ways, so a host defining `--bg`
+  recoloured the inbox just as easily.
+- **Added `config.base_controller_class`.** Name the controller your own admin
+  inherits from and the inbox adopts its layout, helpers, authentication and
+  request context. It reparents the inbox only — the widget, visitor API and
+  attachment proxy stay on the engine's public controller, so it can never
+  demand a staff session from a visitor starting a chat. Default is unchanged.
+- **Migrations follow the host's `primary_key_type`,** including the engine's own
+  `messages -> conversations` foreign key, which has to match or a bigint column
+  ends up pointing at a uuid table. A uuid-keyed app has a uuid
+  `active_storage_attachments.record_id`, so bigint tables here could never hold
+  a message attachment: `attach` raised `NotNullViolation`.
+- **Dropped the `id: /\d+/` constraints** on the attachment and conversation
+  routes, which were what forced the tables to be bigint. Ordering already
+  disambiguates: every fixed-name route is declared first.
+- **`t.references :conversation` no longer creates its own index.**
+  `(conversation_id)` is a leftmost prefix of the `(conversation_id, id)` index
+  the migration already adds, so it answered no query the wider one could not.
+  Existing installs keep theirs until they drop it:
+  `remove_index :livechat_messages, :conversation_id`.
+- A `BackboneTest` now fails the build on any of the above regressing.
+
 ## 0.7.2
 
 - Adds `AGENTS.md`: install and integration instructions written for coding

data/README.md

@@ -126,6 +126,7 @@ Everything is optional — a fresh install works with zero config. In
 | Option | Default | What it does |
 | --- | --- | --- |
 | `authorize_agent` | development only | **Who can read the inbox.** Override before deploying |
+| `base_controller_class` | `ActionController::Base` | Controller the inbox inherits — name your admin's and it adopts its layout, helpers and auth |
 | `enabled` | everyone | Who sees the widget. `false` hides it and rejects posts |
 | `current_user` | `nil` | Identify the visitor. Receives the request |
 | `app_name` | Rails app name | Shown in the widget header |

data/app/controllers/concerns/livechat/request_context.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Livechat
+  # Who is asking — visitor or agent — and the gates that answer it.
+  #
+  # A concern rather than inherited behaviour because the engine has two
+  # controller roots: the widget's endpoints hang off ActionController::Base, and
+  # the inbox hangs off whatever the host set as `base_controller_class`.
+  module RequestContext
+    extend ActiveSupport::Concern
+
+    private
+
+    def livechat_agent_layout
+      Livechat.config.agent_layout
+    end
+
+    def current_visitor
+      return @current_visitor if defined?(@current_visitor)
+
+      @current_visitor = Livechat.config.current_user.call(request)
+    end
+
+    def current_visitor_id
+      current_visitor.respond_to?(:id) ? current_visitor.id.to_s : nil
+    end
+
+    def require_enabled
+      head :forbidden unless Livechat.enabled?(request)
+    end
+
+    # Server-side gate for the inbox. Default: development only.
+    def require_agent
+      return if Livechat.agent?(request)
+
+      render plain: 'Forbidden. Set Livechat.config.authorize_agent to grant access.',
+             status: :forbidden
+    end
+
+    # Replies are attributed to whoever config.current_user resolves. When an
+    # inbox is protected by something user-less (HTTP basic, a VPN), replies
+    # still work — anonymously, as "Support".
+    def current_agent_id
+      current_visitor_id || '0'
+    end
+
+    def current_agent_label
+      label = (Livechat.config.agent_label.call(current_visitor).presence if current_visitor)
+      label || I18n.t(:team, scope: :livechat, default: 'Support')
+    end
+
+    def render_rate_limited
+      message = I18n.t('livechat.error_rate_limited',
+                       default: 'Too many messages. Please wait a moment and try again.')
+      render json: { errors: [message] }, status: :too_many_requests
+    end
+
+    # Guests get a permanent random token — their key to the conversation
+    # across visits. Signed-in visitors are keyed by id and only need the
+    # cookie to carry a guest history into their account.
+    def visitor_token
+      cookies[:livechat_vid]
+    end
+
+    def ensure_visitor_token
+      visitor_token.presence || begin
+        token = SecureRandom.base58(24)
+        cookies.permanent[:livechat_vid] = { value: token, httponly: true, same_site: :lax }
+        token
+      end
+    end
+
+    # A guest who signed in keeps their thread: adopt cookie-token
+    # conversations into the account, then the cookie no longer matters.
+    def claim_guest_conversations
+      return unless current_visitor_id && visitor_token
+
+      Conversation.claim!(
+        visitor_token: visitor_token,
+        visitor_id: current_visitor_id,
+        visitor_label: Livechat.config.visitor_label.call(current_visitor).presence
+      )
+    end
+  end
+end

