livechat 1.0.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3784d2aa4059d1cc6faa8b79321ef0ec669dd69fac0b5543a3b881a5342b1961
-  data.tar.gz: d31ff12aa8a32a70315f38216fa4c423f0e130147e21bde0473ae189f337ed45
+  metadata.gz: 771d11b3c4a9a70c254bbe8f403fe4196f1aff26395fd31d023638b261fcea50
+  data.tar.gz: cc8ef5bf1ef7dc04f66eff71481297782ea8496ada69f7bc48cab57fe3e5bfca
 SHA512:
-  metadata.gz: b9a7ceca8836ce9238635a4dce4083eb5e04c60d1fb8241957b85a7c2ac5bff69099a8f19ceee1fa7075f1177075511790e783c9ff41df75cb01651a826f9ce0
-  data.tar.gz: 6fe9125a8525af6a62d4e40f728a4260d12aba7bcef2bc9fb75f12eb89fea1ebe1f75b125c20b47a36597eebe91321e3d94d4d43fe622912e35aea42ae34bb26
+  metadata.gz: 4e9dcd6248961f6785a85fb77c79d3fbc7c5a4d79871ef7cffc7b137615c81467f77aeab2354475fd1f69ed9233ab4759eec426a52ad1aaf14cb009527e4bd0b
+  data.tar.gz: a214328cf56cede8a3179256e30e7fc9756d4e725d69001bc396c2d0343b2beb911f0644866f6b0bf74cad4ddba026f0b0bc83f7b901ab8f96960e7106e78d6f

data/AGENTS.md

@@ -119,9 +119,24 @@ For an account-erasure request, destroy that user's conversations with
 email notifications and hook destinations separately. The content-type
 allowlist is not malware scanning.
 
+### Embedding on a static site
+
+A marketing site that proxies the mount path through to Rails gets the widget from one tag:
+
+```html
+<script src="/livechat/embed.js" defer></script>
+```
+
+Add `?locale=de` for a translated page. Two requirements, and both are load-bearing:
+
+1. **Same origin.** The widget sends `credentials: "same-origin"`, so a cross-origin `<script src>` loads and then silently fails to carry the visitor cookie. Proxy `/livechat/*` from the static site to Rails; do not point the tag at another host.
+2. **`config.allowed_embed_origins = ["https://example.com"]`.** A static page cannot mint a CSRF token, so a request from a listed origin is exempted. Safe because `Origin` is browser-set and unforgeable by page script, it covers only the visitor endpoints, and a request with no `Origin` is never treated as embedded.
+
+Give that surface its own wording with a callable — `config.greeting = ->(request) { ... }` keyed on `request.origin`.
+
 ### Do not
 
-- **Do not copy the widget JavaScript into `app/javascript`, or add a `<script>` tag for it.** `livechat_tag` renders what is needed, and the engine serves the code with a content fingerprint. There is no build step and nothing for esbuild/importmap/Tailwind to know about.
+- **Do not copy the widget JavaScript into `app/javascript`, or add a `<script>` tag for it.** `livechat_tag` renders what is needed (on a page Rails does not render, use `embed.js` above — still not a copy), and the engine serves the code with a content fingerprint. There is no build step and nothing for esbuild/importmap/Tailwind to know about.
 - **Do not rebuild the inbox, and do not edit views inside the gem.** To put it inside an admin you already have, set `config.base_controller_class = "Admin::BaseController"` — it inherits that controller's layout, helpers, authentication and request context. For the shell alone, `config.agent_layout = "admin/application"`. Both work with nothing else wired up: the inbox's own assets are declared by its views, not the layout.
 - **Do not add an Action Cable mount to "make chat realtime"** unless you also set `config.action_cable = true`. Polling is the default and is not broken.
 - **Do not set config outside the initializer.** `rate_limit` in particular is read when the controller class loads; assigning config per-request mutates it process-wide.
@@ -139,9 +154,10 @@ Everything is optional; a fresh install works with zero config. Full list with c
 | `current_user` | `nil` | Receives the request; nil means guest-by-cookie |
 | `visitor_label`, `agent_label` | name/email/to_s | Receive the user |
 | `agent_display_name` | the label unchanged | Receives the label; return "Support team" to keep agents anonymous |
-| `app_name`, `greeting`, `reply_time_text`, `launcher_label` | localized defaults | Widget copy |
-| `avatar_url`, `accent_color` | `nil` | Header avatar (URL or callable) and brand hex |
-| `show_launcher` | `true` | `false` = open only from your own elements |
+| `app_name`, `greeting`, `reply_time_text`, `launcher_label` | localized defaults | Widget copy. All but `app_name` also take a callable receiving the request |
+| `avatar_url`, `accent_color` | `nil` | Header avatar (URL or callable) and brand hex (also callable) |
+| `show_launcher` | `true` | `false` = open only from your own elements. Also takes a callable |
+| `allowed_embed_origins` | `[]` | Origins that may embed the widget on a page this app does not render |
 | `mailer_from` | `nil` | **Required for any email at all** |
 | `agent_emails` | `nil` | Array or callable |
 | `attach_files` | `true` | Needs Active Storage; inert without it |
@@ -167,6 +183,8 @@ Turbo Drive and strict nonce-based CSP work out of the box. 26 locales ship with
 | Messages only appear on refresh | Expected: polling is the default. `config.action_cable = true` (with `/cable` mounted) for push |
 | No attachment button | Active Storage not installed, or `attach_files = false` |
 | `undefined local variable current_user` in the initializer | A gate lambda treated its argument as a controller. It is a `request` |
+| Widget loads on a static site but every message 422s | The embedding origin is not in `allowed_embed_origins`. A static page has no CSRF token |
+| Widget on a static site never finds its thread | It is pointed at another origin. The widget sends `credentials: "same-origin"` — proxy the mount path instead of linking across hosts |
 
 ---
 

data/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 1.2.0 - 2026-10-18
+
+- Add Rails edge CI and experimental Ruby 4.0+ Ractor request support. The host
+  must opt into `Rails.application.ractorize!` and use the upstream Rack/I18n
+  dependencies documented in `docs/ractors.md`.
+- Exercise actual multipart uploads and private downloads in worker Ractors
+  when Active Storage is installed, alongside the optional-dependency-free host.
+- Exercise signed Action Cable stream tokens and worker-originated broadcasts;
+  broadcasts are coordinated with the main Cable server.
+- Prepare immutable widget assets and a frozen configuration snapshot at
+  Ractorization. Callbacks still run for each request, with isolated captures;
+  callbacks that capture mutable state fail at boot with the setting name.
+  Normal Rails boots retain mutable configuration and lazy asset loading.
+- Bridge framework operations that are not yet Ractor safe (mounted URL
+  generation, digests/key derivation and attribute factories) to the main
+  Ractor. This adds dispatch overhead in Ractor mode; it is compatibility
+  support, not a claim of improved throughput. Existing Rails 7.1–8.1 installs
+  need no migration or initializer changes.
+
+## 1.1.0 - 2026-09-25
+
+- **The widget can now live on a site this app does not render.** A static
+  marketing site that proxies the mount path through to Rails loads the whole
+  widget from one tag — `<script src="/livechat/embed.js" defer>` — and never
+  reproduces the config block itself. `?locale=` picks the copy. The response is
+  never cached; the widget code it pulls in stays immutably cached as before.
+- Added `config.allowed_embed_origins`. A page served from a listed origin
+  cannot carry a Rails CSRF token, so a matching request is exempted from
+  forgery protection. The exemption rests on the `Origin` header, which the
+  browser sets and page script cannot forge; it covers only the widget's own
+  visitor endpoints, never the inbox; and a request that sends no `Origin` at
+  all — curl, a server-side client — is never treated as embedded.
+- Added `Livechat.public_paths`: the endpoints that answer with JavaScript, JSON
+  or a file and need no Rails session. Hosts that mint a CSP nonce (or anything
+  else) from the session per request can skip these, rather than handing a
+  cookie to every visitor who only ever loaded the page.
+- `greeting`, `reply_time_text`, `launcher_label`, `show_launcher` and
+  `accent_color` each accept a callable receiving the request, the way
+  `avatar_url` already did. One app serving both an in-app widget and an
+  embedded one can greet each surface differently, and show the bubble on one
+  but not the other.
+
 ## 1.0.0 - 2026-08-11
 
