logster 2.20.1 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: df1b755e756b30297ee48fe00456a874cf3b786a824afdb11ae42e42382db0e8
-  data.tar.gz: 33327bda522fba9743bbf871b700aa68f86df7ef27182d4d1dc0ac11dfa53a6d
+  metadata.gz: eb3cace958418f67569d2d5847ae6abf08903a8a5d5114e9472e894a22379e1d
+  data.tar.gz: 9eb299f2e3e48cb69286f3d04b51beb6ef02a7c5f01c2bf9b1c88420b1ac85a9
 SHA512:
-  metadata.gz: 752bcff5c4e7473f141a7fcc3bfdfc64c2aa8e42027f92861e941de4acb1386139f4f993399f51a10ba804d7318bd2a41831f7bae8ddf09a1b2fa61d14c82c48
-  data.tar.gz: 3c860e2cc631814d131117a8e77c2c4bcde76b86149988a482b6dba4b076cbff166b63921756ba85236ea3dbcaf660e61682d3560c16ce4065178c1407321d63
+  metadata.gz: bf7c85b2e804442dd43e64c50b8bd178a85d70746b7ee1d27cbe75842d0afbbffb711a87e14739ab2d899e1a22e8150e68ea440279b74cbacbabba33b7037355
+  data.tar.gz: 58d5fc04bc4a430a1f8f56d1c51b9be1447224517ddecc934abd0ad3d5d131fccc595d13c30ae19c9aaa68f4c9db2f8791a4a1ac1d2fa6ddc57b19a17a384f17

data/CHANGELOG.md

@@ -1,156 +1,143 @@
 # CHANGELOG
 
-- 2025-02-06: 2.20.1
+- 2026-10-19: 3.0.0
+
+  - BREAKING: Require Ruby 3.3 or newer; support is now focused on maintained Ruby 3.3, 3.4, and 4.0 releases
+  - BREAKING: Drop support for Rails versions before 8.0; Rails 8.0 and 8.1 are now supported
+  - BREAKING: Target Rack 3.1–3.2, redis-rb 6.x, and Redis Open Source 8.10
+  - BREAKING: Require Node.js 24 and pnpm 10 for frontend development, replace Yarn with pnpm, and drop Internet Explorer 11 support
+  - SECURITY: Require the documented HTTP method and `X-Requested-With: XMLHttpRequest` header for mutating viewer endpoints; JavaScript error reports additionally accept browser-verified same-origin requests so `navigator.sendBeacon` remains supported; reject cross-site requests using `Origin` and `Sec-Fetch-Site`
+  - SECURITY: Add the optional `Logster.config.authorize_request` defense-in-depth callback for viewer routes
+  - SECURITY: Add no-store, referrer, content-type, and framing response headers, tighten the viewer Content Security Policy, and remove externally hosted Google Fonts
+  - UX: Improve grouping-pattern creation for grouped or unrelated messages, surface submission errors, and prevent duplicate submissions while saving
+  - UX: Add success and failure feedback when copying messages, support messages without environment data, and fall back for browsers without the Clipboard API
+  - UX: Drive the log search from the `search` query parameter so a search can be linked to and reloaded
+  - FIX: Keep protect and unprotect actions in sync with request results, restoring their previous state when a request fails
+  - FIX: Correct pattern settings state handling for plain JSON arrays and newly created or removed patterns
+  - DEV: Upgrade the client from Ember 3.28 to Ember 7.2 and serve the scripts and stylesheets listed in a manifest generated by the Ember build
+  - DEV: Convert the client components and route templates to Glimmer GJS
+  - DEV: Add a unified `bundle exec rake dev` workflow that installs dependencies, starts the backend and frontend, waits for readiness, and opens the app
+  - DEV: Add a reusable sample-data loader and richer development fixtures, and run the website tests in CI
+  - DEV: Ship only the runtime files and the built frontend assets in the gem, and verify the packaged assets before a release
+
+- 2026-04-29: 2.21.0
+  - FEATURE: Allow editing grouping pattern before submitting
 
+- 2025-02-06: 2.20.1
   - FIX: Don't break search when providing invalid regex characters
 
 - 2024-07-05: 2.20.0
-
   - Dropped support for Ruby 3.0
   - Add `Logster::Logger#subscribe` which allows subscribing to log events from `Logster::Logger`.
 