data/app/controllers/livechat/application_controller.rb

@@ -1,80 +1,17 @@
 # frozen_string_literal: true
 
 module Livechat
+  # Root of the engine's PUBLIC surface: widget.js, the visitor API and the
+  # attachment proxy (which serves visitors as well as agents). These stay on a
+  # plain ActionController::Base deliberately — a visitor starting a chat must
+  # not be routed through a host's admin controller, which would demand a staff
+  # session for the widget.
+  #
+  # The inbox's root is DashboardController, and that is where
+  # `config.base_controller_class` applies.
   class ApplicationController < ActionController::Base
-    protect_from_forgery with: :exception
-
-    private
-
-    def livechat_agent_layout
-      Livechat.config.agent_layout
-    end
-
-    def current_visitor
-      return @current_visitor if defined?(@current_visitor)
-
-      @current_visitor = Livechat.config.current_user.call(request)
-    end
-
-    def current_visitor_id
-      current_visitor.respond_to?(:id) ? current_visitor.id.to_s : nil
-    end
-
-    def require_enabled
-      head :forbidden unless Livechat.enabled?(request)
-    end
-
-    # Server-side gate for the inbox. Default: development only.
-    def require_agent
-      return if Livechat.agent?(request)
+    include RequestContext
 
-      render plain: 'Forbidden. Set Livechat.config.authorize_agent to grant access.',
-             status: :forbidden
-    end
-
-    # Replies are attributed to whoever config.current_user resolves. When an
-    # inbox is protected by something user-less (HTTP basic, a VPN), replies
-    # still work — anonymously, as "Support".
-    def current_agent_id
-      current_visitor_id || '0'
-    end
-
-    def current_agent_label
-      label = (Livechat.config.agent_label.call(current_visitor).presence if current_visitor)
-      label || I18n.t(:team, scope: :livechat, default: 'Support')
-    end
-
-    def render_rate_limited
-      message = I18n.t('livechat.error_rate_limited',
-                       default: 'Too many messages. Please wait a moment and try again.')
-      render json: { errors: [message] }, status: :too_many_requests
-    end
-
-    # Guests get a permanent random token — their key to the conversation
-    # across visits. Signed-in visitors are keyed by id and only need the
-    # cookie to carry a guest history into their account.
-    def visitor_token
-      cookies[:livechat_vid]
-    end
-
-    def ensure_visitor_token
-      visitor_token.presence || begin
-        token = SecureRandom.base58(24)
-        cookies.permanent[:livechat_vid] = { value: token, httponly: true, same_site: :lax }
-        token
-      end
-    end
-
-    # A guest who signed in keeps their thread: adopt cookie-token
-    # conversations into the account, then the cookie no longer matters.
-    def claim_guest_conversations
-      return unless current_visitor_id && visitor_token
-
-      Conversation.claim!(
-        visitor_token: visitor_token,
-        visitor_id: current_visitor_id,
-        visitor_label: Livechat.config.visitor_label.call(current_visitor).presence
-      )
-    end
+    protect_from_forgery with: :exception
   end
 end

data/app/controllers/livechat/conversations_controller.rb

@@ -4,10 +4,8 @@ module Livechat
   # The inbox. Every action is gated by config.authorize_agent; any
   # authorized teammate can read and answer any thread — it's a shared line,
   # not an assignment queue.
-  class ConversationsController < ApplicationController
-    before_action :require_agent
+  class ConversationsController < DashboardController
     before_action :set_conversation, except: %i[index index_poll]
-    layout :livechat_agent_layout
 