 - **The 1.x record names are settled.** `Livechat::Conversation` and

data/README.md

@@ -136,6 +136,7 @@ Everything is optional — a fresh install works with zero config. In
 | `avatar_url` | `nil` | Customer-facing avatar in the widget header; URL or per-request callable |
 | `accent_color` | `nil` | One hex restyles launcher, header, bubbles, send button |
 | `show_launcher` | `true` | `false` hides the bubble — bring your own entry point |
+| `allowed_embed_origins` | `[]` | Origins allowed to embed the widget on a page this app doesn't render |
 | `visitor_label` | name, else email | How a visitor is labelled in the inbox |
 | `agent_label` | name, else email | How an agent is labelled internally |
 | `agent_display_name` | the full label | What **visitors** see — trim it or anonymise it |
@@ -167,7 +168,9 @@ Livechat.configure do |config|
 end
 ```
 
-`avatar_url` can also choose branding from the current request:
+`avatar_url`, `greeting`, `reply_time_text`, `launcher_label`, `show_launcher`
+and `accent_color` each take a callable receiving the request, so one app can
+brand or word the widget per tenant — or per surface:
 
 ```ruby
 config.avatar_url = ->(request) { request.env["current_account"]&.support_avatar_url }
@@ -245,6 +248,66 @@ config.storage_service = :livechat_uploads
 
 </details>
 
+## On a site this app doesn't render
+
+Marketing sites are usually static and live on their own host, which is exactly
+where people ask presales questions. The widget can go there too, with one tag:
+
+```html
+<script src="/livechat/embed.js" defer></script>
+```
+
+`embed.js` carries the config block the layout helper would have rendered and
+pulls in the widget, so the static page never reproduces engine markup that a
+future release might change. Add `?locale=de` for a translated site.
+
+Two things have to be true.
+
+**The mount path must be same-origin with that site.** The widget sends
+`credentials: "same-origin"`, so a cross-origin script tag would load and then
+quietly fail to carry the visitor's cookie. Proxy `/livechat/*` from the static
+site through to Rails — one rule on a CDN, one `location` block in nginx — and
+the browser sees a single origin.
+
+**The embedding origin must be allowlisted**, because a static page cannot mint
+a CSRF token:
+
+```ruby
+config.allowed_embed_origins = ["https://example.com"]
+```
+
+`Livechat.public_paths` lists the endpoints that need no Rails session — the
+widget script, the embed bootstrap, the visitor API and attachments. If your app
+touches the session on every request (a CSP nonce generator usually does), skip
+them there, or every visitor who merely loads a page leaves with a cookie:
+
+```ruby
+config.content_security_policy_nonce_generator = lambda do |request|
+  next if Livechat.public_paths.any? { |path| request.path.start_with?(path) }
+  request.session[:csp_nonce] ||= SecureRandom.hex(16)
+end
+```
+
+A request from a listed origin skips forgery protection. What makes that safe is
+that `Origin` is set by the browser and cannot be forged by page script, so
+listing an origin grants nothing to any other site; the exemption covers only
+the widget's visitor endpoints and never the inbox; and a request with no
+`Origin` header at all is never treated as embedded, so a non-browser client
+gains nothing.
+
+Marketing visitors usually want a different greeting from signed-in users, and
+the same app serves both:
+
+```ruby
+config.greeting = lambda do |request|
+  if request.origin == "https://example.com"
+    "Questions before you buy? Ask away."
+  else
+    "Hi! How can we help?"
+  end
+end
+```
+
 ## Privacy, retention, and deletion
 
 Livechat stores conversation identity and context, message bodies and
@@ -340,6 +403,9 @@ stable under semantic versioning:
 - `Livechat.configure`, `mount_livechat`, `livechat_tag`, `livechat_button`,
   `window.Livechat.open/close`, `data-livechat-open`, and
   `data-livechat-message`.
+- The `embed.js` endpoint under the mount path, including its `locale`
+  parameter. The markup it writes is private — embed the endpoint, not a copy
+  of its output.
 - `config.on_visitor_message` and `config.on_agent_message`, each called with
   the saved `Livechat::Message` documented by the initializer.
 
@@ -402,3 +468,9 @@ touch your own CSS — and migrations that follow your app's `primary_key_type`.
 ## License
 
 MIT.
+
+## Rails edge and Ractors
+
+Rails edge is tested alongside Rails 7.1–8.1. Experimental Ruby 4.0+ Ractor hosting
+requires additional upstream dependencies and freezes configuration at startup.
+See [the Ractor hosting guide](docs/ractors.md) for callbacks, requirements and checks.

data/Rakefile

@@ -5,7 +5,7 @@ require 'rake/testtask'
 
 Rake::TestTask.new(:test) do |t|
   t.libs << 'test'
-  t.test_files = FileList['test/**/*_test.rb'].exclude('test/system/**/*')
+  t.test_files = FileList['test/**/*_test.rb'].exclude('test/system/**/*', 'test/ractor/**/*')
 end
 
 namespace :test do
@@ -17,3 +17,11 @@ namespace :test do
 end
 
 task default: :test
+
+namespace :test do
+  desc 'Run isolated configuration and Rails edge Ractor request tests (Ruby 4.0+)'
+  task :ractor do
+    ruby '-Itest', 'test/ractor/configuration_test.rb'
+    ruby '-Itest', 'test/ractor/requests_test.rb'
+  end
+end

data/app/controllers/livechat/application_controller.rb

@@ -13,5 +13,14 @@ module Livechat
     include RequestContext
 
     protect_from_forgery with: :exception
+
+    private
+
+    # A page on an allowlisted embed origin is static and has no Rails session
+    # to mint a token from, so the Origin header stands in for one. Only this
+    # controller's descendants are affected — the inbox verifies as usual.
+    def verified_request?
+      Livechat.embedded?(request) || super
+    end
   end
 end

data/app/controllers/livechat/visitor_controller.rb

@@ -9,7 +9,7 @@ module Livechat
     before_action :claim_guest_conversations
 
     if respond_to?(:rate_limit) && Livechat.config.rate_limit
-      rate_limit(**Livechat.config.rate_limit,
+      Livechat::RactorSupport.rate_limit(self, **Livechat.config.rate_limit,
                  only: %i[create email],
                  with: -> { render_rate_limited })
     end

data/app/controllers/livechat/widgets_controller.rb

@@ -20,6 +20,27 @@ module Livechat
       serve(Widget.javascript, Widget.fingerprint)
     end
 