 - 2024-03-12: 2.19.1
-
   - FIX: Don’t truncate backtrace on copying
 
 - 2024-02-28: 2.19.0
-
   - FIX: Add compatibility with Rails 7.1+
 
 - 2024-02-19: 2.18.1
-
   - UX: backlink in dark mode has a dark background
 
 - 2024-02-15: 2.18.0
-
   - FEATURE: Implement a default Content-Security-Policy
 
 - 2024-02-15: 2.17.1
-
   - UX: fixed top menu when backlink to the site exists
 
 - 2024-02-15: 2.17.0
-
   - FEATURE: backlink to site
 
 - 2024-01-19: 2.16.0
-
   - FEATURE: Add inline grouping pattern creation
 
 - 2024-01-16: 2.15.0
-
   - FEATURE: Add loading spinner
 
 - 2024-01-15: 2.14.0
-
   - FEATURE: Stop grouping logs with different messages
 
 - 2023-11-01: 2.13.1
-
   - FIX: Solve/remove buttons on 'share' page
 
 - 2023-10-03: 2.13.0
-
   - FEATURE: Format messages with Logster::Logger#formatter before storing
 
 - 2023-03-10: 2.12.2
-
   - FIX: Don't throw on non-gem backtrace lines
 
 - 2023-03-10: 2.12.1
   Note: 2.12.0 was yanked due to a release process error
-
   - DEV: Upgrade to Ember 3.28
 
 - 2023-01-30: 2.11.4
-
   - DEV: Various dependencies upgrade
   - FIX: Switch the `/messages.json` endpoint from `GET` to `POST`
 
 - 2022-08-25: 2.11.3
-
   - DEV: Avoid deprecation warning in Redis 4.8 (#166)
 
 - 2022-04-28: 2.11.2
-
   - FIX: store override level in thread local storage (Truffle Ruby compatibility)
 
 - 2022-04-21: 2.11.1
-
   - FIX: Redis pipelining deprecation (#159)
 
 - 2022-03-12: 2.11.0
-
   - FEATURE: Improve support for logging error objects (#153)
 
 - 2021-11-26: 2.10.1
-
   - UX: More dark-mode related changes
 
 - 2021-11-26: 2.10.0
-
   - FEATURE: Introduce dark mode
 
 - 2021-10-27: 2.9.8
-
   - FIX: We weren't properly memoizing the hostname
 
 - 2021-07-01: 2.9.7
-
   - FEATURE: Optionally use full hostname
 
 - 2021-02-19: 2.9.6
-
   - UX: Make `Warn` level visible by default
 
 - 2021-01-21: 2.9.5
-
   - FIX: Stop encoding errors when converting Message objects to JSON (#128)
   - DEV: Bump dependencies
 
 - 2020-09-01: 2.9.4
-
   - FEATURE: Merge messages differing only by numbers (#118)
   - DEV: Bump dependencies
   - UX: Turn severities below `Error` off by default and remember changes using localStorage (#125)
 
 - 2020-08-20: 2.9.3
-
   - FIX: fix code that causes warning from recent redis gem
 
 - 2020-08-11: 2.9.2
-
   - FIX: `report_js_error` incorrectly denying logs when Redis#exists returns integer
 
 - 2020-07-20: 2.9.1
-
   - FIX: Missing application backtrace in chained loggers.
 