     PER_PAGE = 50
 

data/app/controllers/livechat/dashboard_controller.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Livechat
+  # Root of the AGENT surface: the inbox and agent replies.
+  #
+  # Inherits from `config.base_controller_class` — by default a plain
+  # ActionController::Base, which is why `authorize_agent` exists. Point it at
+  # the controller your own admin already inherits from and the inbox picks up
+  # that stack wholesale: your layout, your helpers, your authentication, and
+  # whatever request context your before_actions establish.
+  #
+  # Only the inbox hangs off it. The widget's endpoints stay on
+  # ApplicationController, so wiring an admin base controller here can never
+  # demand a staff session from a visitor starting a chat.
+  class DashboardController < Livechat.base_controller
+    include RequestContext
+
+    # A host base controller brings its own layout, and declaring one here would
+    # override it. So the gem only claims the layout when it owns the decision:
+    # no host base controller, or a host that named an `agent_layout` explicitly.
+    layout :livechat_agent_layout unless superclass != ActionController::Base &&
+                                         Livechat.config.agent_layout == Configuration::DEFAULT_AGENT_LAYOUT
+
+    before_action :require_agent
+
+    # A host base controller has configured CSRF already; declaring it twice
+    # would run the check twice.
+    protect_from_forgery with: :exception if superclass == ActionController::Base
+  end
+end

data/app/controllers/livechat/messages_controller.rb

@@ -1,9 +1,7 @@
 # frozen_string_literal: true
 
 module Livechat
-  class MessagesController < ApplicationController
-    before_action :require_agent
-
+  class MessagesController < DashboardController
     def create
       conversation = Conversation.find(params[:conversation_id])
       message = conversation.post_agent_message!(

data/app/views/layouts/livechat/application.html.erb

@@ -5,19 +5,18 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <%= csrf_meta_tags %>
   <%= csp_meta_tag %>
-  <%= stylesheet_link_tag "#{dashboard_stylesheet_path}?v=#{Livechat::Widget.dashboard_stylesheet_fingerprint}",
-                          'data-turbo-track': 'reload' %>
-  <%# Same-origin script instead of inline handlers, so thread polling and
-      keyboard submit work under strict script-src CSPs. %>
-  <%= javascript_include_tag "#{dashboard_script_path}?v=#{Livechat::Widget.dashboard_fingerprint}",
-                             defer: true, nonce: true %>
+  <%# The inbox's stylesheet and script are declared by the views
+      (livechat/shared/_dashboard), not here, so they survive a host replacing
+      this layout via config.agent_layout or config.base_controller_class. %>
 </head>
-<body class="<%= yield(:body_class) %>">
-  <div class="container">
-    <% if flash[:alert].present? %>
-      <p class="flash alert"><%= flash[:alert] %></p>
-    <% end %>
-    <%= yield %>
+<body class="lvc-page <%= yield(:body_class) %>">
+  <div class="lvc-dashboard">
+    <div class="container">
+      <% if flash[:alert].present? %>
+        <p class="flash alert"><%= flash[:alert] %></p>
+      <% end %>
+      <%= yield %>
+    </div>
   </div>
 </body>
 </html>

data/app/views/livechat/conversations/index.html.erb

@@ -1,105 +1,107 @@
 <% content_for :body_class, 'lvc-inbox' %>
 
-<h1><%= t('livechat.dashboard.title', default: 'LiveChat') %></h1>
+<%= render layout: 'livechat/shared/dashboard' do %>
+  <h1><%= t('livechat.dashboard.title', default: 'LiveChat') %></h1>
 
-<div class="inbox-shell <%= 'has-selected' if @selected_conversation %>">
-  <aside class="inbox-sidebar" aria-label="<%= t('livechat.dashboard.conversations', default: 'Conversations') %>">
-    <div class="tabs">
-      <% Livechat::Conversation::STATUSES.each do |status| %>
-        <%= link_to conversations_path(status: status, q: @query), class: ('active' if @status == status) do %>
-          <%= t("livechat.statuses.#{status}", default: status.humanize) %>
-          <span class="count"><%= @counts.fetch(status, 0) %></span>
+  <div class="inbox-shell <%= 'has-selected' if @selected_conversation %>">
+    <aside class="inbox-sidebar" aria-label="<%= t('livechat.dashboard.conversations', default: 'Conversations') %>">
+      <div class="tabs">
+        <% Livechat::Conversation::STATUSES.each do |status| %>
+          <%= link_to conversations_path(status: status, q: @query), class: ('active' if @status == status) do %>
+            <%= t("livechat.statuses.#{status}", default: status.humanize) %>
+            <span class="count"><%= @counts.fetch(status, 0) %></span>
+          <% end %>
         <% end %>
-      <% end %>
-    </div>
+      </div>
 