+    # Bootstraps the widget on a page this app does not render. Carries the
+    # config the layout helper would have rendered, so an external page needs
+    # one <script src> and nothing that has to keep up with this engine.
+    #
+    # Never cached: it reflects the current visitor and whatever copy the host
+    # resolves per request. The heavy widget.js it pulls in stays immutable.
+    def embed
+      body = if Livechat.enabled?(request)
+               I18n.with_locale(embed_locale) do
+                 Widget.embed_javascript(locale: I18n.locale,
+                                         authenticated: current_visitor.present?,
+                                         settings: Livechat.settings_for(request))
+               end
+             else
+               ''
+             end
+
+      response.headers['Cache-Control'] = 'no-store'
+      render plain: body, content_type: 'text/javascript'
+    end
+
     def dashboard
       serve(Widget.dashboard_javascript, Widget.dashboard_fingerprint, 'text/javascript')
     end
@@ -30,6 +51,14 @@ module Livechat
 
     private
 
+    # An embedding site carries its own language; it asks for the matching
+    # copy with ?locale=. Anything the host does not actually have falls back
+    # rather than raising.
+    def embed_locale
+      requested = params[:locale].to_s
+      I18n.available_locales.map(&:to_s).include?(requested) ? requested : I18n.locale
+    end
+
     def serve(source, fingerprint, content_type = 'text/javascript')
       expires_in 1.year, public: true if params[:v] == fingerprint
       return unless stale?(etag: [Livechat::VERSION, fingerprint])

data/app/models/livechat/conversation.rb

@@ -33,9 +33,8 @@ module Livechat
       destroyed
     end
 
-    STATUSES.each do |status|
-      define_method(:"#{status}?") { self.status == status }
-    end
+    def open? = status == 'open'
+    def resolved? = status == 'resolved'
 
     # The visitor's ongoing thread. Signed-in identity wins; guests are found
     # by their cookie token (only unclaimed threads — a token that has been

data/app/models/livechat/message.rb

@@ -35,9 +35,9 @@ module Livechat
 
     after_create_commit :on_created
 
-    AUTHOR_TYPES.each do |type|
-      define_method(:"#{type}?") { author_type == type }
-    end
+    def visitor? = author_type == 'visitor'
+    def agent? = author_type == 'agent'
+    def system? = author_type == 'system'
 
     def read? = read_at.present?
 
@@ -154,8 +154,8 @@ module Livechat
     def broadcast_new_message
       return unless Livechat.action_cable_enabled?
 
-      ActionCable.server.broadcast("livechat:conversation:#{conversation_id}", { nudge: id })
-      ActionCable.server.broadcast('livechat:inbox', { nudge: id })
+      RactorSupport.broadcast("livechat:conversation:#{conversation_id}", { nudge: id })
+      RactorSupport.broadcast('livechat:inbox', { nudge: id })
     rescue StandardError => e
       Rails.logger.error("[livechat] cable broadcast failed: #{e.class}: #{e.message}")
     end

data/config/routes.rb

@@ -2,6 +2,7 @@
 
 Livechat::Engine.routes.draw do
   get 'widget.js', to: 'widgets#show', as: :widget
+  get 'embed.js', to: 'widgets#embed', as: :embed
   get 'dashboard.js', to: 'widgets#dashboard', as: :dashboard_script
   get 'dashboard.css', to: 'widgets#dashboard_stylesheet', as: :dashboard_stylesheet
 

data/docs/ractors.md

@@ -0,0 +1,123 @@
+# Rails edge and experimental Ractor hosting
+
+The regular CI matrix covers Rails 7.1, 7.2, 8.0 and 8.1. A required Rails
+edge job runs the same suite against `rails/rails` main. A separate job boots
+an eager-loaded host, calls `Rails.application.ractorize!`, and sends real
+Rack requests through the mounted engine in non-main Ractors, including
+simultaneous requests. The Ractor checks run in separate processes because
+Ractorization freezes Rails; they never freeze the ordinary test application.
+
+## Host prerequisites
+
+Ractor hosting currently requires Ruby 4.0+, Rails main, Rack main's
+`rack/ractorize`, and the unreleased [I18n Ractor support](https://github.com/ruby-i18n/i18n/pull/741).
+`gemfiles/rails_ractor.gemfile` records the exact I18n revision tested. These
+are development/test dependencies, not new runtime dependencies for released
+Rails. The gem's supported dependency range remains Rails >= 7.1 and < 9.
+
+For a host experimenting with Ractor hosting, the tested upstream overrides are:
+
+```ruby
+gem "rails", github: "rails/rails", branch: "main"
+gem "rack", github: "rack/rack", branch: "main"
+gem "i18n", github: "Shopify/i18n", ref: "58aa1dcd3e04c34831e1c2ec06c83391559c7c91"
+```
+
+Follow Rails' own Ractor hosting requirements: disable reloading, eager-load
+application code, use a shareable logger/cache and a Ractor-compatible job
+adapter. Before application classes load, enable Rails' callback isolation:
+
+```ruby
+require "active_support/ractors"
+ActiveSupport::Ractors.unshareable_proc_action = :raise
+```
+
+Our isolated fixture uses `ActiveSupport::Ractors::Logger`, a null
+cache, and (where jobs are loaded) `:inline`. Its separate shared counter proves
+that public submission limits remain effective across worker Ractors. The
+ordinary dummy application's `:test` job adapter is unchanged.
+
+The engine prepares itself automatically on `before_ractorize`; ordinary Rails
+boots do not freeze its configuration or load the experimental I18n extension.
+An unavailable I18n Ractor extension produces a startup error explaining the
+prerequisite. Rails edge and Ractor hosting remain experimental: this is not a
+promise that every third-party host middleware, database driver, storage
+service, mail adapter or Action Cable adapter is Ractor safe.
+
+## Configuration and callbacks
+
+Finish configuring Livechat before calling `ractorize!`. The engine publishes
+a frozen copy of the configuration and warms/freezes widget JS, CSS and content
+fingerprints. Changes after Ractorization require a process restart. Arrays and
+hashes supplied by the host are copied before freezing.
+
+Callbacks are isolated with Ruby's `Ractor.shareable_lambda` or
+`Ractor.shareable_proc`, preserving lambda/proc arity. They continue to receive
+the same request, user, record or event arguments and run on each request.
+Isolated callbacks use arguments and constants; their implicit initializer
+`self` becomes nil, following Rails' isolated callback convention.
+
+```ruby
+Livechat.configure do |config|
+  config.enabled = ->(request) { request.get_header("HTTP_X_WIDGET") != "off" }
+end
+```
+
+Immutable captured values must already be shareable:
+
+```ruby
+expected_host = "app.example.com".freeze
+Livechat.configure do |config|
+  config.enabled = ->(request) { request.host == expected_host }
+end
+```
+
+Mutable captures (an array collecting notifications, an unfrozen captured
+string, or reassigned outer locals) cannot be shared. The engine fails at
+startup with `Livechat.config.<setting>` in the error rather than failing on
+a visitor's request. Use request-local state and external persistence for
+side effects. A pre-isolated callback made with an explicit shareable `self:`
+keeps that receiver. Stateful callable objects must be copyable/shareable;
+custom objects remain subject to Ruby's Ractor rules.
+
+## Scope and cost
+
+Some Rails main paths are still being converted to Ractors. The engine warms
+model attributes and controller names, prepares ETag callbacks, and supplies
+narrow bridges for mounted URL generation, cache freshness, digest/key
+operations, GlobalID URI decoding and boot-time attribute decorators. Those bridges preserve the
+original operation on the main Ractor; requests, authorization callbacks,
+rendering and persistence orchestration execute in their worker Ractors.
+Adapter name quoting delegates to its original implementation on the main Ractor,
+which preserves escaping and avoids process-global mutable caches in workers.
+Disk-backed uploads use Ractor-local storage clients and plain temporary files
+with explicit cleanup, because Tempfile's generated delegation methods cannot
+be called from another Ractor. MIME registrations must finish before
+Ractorization, when Marcel's MIME tables become immutable. Eager model schema
+preparation adds startup database work.
+The bridges are internal compatibility code, add coordination overhead, and
+must be reviewed as upstream Rails evolves. No throughput improvement is claimed.
+
+## Run the checks
+
+Use the Ruby configured in `mise.toml`, never macOS's system Ruby.
+
+```sh
+BUNDLE_GEMFILE=gemfiles/rails_edge.gemfile bundle install
+BUNDLE_GEMFILE=gemfiles/rails_edge.gemfile bundle exec rake test
+BUNDLE_GEMFILE=gemfiles/rails_ractor.gemfile bundle install
+BUNDLE_GEMFILE=gemfiles/rails_ractor.gemfile bundle exec rake test:ractor
+```
+
+The request fixture creates and removes its own temporary database and host;
+it does not reuse or freeze `test/dummy`. The shared schema lives in
+`test/support/schema.rb` so the ordinary and Ractor suites exercise the same
+record shape. Successful checks establish the tested SQLite host and explicit
+request paths, not all combinations of host integrations.
+
+The media job also runs with `RACTOR_MEDIA=1`, exercising private disk-backed
+Active Storage downloads through the engine's authorization gate. Storage
+services are initialized per Ractor, and streamed responses use a thread local
+to that Ractor. Livechat additionally runs with `RACTOR_CABLE=1`, checking the
+signed stream token and broadcasts delegated to the main Action Cable server.
+Other storage services and production Cable adapters need host-specific QA.