 - 2020-06-11: 2.9.0
-
   - FEATURE: Allows JS errors to specify a log severity
   - DEV: Several dependencies upgrades
   - FIX: Don't search if the phrase hasn't changed
   - UX: Distinguish the value of the current env from the values of other envs in a merged message
 
 - 2020-03-30: 2.8.0
-
   - FEATURE: Upgrade icons to Font Awesome 5
 
 - 2020-03-03: 2.7.1
-
   - FIX: Stop env mutation to allow all chained loggers to have the same env (#110)
 
 - 2020-02-26: 2.7.0
-
   - FEATURE: Make log message max length configurable and bump the default to 2000 (#109)
 
 - 2020-02-17: 2.6.3
-
   - FIX: Respect redis namespace when fetching env using LUA
 
 - 2020-02-09: 2.6.2
-
   - FIX: Regression with rendering single env when `env_expandable_keys` config is present
   - DEV: Fix Ember deprecations in tests
   - DEV: Add more tests to env rendering
@@ -159,11 +146,9 @@
   - FIX: Fetch env when navigating through grouped messages
 
 - 2020-02-07: 2.6.1
-
   - FIX: Fetch env when row is selected to allow copy to work on Firefox
 
 - 2020-02-07: 2.6.0
-
   - DEV: Bump handlebars from 4.1.2 to 4.5.3 in /client-app (#102)
   - FEATURE: Linkify backtrace lines to github (#104)
   - UX: Keep the 50 most recent envs rather than the first 50 (#103). Also introduces new config options `max_env_bytes` and `max_env_count_per_message`.
@@ -172,7 +157,6 @@
   - DEV: Upgrade Ember to 3.15 and remove jQuery and lodash as dependencies (#107)
 
 - 2019-12-13: 2.5.1
-
   - DEV: Bump puma from 4.2.1 to 4.3.1 in /website (#100)
   - FIX: Don't include messages that were removed from groups due to max size limit
   - FIX: loadingEnv is an attribute of model
@@ -180,7 +164,6 @@
   - UX: Group count attribute should be a long-running number of errors, not just the number of errors the group currently contains
 
 - 2019-12-12: 2.5.0
-
   - DEV: Update to latest version of gems
   - FIX: when rate limiting return an object responding to each
   - FEATURE: Expose the search phrase in query params
@@ -188,11 +171,9 @@
   - FEATURE: Custom grouping patterns
 
 - 2019-10-28: 2.4.2
-
   - FIX: wrong number of arguments when adding message using a block (#98)
 
 - 2019-10-17: 2.4.1
-
   - PERF: Debounce search field so it doesn't fire a search query at every keystroke.
   - PERF: Disallow search terms that are fewer than 2 characters long.
   - PERF: Bypass refresh cycle if previous cycle hasn't finished.
@@ -200,63 +181,50 @@
   - PERF: Cap message size to 60,000 bytes by default.
 
 - 2019-10-10: 2.4.0
-
   - FEATURE: Allow having retroactive affect when adding suppression patterns
   - DEV: Bump JS dependencies
 
 - 2019-10-08: 2.3.3
-
   - FEATURE: keep track of message timestamp when it's merged into another message
 
 - 2019-08-20: 2.3.2
-
   - FEATURE: automatic 1 minute rate limiting for js error reporting per IP
 
 - 2019-08-15: 2.3.1
-
   - DEV: upgrade Ember to 3.8 and jQuery to 3.4.1 (#84)
   - FIX: properly escape string ignore pattern (#88)
   - FIX: scrub params if they have invalid encoding (#92)
 
 - 2019-03-26: 2.3.0
-
   - FEATURE: track count of suppressed logs for each pattern
 
 - 2019-03-19: 2.2.0
-
   - FEATURE: custom suppression patterns via UI
   - UX: auto expand env keys when list length is <= 3
 
 - 2019-03-14: Unreleased
-
   - FIX: Logster message options missing when base logger is a sub-class of
     `Logster::Logger`
 
 - 2019-02-21: Version 2.1.2
-
   - FEATURE: allow certain env keys to be expandable via `Logster.config.env_expandable_keys.push(:key, :another_key)`. See https://github.com/discourse/logster/pull/81 for more info
 
 - 2019-02-21: Version 2.1.1
-
   - FEATURE: allow defer logger to be disabled as Ruby 2.5.3 can segfault with defer logger due to a bug in Ruby. To disable run `Logster::Scheduler.disable`
 
 - 2019-02-13: Version 2.1.0
-
   - FEATURE/DEV: adds a defer logger that will do logging asynchronously only in dev environments. It should speed things up a little in dev.
 