-    <%= form_with url: conversations_path, method: :get, class: 'filters' do %>
-      <input type="hidden" name="status" value="<%= @status %>">
-      <input type="search" name="q" value="<%= @query %>"
-             placeholder="<%= t('livechat.dashboard.search', default: 'Search') %>"
-             aria-label="<%= t('livechat.dashboard.search', default: 'Search') %>">
-      <button type="submit"><%= t('livechat.dashboard.search', default: 'Search') %></button>
-    <% end %>
+      <%= form_with url: conversations_path, method: :get, class: 'filters' do %>
+        <input type="hidden" name="status" value="<%= @status %>">
+        <input type="search" name="q" value="<%= @query %>"
+               placeholder="<%= t('livechat.dashboard.search', default: 'Search') %>"
+               aria-label="<%= t('livechat.dashboard.search', default: 'Search') %>">
+        <button type="submit"><%= t('livechat.dashboard.search', default: 'Search') %></button>
+      <% end %>
 
-    <%# The list keeps itself fresh (dashboard.js reloads when the token moves) —
-        unless the agent is mid-search or mid-reply, whose typing must never be eaten. %>
-    <% cable = livechat_cable_data('livechat:inbox') %>
-    <div id="lvc-index" data-poll-url="<%= poll_conversations_path %>"
-         data-token="<%= [Livechat::Message.maximum(:id).to_i, Livechat::Conversation.count,
-                          @counts.fetch('open', 0)].join('-') %>"
-         <%= tag.attributes(data: cable) if cable.any? %>></div>
+      <%# The list keeps itself fresh (dashboard.js reloads when the token moves) —
+          unless the agent is mid-search or mid-reply, whose typing must never be eaten. %>
+      <% cable = livechat_cable_data('livechat:inbox') %>
+      <div id="lvc-index" data-poll-url="<%= poll_conversations_path %>"
+           data-token="<%= [Livechat::Message.maximum(:id).to_i, Livechat::Conversation.count,
+                            @counts.fetch('open', 0)].join('-') %>"
+           <%= tag.attributes(data: cable) if cable.any? %>></div>
 
-    <div class="conversation-list">
-      <% if @conversations.empty? %>
-        <p class="empty"><%= t('livechat.dashboard.empty',
-                               default: 'Nothing here. When a visitor writes, the conversation lands on this page.') %></p>
-      <% else %>
-        <% @conversations.each do |conversation| %>
-          <% unread = @unread.fetch(conversation.id, 0) %>
-          <%= link_to conversations_path(status: @status, q: @query, offset: @offset,
-                                         conversation_id: conversation.id),
-                      class: ['conversation-row',
-                              ('active' if @selected_conversation&.id == conversation.id),
-                              ('unread' if unread.positive?)].compact do %>
-            <span class="conversation-main">
-              <span class="conversation-topline">
-                <span class="conversation-name"><%= conversation.display_name %></span>
-                <span class="muted conversation-time">
-                  <% if conversation.last_activity_at %>
-                    <%= time_ago_in_words(conversation.last_activity_at) %>
+      <div class="conversation-list">
+        <% if @conversations.empty? %>
+          <p class="empty"><%= t('livechat.dashboard.empty',
+                                 default: 'Nothing here. When a visitor writes, the conversation lands on this page.') %></p>
+        <% else %>
+          <% @conversations.each do |conversation| %>
+            <% unread = @unread.fetch(conversation.id, 0) %>
+            <%= link_to conversations_path(status: @status, q: @query, offset: @offset,
+                                           conversation_id: conversation.id),
+                        class: ['conversation-row',
+                                ('active' if @selected_conversation&.id == conversation.id),
+                                ('unread' if unread.positive?)].compact do %>
+              <span class="conversation-main">
+                <span class="conversation-topline">
+                  <span class="conversation-name"><%= conversation.display_name %></span>
+                  <span class="muted conversation-time">
+                    <% if conversation.last_activity_at %>
+                      <%= time_ago_in_words(conversation.last_activity_at) %>
+                    <% end %>
+                  </span>
+                </span>
+                <span class="muted conversation-meta">
+                  <span class="case-id">#<%= conversation.id %></span>
+                  <% if conversation.visitor_email.present? && conversation.visitor_email != conversation.display_name %>
+                    <span><%= conversation.visitor_email %></span>
                   <% end %>
                 </span>
+                <span class="muted conversation-preview"><%= conversation.last_message_preview %></span>
               </span>
-              <span class="muted conversation-meta">
-                <span class="case-id">#<%= conversation.id %></span>
-                <% if conversation.visitor_email.present? && conversation.visitor_email != conversation.display_name %>
-                  <span><%= conversation.visitor_email %></span>
-                <% end %>
-              </span>
-              <span class="muted conversation-preview"><%= conversation.last_message_preview %></span>
-            </span>
-            <span class="conversation-side">
-              <% if unread.positive? %>
-                <span class="badge unread-count"><%= unread %></span>
-              <% end %>
-              <span class="avatars">
-                <% @agents.fetch(conversation.id, []).each do |label| %>
-                  <%= livechat_agent_avatar(label) %>
+              <span class="conversation-side">
+                <% if unread.positive? %>
+                  <span class="badge unread-count"><%= unread %></span>
                 <% end %>
+                <span class="avatars">
+                  <% @agents.fetch(conversation.id, []).each do |label| %>
+                    <%= livechat_agent_avatar(label) %>
+                  <% end %>
+                </span>
               </span>
-            </span>
+            <% end %>
           <% end %>
         <% end %>
-      <% end %>
-    </div>
-
-    <div class="pager">
-      <% if @offset.positive? %>
-        <%= link_to t('livechat.dashboard.newer', default: 'Newer'),
-                    conversations_path(status: @status, q: @query,
-                                       offset: [@offset - Livechat::ConversationsController::PER_PAGE, 0].max) %>
-      <% end %>
-      <% if @more %>
-        <%= link_to t('livechat.dashboard.older', default: 'Older'),
-                    conversations_path(status: @status, q: @query,
-                                       offset: @offset + Livechat::ConversationsController::PER_PAGE) %>
-      <% end %>
-    </div>
-  </aside>
+      </div>
 