data/lib/livechat/configuration.rb

@@ -61,6 +61,9 @@ module Livechat
 
     # Widget copy. nil uses the localized defaults. reply_time_text is the
     # honest line under the greeting — "We usually reply within a few hours."
+    # A String, or a callable receiving the request: one app serving both an
+    # in-app widget and an embedded one on a marketing site needs to greet
+    # those visitors differently.
     attr_accessor :greeting, :reply_time_text, :launcher_label
 
     # Optional customer-facing avatar shown in the widget header. Use a URL
@@ -70,13 +73,29 @@ module Livechat
 
     # Brand color for the widget (launcher, header, visitor bubbles, send
     # button) as a hex value, e.g. "#7c3aed". The widget picks black or white
-    # text automatically for contrast. nil keeps the built-in blue.
+    # text automatically for contrast. nil keeps the built-in blue. A callable
+    # receiving the request works too.
     attr_accessor :accent_color
 
     # The floating launcher bubble. Set false to open the widget only from
-    # your own elements carrying `data-livechat-open`.
+    # your own elements carrying `data-livechat-open`. Also accepts a callable
+    # receiving the request, for a host that wants the bubble on one surface
+    # and its own opener on another.
     attr_accessor :show_launcher
 
+    # Origins allowed to embed the widget on pages this app does not render —
+    # a static marketing site that proxies `mount_path` through to this app,
+    # say. An Array of origins ("https://example.com"), or a callable
+    # receiving the request and returning one.
+    #
+    # Such a page cannot carry a Rails CSRF token, so a matching request is
+    # exempted from forgery protection. That exemption rests on the Origin
+    # header, which the browser sets and script cannot forge, and applies only
+    # to the widget's own visitor endpoints — never to the inbox. A request
+    # arriving without an Origin at all (curl, a server-side client) is never
+    # embedded and keeps the full check.
+    attr_accessor :allowed_embed_origins
+
     # Email addresses to notify when a visitor writes and nobody has read it —
     # an array, or a callable returning one. nil disables the built-in email.
     attr_accessor :agent_emails
@@ -140,6 +159,7 @@ module Livechat
       @avatar_url = nil
       @accent_color = nil
       @show_launcher = true
+      @allowed_embed_origins = []
       @agent_emails = nil
       @mailer_from = nil
       @on_visitor_message = ->(_message) {}

data/lib/livechat/engine.rb

@@ -2,8 +2,19 @@
 
 module Livechat
   class Engine < ::Rails::Engine
+    initializer 'livechat.ractor_middleware' do |app|
+      app.middleware.insert_before 0, RactorSupport::Middleware
+    end
+
     isolate_namespace Livechat
 
+    initializer 'livechat.ractorize', before: 'action_controller.ractorize' do
+      if Rails::Application.method_defined?(:ractorize!)
+        Engine.routes.singleton_class.prepend(RactorSupport::MountedRoutes)
+      end
+      ActiveSupport.on_load(:before_ractorize) { Livechat::RactorSupport.prepare! }
+    end
+
     rake_tasks do
       load File.expand_path('../tasks/livechat_tasks.rake', __dir__)
     end