 - 2019-02-05: Version 2.0.1
-
   - FIX: env line height issue on iOS
 
 - 2019-01-17: Version 2.0.0.pre
-
   - FIX: don't merge any new env samples if there are 50 samples (1.4.0.pre regression)
   - UX: make env navigation controls stick to the top when scrolled
   - PERF: store env samples separately from the rest of message data
   - DEV: Rubocop
 
 - 2019-01-09: Version 1.4.0.pre
-
   - FEATURE: allow navigation through merged errors
   - FEATURE: search should look at env
   - FIX: deselect message if new filtering doesn't include selected message
@@ -264,85 +232,67 @@
   - FIX: hide "load more" when there are no more messages and filters/search applied
 
 - 2018-12-30: Version 1.3.4
-
   - FIX: linear-gradient issue on iOS
   - FIX: actions menu should have highest z-index
 
 - 2018-12-26: Version 1.3.3
-
   - Fix: fix double lines logs when date is too long
 
 - 2018-12-25: Version 1.3.2
-
   - UX: improve usability on mobile
 
 - 2018-11-09: Version 1.3.1
-
   - Feature: auto scrub invalid messages reported to logger
 
 - 2018-11-09: Version 1.3.0
-
   - Feature: upgrade Ember to 3.5.1
   - Feature: remove inline JS for CSP compliance
 
 - 2018-08-13: Version 1.2.10
-
   - Feature: expose chained loggers in Logster::Logger
 
 - 2017-10-27: Version 1.2.8
-
   - Fix: `Logster::Middleware::DebugExceptions` is passed a request in Rails 5 instead of the env.
 
 - 2017-01-30: Version 1.2.7
-
   - Feature: Add override_level to Logster::Logger allowing for threadsafe logger override
 
 - 2016-10-24: Version 1.2.6
-
   - Fix: Check if `Rails.env` is defined when using Logster in a none Rails project.
 
 - 2016-07-11: Version 1.2.5
-
   - Fix: Chained `Logster::Logger` logger now receives backtrace as well.
 
 - 2016-05-05: Version 1.2.4
-
   - Fix: XSS in log message show if attacker can inject script into ENV
 
 - 2016-05-05: Version 1.2.3
-
   - Fix: clear_all now also clears rate limits
   - Fix: protect against corrupt data in redis during clear
 
 - 2016-03-22: Version 1.2.2
-
   - Fix: Conflicting attributes and method name for `Logster::RedisStore#rate_limits`.
   - Fix: Rate limit checker was tracking limits too early. It should only track when a message has been bumped or saved.
 
 - 2016-03-22: Version 1.2.1
-
   - Feature: Add method to retrieve current rate from rate limiters.
   - Feature: Make `RedisStore#rate_limits` readable.
   - Feature: Make `RedisRateLimiter#callback` and `RedisRateLimiter#duration` readable.
 
 - 2016-03-18: Version 1.2.0
-
   - Fix: Move Redis configuration into RedisStore.
   - Feature: Allow `RedisStore#redis_prefix` to either be a String or a Proc.
 
 - 2016-02-11: Version 1.1.1
-
   - Feature: Error rate can now be tracked in one minute and one hour buckets.
 