-  <main class="inbox-thread" aria-label="<%= t('livechat.dashboard.current_chat', default: 'Current chat') %>">
-    <% if @selected_conversation %>
-      <p class="mobile-back">
-        <%= link_to "← #{t('livechat.dashboard.back', default: 'All conversations')}",
-                    conversations_path(status: @status, q: @query, offset: @offset) %>
-      </p>
-      <%= render 'thread_panel', conversation: @selected_conversation, messages: @messages, autofocus: false %>
-    <% else %>
-      <div class="empty-state">
-        <h2><%= t('livechat.dashboard.select_conversation', default: 'Select a conversation') %></h2>
-        <p class="muted"><%= t('livechat.dashboard.select_conversation_hint',
-                               default: 'Open a chat from the list to read context and reply.') %></p>
+      <div class="pager">
+        <% if @offset.positive? %>
+          <%= link_to t('livechat.dashboard.newer', default: 'Newer'),
+                      conversations_path(status: @status, q: @query,
+                                         offset: [@offset - Livechat::ConversationsController::PER_PAGE, 0].max) %>
+        <% end %>
+        <% if @more %>
+          <%= link_to t('livechat.dashboard.older', default: 'Older'),
+                      conversations_path(status: @status, q: @query,
+                                         offset: @offset + Livechat::ConversationsController::PER_PAGE) %>
+        <% end %>
       </div>
-    <% end %>
-  </main>
-</div>
+    </aside>
+
+    <main class="inbox-thread" aria-label="<%= t('livechat.dashboard.current_chat', default: 'Current chat') %>">
+      <% if @selected_conversation %>
+        <p class="mobile-back">
+          <%= link_to "← #{t('livechat.dashboard.back', default: 'All conversations')}",
+                      conversations_path(status: @status, q: @query, offset: @offset) %>
+        </p>
+        <%= render 'thread_panel', conversation: @selected_conversation, messages: @messages, autofocus: false %>
+      <% else %>
+        <div class="empty-state">
+          <h2><%= t('livechat.dashboard.select_conversation', default: 'Select a conversation') %></h2>
+          <p class="muted"><%= t('livechat.dashboard.select_conversation_hint',
+                                 default: 'Open a chat from the list to read context and reply.') %></p>
+        </div>
+      <% end %>
+    </main>
+  </div>
+<% end %>

data/app/views/livechat/conversations/show.html.erb

@@ -1,8 +1,10 @@
 <%# Fill the viewport and scroll only the thread (see .lvc-convo in the layout). %>
 <% content_for :body_class, 'lvc-convo' %>
 
-<p class="breadcrumb">
-  <%= link_to "← #{t('livechat.dashboard.back', default: 'All conversations')}", conversations_path %>
-</p>
+<%= render layout: 'livechat/shared/dashboard' do %>
+  <p class="breadcrumb">
+    <%= link_to "← #{t('livechat.dashboard.back', default: 'All conversations')}", conversations_path %>
+  </p>
 