data/lib/livechat/ractor_support.rb

@@ -0,0 +1,534 @@
+# frozen_string_literal: true
+
+module Livechat
+  # Used only by Rails' opt-in before_ractorize hook. Normal Rails boots keep
+  # mutable configuration and lazy assets, including on older Ruby versions.
+  module RactorSupport
+    # Small bridges for framework paths that Rails main does not prepare yet.
+    # They are installed only when the host explicitly calls ractorize!.
+    # Rails' built-in JSON renderer is still defined from an unisolated Proc.
+    # Keep its JSON/JSONP and escaping behavior in a regular Ruby method.
+    module JsonRendering
+      def _render_with_renderer_json(json, options)
+        json_options = options.except(:callback, :content_type, :status)
+        json_options[:escape] ||= false if !self.class.escape_json_responses? && options[:callback].blank?
+        json = json.to_json(json_options) unless json.is_a?(String)
+        if options[:callback].present?
+          self.content_type = :js if media_type.nil? || media_type == Mime[:json]
+          "/**/#{options[:callback]}(#{json})"
+        else
+          self.content_type = :json if media_type.nil?
+          json
+        end
+      end
+    end
+
+    module DependencyInterlock
+      def interlock
+        return super if Ractor.main?
+
+        Ractor[:engine_dependency_interlock] ||= ActiveSupport::Dependencies::Interlock.new
+      end
+    end
+
+    module LiveThreads
+      private
+
+      def new_controller_thread
+        return super if Ractor.main?
+
+        Thread.new do
+          Thread.current.abort_on_exception = true
+          yield
+        end
+      end
+    end
+
+    module UniquenessCoverage
+      private
+
+      def covered_by_unique_index?(klass, record, attribute, scope)
+        return super unless frozen?
+
+        copies = Ractor[:engine_uniqueness_validators] ||= {}
+        copy = copies[[self, klass]] ||= dup
+        copy.send(:covered_by_unique_index?, klass, record, attribute, scope)
+      end
+    end
+
+    # GlobalID calls CGI.unescape without an encoding, whose default reads a
+    # process-wide class variable. Preserve CGI's configured default on main.
+    module UriUnescaping
+      def unescape(string, *arguments)
+        return super if Ractor.main?
+
+        shared_arguments = Ractor.make_shareable([string, *arguments], copy: true)
+        ActiveSupport::Ractors.on_main(self) { unescape(*shared_arguments) }
+      end
+    end
+
+    module CacheFreshness
+      def strict_freshness
+        return super if Ractor.main?
+
+        ActiveSupport::Ractors.on_main(self) { strict_freshness }
+      end
+    end
+
+    # Attribute decorators (including Rails enums and serialized attributes)
+    # are boot-time factories. Keep their original receivers and captures on
+    # the main Ractor, rather than changing the semantics of Rails' closures.
+    class Decorator
+      def initialize(callback)
+        @key = RactorSupport.register_decorator(callback)
+        freeze
+      end
+
+      def call(*arguments)
+        return RactorSupport.call_decorator(@key, arguments) if Ractor.main?
+
+        shared_arguments = Ractor.make_shareable(arguments, copy: true)
+        ActiveSupport::Ractors.on_main(self) { RactorSupport.call_decorator(@key, shared_arguments) }
+      end
+    end
+
+    def self.register_decorator(callback)
+      @decorators ||= []
+      @decorators << callback
+      @decorators.length - 1
+    end
+
+    def self.call_decorator(key, arguments)
+      @decorators.fetch(key).call(*arguments)
+    end
+
+    def self.prepare_attributes(model)
+      prepare_attributes(model.superclass) if model.superclass.respond_to?(:pending_attribute_modifications, true)
+      model.send(:pending_attribute_modifications)&.each do |modification|
+        next unless modification.respond_to?(:decorator) && modification.decorator.is_a?(Proc)
+
+        modification.decorator = Decorator.new(modification.decorator)
+      end
+    end
+
+    module AdapterQuoting
+      def quote_column_name(name)
+        return super if Ractor.main?
+
+        shared_name = Ractor.make_shareable(name, copy: true)
+        ActiveSupport::Ractors.on_main(self) { quote_column_name(shared_name) }
+      end
+
+      def quote_table_name(name)
+        return super if Ractor.main?
+
+        shared_name = Ractor.make_shareable(name, copy: true)
+        ActiveSupport::Ractors.on_main(self) { quote_table_name(shared_name) }
+      end
+    end
+
+    # Route arguments can contain records with native Set caches. Only their
+    # to_param value is needed to generate a mount prefix; keep the caller's
+    # original record objects in the options passed to the actual route.
+    def self.routing_snapshot(value)
+      return value if Ractor.shareable?(value)
+
+      copy = case value
+             when ActiveRecord::Base then value.to_param
+             when Hash then value.to_h { |key, item| [routing_snapshot(key), routing_snapshot(item)] }
+             when Array then value.map { |item| routing_snapshot(item) }
+             when Set then Set.new(value.map { |item| routing_snapshot(item) })
+             else return Ractor.make_shareable(value, copy: true)
+             end
+      Ractor.make_shareable(copy)
+    end
+
+    module MountedRoutes
+      def find_script_name(options)
+        return super unless defined?(Ractor.shareable_proc) && !Ractor.main?
+
+        shared_options = RactorSupport.routing_snapshot(options)
+        prefix, updated = ActiveSupport::Ractors.on_main(self) do
+          local_options = shared_options.dup
+          [find_script_name(local_options), local_options]
+        end
+        (shared_options.keys - updated.keys).each { |key| options.delete(key) }
+        updated.each do |key, value|
+          options[key] = value unless shared_options.key?(key) && shared_options[key] == value
+        end
+        prefix
+      end
+    end
+
+    module Digesting
+      def hexdigest(value)
+        return super if Ractor.main?
+
+        shared_value = Ractor.make_shareable(value, copy: true)
+        ActiveSupport::Ractors.on_main(self) { hexdigest(shared_value) }
+      end
+    end
+
+    module KeyGeneration
+      def generate_key(salt, key_size = 64)
+        return super if Ractor.main?
+
+        shared_salt = Ractor.make_shareable(salt, copy: true)
+        ActiveSupport::Ractors.on_main(self) { generate_key(shared_salt, key_size) }
+      end
+    end
+
+    module UploadCleanup
+      def open
+        reopen(path, 'rb+')
+        self
+      end
+
+      # Tempfile#close takes a positional unlink flag.
+      def close(unlink_now = false) # rubocop:disable Style/OptionalBooleanParameter
+        super() unless closed?
+        unlink if unlink_now
+      end
+
+      def unlink
+        File.unlink(path)
+      rescue Errno::ENOENT
+        nil
+      end
+
+      def close!
+        close(true)
+      end
+    end
+
+    def self.upload_tempfile(filename, _content_type)
+      extension = File.extname(filename.gsub("\0", '%00'))[0, 129]
+      Tempfile.create(['RackMultipart', extension]).extend(UploadCleanup)
+    end
+
+    class Middleware
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        if (fallbacks = RactorSupport.fallbacks)
+          Fiber[:i18n_fallbacks] ||= fallbacks
+          env['rack.multipart.tempfile_factory'] ||= RactorSupport.method(:upload_tempfile) unless Ractor.main?
+        end
+        @app.call(env)
+      end
+    end
+
+    def self.fallbacks
+      @fallbacks
+    end
+
+    module StorageMetadata
+      def analyzed = read_store_attribute(:metadata, :analyzed)
+      def identified = read_store_attribute(:metadata, :identified)
+      def composed = read_store_attribute(:metadata, :composed)
+
+      def analyzed=(value)
+        write_store_attribute(:metadata, :analyzed, value)
+      end
+
+      def identified=(value)
+        write_store_attribute(:metadata, :identified, value)
+      end
+
+      def composed=(value)
+        write_store_attribute(:metadata, :composed, value)
+      end
+    end
+
+    class StorageServices
+      def initialize(configurations)
+        @configurations = Ractor.make_shareable(configurations, copy: true)
+        freeze
+      end
+
+      def fetch(name, &)
+        registry = if Ractor.main?
+                     RactorSupport.storage_registry
+                   else
+                     Ractor[:engine_storage_services] ||= ActiveStorage::Service::Registry.new(@configurations)
+                   end
+        registry.fetch(name, &)
+      end
+    end
+
+    def self.storage_registry
+      @storage_registry
+    end
+
+    module StorageChecksums
+      def checksum_implementation(**options)
+        implementation = super
+        if Ractor.main? || !implementation.respond_to?(:name) || !implementation.name&.start_with?('OpenSSL::Digest::')
+          return implementation
+        end
+
+        DigestFactory.new(implementation.name.delete_prefix('OpenSSL::Digest::'))
+      end
+    end
+
+    class DigestFactory
+      def initialize(algorithm)
+        @algorithm = algorithm.freeze
+        freeze
+      end
+
+      def new
+        OpenSSL::Digest.new(@algorithm)
+      end
+
+      def file(io)
+        new.file(io)
+      end
+
+      def base64digest(value)
+        new.base64digest(value)
+      end
+    end
+
+    def self.prepare_redirects!
+      base = ActionController::Base
+      readers = Module.new
+      %i[raise_on_open_redirects action_on_open_redirect action_on_path_relative_redirect].each do |key|
+        source = base.method(key).source_location&.first
+        next unless source&.end_with?('/action_controller/metal/redirecting.rb')
+
+        value = Ractor.make_shareable(base.public_send(key), copy: true)
+        readers.define_method(key, Ractor.shareable_proc { Ractor.main? ? super() : value })
+      end
+      return if readers.instance_methods(false).empty?
+
+      base.prepend(readers)
+      base.singleton_class.prepend(readers)
+    end
+
+    def self.prepare_previewers!
+      ActiveStorage.previewers.each do |previewer|
+        readers = Module.new
+        previewer.methods.grep(/_exists\?\z/).each do |capability|
+          method = previewer.method(capability)
+          next unless method.arity.zero? && method.source_location&.first&.include?('/active_storage/previewer/')
+
+          readers.define_method(capability, Ractor.shareable_proc do