 - 2015-11-27: Version 1.0.1
-
   - New assets and logster logo
   - Added favicon
   - Added title
   - Use rails logger instead of invoking store
 
 - 2015-08-18: Version 0.9.9
-
   - This marks the largest release of Logster to date, it has been in production use for quite a while, hence the version bump.
   - Feature: automatically group errors in production mode, can be manually controlled via Logster.config.allow_grouping
   - Feature: automatically track application version, can be manually controlled via Logster.config.application_version
@@ -359,46 +309,36 @@
   - Fix: protect/unprotect redirected to show page
 
 - 2015-06-16: Version 0.8.3
-
   - Chained loggers now respect chain ignore
   - Add hostname and process_id to env on all messages
 
 - 2015-06-10: Version 0.8.2
-
   - Add hostname and process_id to env on all messages
 
 - 2015-05-01: Version 0.8.1
-
   - Don't crash out logging routine if redis is down or stderr is closed
 
 - 2015-04-16: Version 0.8.0
-
   - Improve formatting of /show page
   - Big version bump cause it is quite stable
 
 - 2015-02-27: Version 0.1.7
-
   - Fix invalid request on ?test
 
 - 2014-08-05: Version 0.1.3
-
   - Automatically include ignore filter
 
 - 2014-08-13: Version 0.1.6
-
   - Simplify install process
   - Fix crash on 404 in /logs dir
 
 - 2014-08-10: Version 0.1.5
-
   - Fix crash in Rails 3
 
 - 2014-08-08: Version 0.1.4
-
   - Fix crash in ignore filter
 
 - 2014-07-17: Version 0.1.1
-
   - Refactored report method into base_store.rb - will be easier to make a new log store
   - Add link in UI to clear all (non-protected) logs
   - Add example of submitting logs from Sidekiq jobs
@@ -406,42 +346,33 @@
   - Render hashes provided via Logster.add_to_env
 
 - 2014-07-04: Version 0.0.12
-
   - Feature: Able to share logs, at /logs/show/(hexdigits)
   - Add protecting logs, so they aren't deleted when old (for use with sharing)
   - Restructured Redis data model
 
 - 2014-05-24: Version 0.0.10
-
   - Correct context for error reporting
   - Clean up backtraces of reported exceptions
 
 - 2014-05-13: Version 0.0.9
-
   - Stray debugger message removed, add window.location logging to js
 
 - 2014-05-13: Version 0.0.8
-
   - Fix packaging binstubs by mistake
 
 - 2014-05-13: Version 0.0.7
-
   - Add support for javascript exception logging
 
 - 2014-05-12: Version 0.0.6
-
   - Add referer to env
 
 - 2014-05-12: Version 0.0.5
-
   - Feature: We now log basic rack environment with the messages
   - Add your own with Logster.add_to_env(env, key, value)
 
 - 2014-05-07: Version 0.0.4
-
   - Feature: Ability to ignore patterns with Logster.store.ignore = [/regex/]
   - Feature: Store backtraces, allow people to view them in the GUI
 
 - 2014-05-07: Started changelog :)
-
   - Report params in env tab

data/README.md

@@ -1,12 +1,10 @@
-![logster logo](https://raw.githubusercontent.com/discourse/logster/master/website/images/logo-logster-cropped-small.png)
+![logster logo](https://raw.githubusercontent.com/discourse/logster/main/website/images/logo-logster-cropped-small.png)
 
 Logster is an embedded Ruby "exception reporting service" admins can view on live websites, at `http://example.com/logs`
 
 ## Interface
 
-![Screenshot](https://raw.githubusercontent.com/discourse/logster/master/website/images/logster-screenshot.png)
-
-Play with a live demo at [logster.info/logs](http://logster.info/logs).
+![Screenshot](https://raw.githubusercontent.com/discourse/logster/main/website/images/logster-screenshot.png)
 