-<%= render 'thread_panel', conversation: @conversation, messages: @messages %>
+  <%= render 'thread_panel', conversation: @conversation, messages: @messages %>
+<% end %>

data/app/views/livechat/shared/_dashboard.html.erb

@@ -0,0 +1,18 @@
+<%# The inbox's own shell, rendered by the views rather than the layout.
+    That is deliberate: `config.agent_layout` and `config.base_controller_class`
+    both let a host replace the layout, and assets declared in a layout the host
+    replaces simply vanish — the inbox then renders unstyled with its thread
+    polling and keyboard submit dead. Declaring them here means every layout
+    works, host or gem.
+
+    The `lvc-dashboard` wrapper is what scopes dashboard.css (see the comment at
+    the top of that file), so it has to enclose the content, not precede it. %>
+<%= stylesheet_link_tag "#{dashboard_stylesheet_path}?v=#{Livechat::Widget.dashboard_stylesheet_fingerprint}",
+                        'data-turbo-track': 'reload' %>
+<%# Same-origin script instead of inline handlers, so thread polling and
+    keyboard submit work under strict script-src CSPs. %>
+<%= javascript_include_tag "#{dashboard_script_path}?v=#{Livechat::Widget.dashboard_fingerprint}",
+                           defer: true, nonce: true %>
+<div class="lvc-dashboard">
+  <%= yield %>
+</div>

data/config/routes.rb

@@ -17,12 +17,17 @@ Livechat::Engine.routes.draw do
 
   # Message attachments, gated by the engine (never a public blob URL). One
   # route for both sides — the controller decides whether you're the visitor
-  # who owns the thread or an agent. Above the conversations catch-all, and
-  # id-constrained so it never shadows a numeric conversation path.
-  get 'attachments/:id', to: 'attachments#show', as: :attachment, constraints: { id: /\d+/ }
+  # who owns the thread or an agent. Declared above the conversations catch-all,
+  # which is what keeps it from being shadowed — no id constraint needed, and a
+  # digits-only one would have made the tables bigint-only (see below).
+  get 'attachments/:id', to: 'attachments#show', as: :attachment
 
   # The inbox. Flat, human URLs: the mount path IS the conversation list.
-  resources :conversations, path: '', only: %i[index show], constraints: { id: /\d+/ } do
+  # No `id: /\d+/` constraint: it made these routes bigint-only, which forced the
+  # tables to be bigint too, and a uuid-keyed host could then never attach a file
+  # (its active_storage_attachments.record_id is a uuid column). Every fixed-name
+  # route above is declared first, so ordering already disambiguates.
+  resources :conversations, path: '', only: %i[index show] do
     collection do
       get :poll, action: :index_poll
     end

data/lib/generators/livechat/install/install_generator.rb

@@ -2,11 +2,13 @@
 
 require 'rails/generators'
 require 'rails/generators/active_record'
+require_relative '../migration_helpers'
 
 module Livechat
   module Generators
     class InstallGenerator < Rails::Generators::Base
       include ActiveRecord::Generators::Migration
+      include MigrationHelpers
 
       source_root File.expand_path('templates', __dir__)
 
@@ -32,12 +34,6 @@ module Livechat
         say 'Optional: run `bin/rails livechat:seed_demo` for sample conversations.'
         say "Set config.mailer_from + config.agent_emails to hear about new messages by email.\n"
       end
-
-      private
-
-      def migration_version
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
     end
   end
 end

data/lib/generators/livechat/install/templates/create_livechat_tables.rb.tt

@@ -2,7 +2,7 @@
 
 class CreateLivechatTables < ActiveRecord::Migration<%= migration_version %>
   def change
-    create_table :livechat_conversations do |t|
+    create_table :livechat_conversations<%= primary_key_type_option %> do |t|
       t.string :visitor_token
       t.string :visitor_id
       t.string :visitor_label
@@ -20,8 +20,10 @@ class CreateLivechatTables < ActiveRecord::Migration<%= migration_version %>
     add_index :livechat_conversations, :status
     add_index :livechat_conversations, :last_activity_at
 
-    create_table :livechat_messages do |t|
-      t.references :conversation, null: false
+    create_table :livechat_messages<%= primary_key_type_option %> do |t|
+      # index: false — the (conversation_id, id) index below already covers
+      # lookups by conversation_id, being a leftmost prefix of it.
+      t.references :conversation, null: false, index: false<%= foreign_key_type_option %>
       t.string :author_type, null: false
       t.string :agent_id
       t.string :agent_label