+            if Ractor.main?
+              super()
+            else
+              ActiveSupport::Ractors.on_main(self) { public_send(capability) }
+            end
+          end)
+        end
+        previewer.singleton_class.prepend(readers) unless readers.instance_methods(false).empty?
+      end
+    end
+
+    def self.prepare_storage!
+      return unless defined?(ActiveStorage::Blob)
+
+      prepare_previewers!
+      ActiveStorage::Blob.prepend(StorageMetadata) unless ActiveStorage::Blob < StorageMetadata
+      %i[EXTENSIONS TYPE_EXTS TYPE_ALIASES TYPE_PARENTS ROOT_XML MAGIC].each do |name|
+        Ractor.make_shareable(Marcel.const_get(name)) if Marcel.const_defined?(name)
+      end
+      ActiveStorage::Service.prepend(StorageChecksums) unless ActiveStorage::Service < StorageChecksums
+      unless Ractor.shareable?(ActiveStorage::Blob.services)
+        @storage_registry = ActiveStorage::Blob.services
+        configurations = @storage_registry.instance_variable_get(:@configurations)
+        default_name = ActiveStorage::Blob.service.name
+        default_reader = Module.new
+        default_reader.define_method(:service, Ractor.shareable_proc do
+          Ractor.main? ? super() : services.fetch(default_name)
+        end)
+        ActiveStorage::Blob.singleton_class.prepend(default_reader)
+        ActiveStorage::Blob.services = StorageServices.new(configurations)
+      end
+      settings = ActiveStorage.class_variables.map { |name| name.to_s.delete_prefix('@@').to_sym }
+      settings.select! { |key| ActiveStorage.respond_to?(key) }
+      snapshot = settings.to_h { |key| [key, ActiveStorage.public_send(key)] }
+      checksum = snapshot[:checksum_implementation]
+      if checksum.is_a?(Class) && checksum.name&.start_with?('OpenSSL::Digest::')
+        snapshot[:checksum_implementation] = DigestFactory.new(checksum.name.delete_prefix('OpenSSL::Digest::'))
+      end
+      Ractor.make_shareable(snapshot)
+      readers = Module.new
+      settings.each do |key|
+        readers.define_method(key, Ractor.shareable_proc { Ractor.main? ? super() : snapshot.fetch(key) })
+      end
+      ActiveStorage.singleton_class.prepend(readers)
+    end
+
+    def self.prepare_framework!
+      CGI.singleton_class.prepend(UriUnescaping) unless CGI.singleton_class < UriUnescaping
+      Ractor.make_shareable(GlobalID.app) if defined?(GlobalID) && GlobalID.respond_to?(:app)
+      I18n.available_locales.each { |locale| I18n.transliterate('ractor', locale: locale) }
+      require 'i18n/ractorize'
+      require 'tempfile'
+      prepare_redirects!
+      %i[BASE36_ALPHABET BASE58_ALPHABET].each do |name|
+        Ractor.make_shareable(SecureRandom.const_get(name)) if SecureRandom.const_defined?(name)
+      end
+      uniqueness = ActiveRecord::Validations::UniquenessValidator
+      uniqueness.prepend(UniquenessCoverage) unless uniqueness < UniquenessCoverage
+      dependencies = ActiveSupport::Dependencies.singleton_class
+      dependencies.prepend(DependencyInterlock) unless dependencies < DependencyInterlock
+      prepare_storage!
+      Ractor.make_shareable(ActiveRecord::Associations::AssociationScope::INSTANCE)
+      Ractor.make_shareable(ActionDispatch::Http::Cache::Response::SPECIAL_KEYS)
+      freshness = ActionDispatch::Http::Cache::Request.singleton_class
+      freshness.prepend(CacheFreshness) unless freshness < CacheFreshness
+      fallbacks = I18n.fallbacks
+      I18n.available_locales.each { |locale| fallbacks[locale] }
+      @fallbacks = Ractor.make_shareable(fallbacks)
+      ActiveSupport::Digest.singleton_class.prepend(Digesting) unless ActiveSupport::Digest.singleton_class < Digesting
+      ActiveSupport::KeyGenerator.prepend(KeyGeneration) unless ActiveSupport::KeyGenerator < KeyGeneration
+      ActiveRecord::Base.connection_handler.connection_pool_list.each do |pool|
+        adapter = pool.db_config.adapter_class.singleton_class
+        adapter.prepend(AdapterQuoting) unless adapter < AdapterQuoting
+      end
+    rescue LoadError => e
+      raise LoadError,
+            "Ractor requests need the upstream I18n Ractor support (see gemfiles/rails_ractor.gemfile): #{e.message}"
+    end
+
+    def self.broadcast(name, payload)
+      if @prepared && !Ractor.main?
+        shared_name = Ractor.make_shareable(name, copy: true)
+        shared_payload = Ractor.make_shareable(payload, copy: true)
+        ActiveSupport::Ractors.on_main { ActionCable.server.broadcast(shared_name, shared_payload) }
+      else
+        ActionCable.server.broadcast(name, payload)
+      end
+    end
+
+    def self.prepare!
+      # A cache store can reference the whole middleware stack and freeze
+      # other mounted engines before their own hooks run. Warm every engine's
+      # request environment before making any of that graph shareable.
+      Rails.application.railties.each do |railtie|
+        railtie.env_config if railtie.is_a?(Rails::Engine)
+      end
+      Engine.instance.env_config
+      prepare_framework!
+      ActiveRecord::Base.descendants.each do |model|
+        next if model.abstract_class? || !model.table_exists?
+
+        model.reflect_on_all_associations.each { |reflection| reflection.send(:inverse_name) }
+        prepare_attributes(model)
+        Ractor.make_shareable(model.defined_enums)
+        model.defined_enums.each do |attribute, mapping|
+          method_name = attribute.pluralize
+          source = model.method(method_name).source_location&.first
+          next unless source&.end_with?('/active_record/enum.rb')
+
+          model.define_singleton_method(method_name, Ractor.shareable_proc { mapping })
+        end
+        model.define_attribute_methods
+        if model.respond_to?(:attachment_reflections)
+          model.attachment_reflections.each_value(&:named_variants)
+          Ractor.make_shareable(model.attachment_reflections)
+        end
+      end
+      ActionController::Base.descendants.each do |controller|
+        next unless controller.name&.start_with?('Livechat::')
+
+        controller.prepend(LiveThreads) if defined?(ActionController::Live) && controller < ActionController::Live
+        renderer_source = controller.instance_method(:_render_with_renderer_json).source_location&.first
+        if renderer_source&.end_with?('/action_controller/metal/renderers.rb') && !(controller < JsonRendering)
+          controller.prepend(JsonRendering)
+        end
+        Ractor.make_shareable(controller.controller_name)
+        controller.etaggers = controller.etaggers.map { |callback| Ractor.shareable_proc(&callback) }.freeze
+      end
+      Livechat.instance_variable_set(:@config, configuration(Livechat.config))
+      %i[javascript dashboard_javascript dashboard_stylesheet fingerprint
+         dashboard_fingerprint dashboard_stylesheet_fingerprint].each do |method|
+        next unless Widget.respond_to?(method)
+
+        Widget.public_send(method)
+      end
+      ActionController::Base.descendants.each do |controller|
+        next unless controller.respond_to?(:livechat_rate_limit_options)
+
+        options = controller.livechat_rate_limit_options
+        controller.livechat_rate_limit_options = share_options(options)
+      end
+      if Livechat.config.action_cable && defined?(ActionCable)
+        verifier = Livechat.stream_verifier
+        verifier.verify(verifier.generate('livechat:ractor:warmup'))
+        Livechat.instance_variable_set(:@stream_verifier, Ractor.make_shareable(verifier))
+      end
+      @prepared = true
+      Widget.instance_variables.each do |variable|
+        Widget.instance_variable_set(variable, Ractor.make_shareable(Widget.instance_variable_get(variable)))
+      end
+    end
+
+    # Rails edge's rate_limit currently closes over reassigned keyword
+    # arguments. A named filter avoids that unshareable closure; the actual
+    # counter, cache key and rejection still use Rails' rate_limiting method.
+    def self.rate_limit(controller, to:, within:, only:, with:, **options)
+      unless Rails::Application.method_defined?(:ractorize!)
+        return controller.rate_limit(to: to, within: within, only: only, with: with, **options)
+      end
+
+      controller.class_attribute :livechat_rate_limit_options, instance_accessor: false
+      controller.livechat_rate_limit_options = {
+        to: to, within: within, by: -> { request.remote_ip }, with: with,
+        store: controller.cache_store, name: nil, scope: controller.controller_path
+      }.merge(options.slice(:by, :store, :name, :scope))
+      controller.livechat_rate_limit_options[:scope] ||= controller.controller_path
+      filters = options.except(:by, :store, :name, :scope)
+      controller.before_action :livechat_rate_limit, only: only, **filters
+      controller.class_eval <<~RUBY, __FILE__, __LINE__ + 1
+        private
+        def livechat_rate_limit
+          rate_limiting(**self.class.livechat_rate_limit_options)
+        end
+      RUBY
+    end
+
+    def self.share_options(options)
+      options.to_h do |key, value|
+        value = configuration_value(value) if value.is_a?(Proc)
+        [key, Ractor.make_shareable(value)]
+      end.freeze
+    end
+
+    def self.configuration_value(value)
+      case value
+      when Proc
+        return value if Ractor.shareable?(value)
+
+        # Like Rails callbacks, isolated callbacks use arguments and constants,
+        # not their initializer's implicit self. Keep lambda/proc arity intact.
+        value.lambda? ? Ractor.shareable_lambda(&value) : Ractor.shareable_proc(&value)
+      when Hash
+        value.to_h { |key, item| [configuration_value(key), configuration_value(item)] }.freeze
+      when Array
+        value.map { |item| configuration_value(item) }.freeze
+      else
+        Ractor.make_shareable(value, copy: true)
+      end
+    end
+
+    def self.configuration(original)
+      prepared = original.dup
+      original.instance_variables.each do |variable|
+        value = original.instance_variable_get(variable)
+        begin
+          shared = configuration_value(value)
+          prepared.instance_variable_set(variable, shared)
+        rescue Ractor::Error, TypeError => e
+          setting = variable.to_s.delete_prefix('@')
+          raise ArgumentError, "Livechat.config.#{setting} cannot be shared with Ractors: #{e.message}"
+        end
+      end
+      Ractor.make_shareable(prepared)
+    end
+  end
+end