 ## Installation
 
@@ -27,7 +25,19 @@ constraints lambda { |req| req.session["admin"] } do
 end
 ```
 
-By default, logster will only run in development and production environments.
+By default, Logster will only run in development and production environments.
+
+## Supported versions
+
+Logster supports maintained release series only:
+
+- Ruby 3.3, 3.4, and 4.0
+- Rails 8.0 and 8.1
+- Rack 3.1 and 3.2
+- redis-rb 6.x
+- Redis Open Source 8.10
+
+Support for a release series ends when its upstream security support ends. Ruby head is also tested proactively, and the CI matrix is the source of truth for the combinations tested by Logster.
 
 To run logster in other environments, in `config/application.rb`
 
@@ -40,6 +50,8 @@ Logster.set_environments([:development, :staging, :production])
 Logster can be configured using `Logster.config`:
 
 - `Logster.config.application_version`: set to a unique identifier denoting version of your app. The "solve" function takes this version into account when suppressing errors.
+- `Logster.config.authorize_request` : Optional defense-in-depth authorization callback. It receives the Rack environment and must return a truthy value to allow access. The application must still mount Logster behind its normal administrator authentication constraint.
+
 - `Logster.config.enable_js_error_reporting` : enable js error reporting from clients
 - `Logster.config.rate_limit_error_reporting` : controls automatic 1 minute rate limiting for JS error reporting.
 - `Logster.config.web_title` : `<title>` tag for logster error page.
@@ -60,12 +72,16 @@ Logster can be configured using `Logster.config`:
 
 - `Logster.config.enable_backtrace_links` : Enable/disable the backtrace links feature.
 
-- `Logster.config.gems_dir` : The value of this config is `Gem.dir + "/gems/"` by default. You probably don't need to change this config, but it's available in case your app gems are installed in a different directory. An example where this config is needed is Logster [demo site](http://logster.info/logs/): [https://github.com/discourse/logster/blob/master/website/sample.rb#L77](https://github.com/discourse/logster/blob/master/website/sample.rb#L77).
+- `Logster.config.gems_dir` : The value of this config is `Gem.dir + "/gems/"` by default. You probably don't need to change this config, but it's available in case your application gems are installed in a different directory.
 
 - `Logster.config.back_to_site_link_path` : Path for the backlink to site.
 
 - `Logster.config.back_to_site_link_text` : Text for the backlink to site.
 
+### HTTP endpoint security
+
+Logster's supplied browser client sends mutating viewer requests with their required HTTP methods and the `X-Requested-With: XMLHttpRequest` header. Custom viewer integrations must do the same. JavaScript error reports may use that header or a browser-verified `Sec-Fetch-Site: same-origin` request, which allows same-origin `navigator.sendBeacon` reporting. Cross-site fetch metadata and mismatching origins from clients without same-origin fetch metadata are rejected. Mounting `Logster::Web` behind an administrator authentication constraint remains required; `authorize_request` can add a second authorization check inside the Rack application.
+
 ### Tracking Error Rate
 
 Logster allows you to register a callback when the rate of errors has exceeded
@@ -144,11 +160,10 @@ Logster UI is built using [Ember.js](http://emberjs.com/)
 
 1. Fork it ( https://github.com/discourse/logster/fork )
 2. Create your feature branch (`git checkout -b my-new-feature`)
-3. Run `cd client-app && yarn install`
-4. Run `cd website && bundle install`
-5. In the root directory, run `bundle exec rake client_dev` to start Sinatra server (port 9292) and Ember server (port 4200). Use Ember server for hot reload for client code.
-6. Visit `http://localhost:4200/logs/` (with trailing slash) to test the application. Reload `http://localhost:4200/report_error` to add sample log data.
-7. Once you're done making changes, run `./build_client_app.sh` to make and copy a production build to the assets folder.
-8. Commit your changes (`git commit -am 'Add some feature'`)
-9. Push to the branch (`git push origin my-new-feature`)
-10. Create a new Pull Request
+3. Run `bundle install`
+4. Run `bundle exec rake dev`. This installs any missing frontend and website dependencies, starts both development servers, and opens Logster in your browser.
+5. Visit `http://localhost:9292/report_error` to add sample log data. The Ember app at `http://localhost:4200/logs/` reloads automatically as you make frontend changes.
+6. Once you're done making changes, run `./build_client_app.sh` to make and copy a production build to the assets folder.
+7. Commit your changes (`git commit -am 'Add some feature'`)
+8. Push to the branch (`git push origin my-new-feature`)
+9. Create a new Pull Request