data/lib/livechat/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Livechat
-  VERSION = '1.0.0'
+  VERSION = '1.2.0'
 end

data/lib/livechat/widget.rb

@@ -9,9 +9,9 @@ module Livechat
   # Rails app regardless of its CSS or JS setup. It lives under lib/ (not
   # app/assets/) so a host that runs an asset pipeline never ingests it.
   module Widget
-    SOURCE = File.expand_path('widget.js', __dir__)
-    DASHBOARD_SOURCE = File.expand_path('dashboard.js', __dir__)
-    DASHBOARD_STYLESHEET_SOURCE = File.expand_path('dashboard.css', __dir__)
+    SOURCE = File.expand_path('widget.js', __dir__).freeze
+    DASHBOARD_SOURCE = File.expand_path('dashboard.js', __dir__).freeze
+    DASHBOARD_STYLESHEET_SOURCE = File.expand_path('dashboard.css', __dir__).freeze
 
     # Right-to-left scripts, so the chat renders mirrored for those locales.
     # Matched on the language subtag, so region variants ("ar-EG") count too.
@@ -58,29 +58,54 @@ module Livechat
       # nonce gets refused; a same-origin src is covered by `'self'` on every
       # visit. `nonce:` is still stamped for hosts whose script-src has no
       # 'self'; pass nil when the app has no nonce.
-      def snippet(locale:, authenticated:, avatar_url: nil, nonce: nil)
-        json = config_json(locale:, authenticated:, avatar_url:)
+      def snippet(locale:, authenticated:, settings: nil, nonce: nil)
+        json = config_json(locale:, authenticated:, settings:)
         nonce_attr = nonce ? %( nonce="#{nonce}") : ''
-        src = "#{Livechat.config.mount_path.chomp('/')}/widget.js?v=#{fingerprint}"
 
         %(<script type="application/json" data-livechat-config>#{json}</script>) +
-          %(<script src="#{src}" defer#{nonce_attr} data-livechat-widget></script>)
+          %(<script src="#{script_src}" defer#{nonce_attr} data-livechat-widget></script>)
       end
 
-      def config_json(locale:, authenticated:, avatar_url: nil)
+      # The same two tags, assembled by the browser instead of by a Rails
+      # template. A page this app does not render — a static marketing site
+      # proxying the mount path through to Rails — gets the widget from one
+      # plain <script src>, and never reproduces the config block itself.
+      def embed_javascript(locale:, authenticated:, settings: nil)
+        <<~JS
+          /* livechat embed */
+          (function () {
+            if (window.__livechatEmbedded) return;
+            window.__livechatEmbedded = true;
+
+            var config = document.createElement("script");
+            config.type = "application/json";
+            config.setAttribute("data-livechat-config", "");
+            config.textContent = JSON.stringify(#{config_json(locale:, authenticated:, settings:)});
+            document.head.appendChild(config);
+
+            var widget = document.createElement("script");
+            widget.src = #{script_src.to_json};
+            widget.setAttribute("data-livechat-widget", "");
+            document.head.appendChild(widget);
+          })();
+        JS
+      end
+
+      def config_json(locale:, authenticated:, settings: nil)
         config = Livechat.config
+        settings ||= Livechat.settings_for(nil)
         payload = {
           endpoint: config.widget_endpoint,
           locale: locale.to_s,
           rtl: rtl?(locale),
           authenticated: authenticated ? true : false,
-          launcher: config.show_launcher ? true : false,
+          launcher: settings[:show_launcher] ? true : false,
           appName: Livechat.app_name,
-          avatarUrl: avatar_url,
-          accentColor: config.accent_color,
+          avatarUrl: settings[:avatar_url],
+          accentColor: settings[:accent_color],
           attachments: Livechat.attachments_enabled?,
           maxAttachments: config.max_attachments,
-          labels: labels
+          labels: labels(settings)
         }
         # Escape "</" so a value can't close the <script> block early.
         payload.to_json.gsub('</', '<\/')
@@ -88,16 +113,19 @@ module Livechat
 
       private
 
+      def script_src
+        "#{Livechat.config.mount_path.chomp('/')}/widget.js?v=#{fingerprint}"
+      end
+
       # Every user-facing string in the widget, resolved through Rails I18n so
       # the chat follows the app's current locale. Each lookup carries an
       # English default, so the widget stays fully worded even when a key is
       # missing for the active locale.
-      def labels
-        config = Livechat.config
+      def labels(settings)
         {
-          launcher: config.launcher_label.presence || t(:launcher, 'Chat with us'),
-          greeting: config.greeting.presence || t(:greeting, 'Hi! How can we help?'),
-          replyTime: config.reply_time_text.presence ||
+          launcher: settings[:launcher_label].presence || t(:launcher, 'Chat with us'),
+          greeting: settings[:greeting].presence || t(:greeting, 'Hi! How can we help?'),
+          replyTime: settings[:reply_time_text].presence ||
             t(:reply_time, 'We usually reply within a few hours.'),
           placeholder: t(:placeholder, 'Write a message…'),
           send: t(:send, 'Send'),

data/lib/livechat/widget_helper.rb

@@ -12,7 +12,7 @@ module Livechat
       Widget.snippet(
         locale: I18n.locale,
         authenticated: livechat_visitor.present?,
-        avatar_url: livechat_avatar_url,
+        settings: Livechat.settings_for(request),
         nonce: (content_security_policy_nonce if respond_to?(:content_security_policy_nonce))
       ).html_safe
     end
@@ -33,12 +33,6 @@ module Livechat
 
     private
 
-    def livechat_avatar_url
-      value = Livechat.config.avatar_url
-      value = value.call(request) if value.respond_to?(:call)
-      value.to_s.presence
-    end
-
     def livechat_visitor
       return @livechat_visitor if defined?(@livechat_visitor)
 

data/lib/livechat.rb

@@ -2,6 +2,7 @@
 
 require 'livechat/version'
 require 'livechat/configuration'
+require 'livechat/ractor_support'
 require 'livechat/widget'
 require 'livechat/widget_helper'
 require 'livechat/attachment_policy'
@@ -30,6 +31,49 @@ module Livechat
       !!config.enabled.call(request)
     end
 
+    # The engine's public surface: the widget script, the embed bootstrap, the
+    # visitor API and the attachment route. All of them answer with JavaScript,
+    # JSON or a file, and none of them need a Rails session.
+    #
+    # Exposed because a host usually has session, CSP or caching rules written
+    # for its own HTML pages, and applying those here costs every visitor a
+    # cookie for a request that never had a use for one.
+    def public_paths
+      mount = config.mount_path.chomp('/')
+      ["#{mount}/widget.js", "#{mount}/embed.js", "#{mount}/widget/", "#{mount}/attachments/"]
+    end
+
+    # Resolve a setting that may be a plain value or a per-request callable.
+    def resolve(value, request)
+      value.respond_to?(:call) ? value.call(request) : value
+    end
+
+    # The per-request widget settings a host may vary by surface. Resolved by
+    # the helper and by the embed script, so both routes see the same values.
+    def settings_for(request)
+      {
+        greeting: resolve(config.greeting, request),
+        reply_time_text: resolve(config.reply_time_text, request),
+        launcher_label: resolve(config.launcher_label, request),
+        show_launcher: resolve(config.show_launcher, request),
+        accent_color: resolve(config.accent_color, request),
+        avatar_url: resolve(config.avatar_url, request).to_s.presence
+      }
+    end
+
+    # Is this request coming from a page on an allowlisted external origin?
+    #
+    # Only ever true for a request the browser stamped with a matching Origin.
+    # A missing Origin is not a match: a non-browser client must not inherit a
+    # browser-guaranteed exemption.
+    def embedded?(request)
+      origin = request.origin.presence
+      return false unless origin
+
+      allowed = resolve(config.allowed_embed_origins, request)
+      Array(allowed).any? { |candidate| candidate.to_s.chomp('/') == origin.chomp('/') }
+    end
+
     # Can this request work the inbox? Checked by every inbox action.
     # The class Livechat::DashboardController inherits from. Resolved on every
     # call rather than memoized, so a host that reassigns base_controller_class

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: livechat
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Yaroslav Shmarov
@@ -97,6 +97,10 @@ files:
 - config/locales/livechat.vi.yml
 - config/locales/livechat.zh-CN.yml
 - config/routes.rb
+- docs/ractors.md
+- docs/screenshots/01-widget.png
+- docs/screenshots/03-inbox.png
+- docs/screenshots/04-conversation.png
 - lib/generators/livechat/install/install_generator.rb
 - lib/generators/livechat/install/templates/create_livechat_tables.rb.tt
 - lib/generators/livechat/install/templates/initializer.rb
@@ -109,6 +113,7 @@ files:
 - lib/livechat/dashboard.js
 - lib/livechat/engine.rb
 - lib/livechat/notifications.rb
+- lib/livechat/ractor_support.rb
 - lib/livechat/seeds.rb
 - lib/livechat/version.rb
 - lib/livechat/widget.js
@@ -138,7 +143,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: 'Open-source live chat for Rails: a drop-in support widget plus a team inbox,
   in your own database.'