m365_active_storage 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d083b38ef3eacb7fa4d749c7c8a1de3c11fd3e8e86350d11c9533f9f295034e
-  data.tar.gz: b8db90e6bd4d2f16c5664ae495cdf4efed60af27fe42bb6823dc4d68bd729e73
+  metadata.gz: 72492311b32ca0b097c13fdec2e254d43006191dfeaa4a6d2245640ac7cd0b97
+  data.tar.gz: 281c7e93c835fb9c8bab29d29f0fc9efdb066c44457327ddd4be5eb71592cf63
 SHA512:
-  metadata.gz: d307d02eb5b143fd26c31cb9711d71e4d8f4668589c830334bc90158615b41138b151f1c125ce2ee8b0c5f05198c24befdcb0478cb176fd74f2935ae407cc010
-  data.tar.gz: 771e399e44037c9a5637d82b16f9cb0ba3d23d42ea699dfcfc70deef533e9873aeec3f3a2cf64df9727917e9164b99615e0da99c8ca8840548f0b49645484055
+  metadata.gz: 0ecc16539d70ec002cb69f6aa1dde824e52ad6e51ec2ba2ea76ff0e9cc54de1aa714098f3ac301784489db932d3390cd93e158f6c5f38898592877a3350f1c55
+  data.tar.gz: 8d73cd54cec9435e1db2b3d7ac7583430d3fe450c83856dccf67fef018d91fcb162516f60cb15071f462855918d86c28c6d891d26e8ef46f564107908d46655b

data/CHANGELOG.md

@@ -1,5 +1,27 @@
-## [Unreleased]
+## [1.1.1] - 2026-04-10
 
-## [0.1.0] - 2026-01-13
+### Bug Fixes
+
+- Fix controller class discovery in `M365ActiveStorage::Files` so only controllers from the active gem installation are loaded, avoiding invalid constantization and inconsistent behavior when multiple gem copies or versions are present on the load path.
+- Fix credential-gated test skipping in `test_helper.rb` to avoid constant lookup errors by comparing class names instead of class constants, making skip behavior stable regardless of test load order.
+- Fix SharePoint path encoding to produce valid Graph URLs by encoding spaces as `%20` (not `+`), ensuring file and folder paths with spaces are resolved correctly.
+- Fix SharePoint ID not being persisted when blob is created with custom metadata (e.g., `sharepoint_folder`). ID persistence is now deferred to an `after_commit` hook to prevent being overwritten by Active Storage's blob save.
+
+### Security
+
+- Add explicit CSRF protection (`protect_from_forgery`) to `M365ActiveStorage::BlobsController` to address Brakeman security warning and enforce forgery protection posture.
+
+## [1.1.0] - 2026-03-25
+
+### Features
+
+- Add support for organizing files in nested SharePoint folders via `sharepoint_folder` metadata on blob attachments.
+- Allow configurable storage key to use either blob key or filename for file storage organization in SharePoint.
+
+### Security
+
+- Patch Stored XSS vulnerability in `action_text-trix` dependency.
+
+## [1.0.0] - 2026-03-16
 
 - Initial release

data/lib/active_storage/service/sharepoint_service.rb

@@ -129,6 +129,8 @@ module ActiveStorage
     #
     # Uploads file content to the configured SharePoint drive.
     # The file is stored with the blob's filename for better organization in SharePoint.
+    # The SharePoint item ID is persisted asynchronously in an after_commit hook
+    # to avoid being overwritten by Active Storage's blob.save.
     #
     # @param [String] key The Active Storage blob key (ignored, filename used instead)
     # @param [IO] io The file content as an IO object
@@ -150,7 +152,10 @@ module ActiveStorage
       storage_path = build_storage_path(get_storage_name(key), folder_path)
       upload_url = "#{drive_url}/root:/#{encode_storage_path(storage_path)}:/content"
       response = http.put(upload_url, io.read, { "Content-Type": "application/octet-stream" })
-      handle_upload_response(key, response)
+      raise "Failed to upload file to SharePoint" unless [201, 200].include?(response.code.to_i)
+
+      # Store response body payload in thread-local storage for later retrieval in after_commit hook
+      Thread.current[:sharepoint_upload_response] = response
     end
 
     # Download a file from SharePoint
@@ -355,38 +360,27 @@ module ActiveStorage
       "#{config.ms_graph_endpoint}/sites/#{config.site_id}/drives/#{config.drive_id}"
     end
 
-    # Handle the response from an upload request
-    #
-    # Validates that the upload succeeded (201 Created or 200 OK).
-    # Raises an error for any other status code.
-    #
-    # @param [String] key The Active Storage blob key associated with the upload
-    # @param [Net::HTTPResponse] response The HTTP response from the upload
-    # @return [void]
-    #
-    # @raise [StandardError] if upload failed
-    def handle_upload_response(key, response)
-      if [201, 200].include?(response.code.to_i)
-        persist_sharepoint_id(key, response)
-        return
-      end
 
-      raise "Failed to upload file to SharePoint"
-    end
 
-    # Persist the SharePoint item id in blob metadata after successful upload.
+    # Persist the SharePoint item id in blob metadata from a stored upload response.
+    #
+    # This is called by the Railtie's after_commit hook to store the SharePoint ID
+    # after the blob has been fully saved to the database, preventing the ID from
+    # being overwritten by Active Storage's metadata save.
     #
     # Stored keys:
     # * metadata["sharepoint_id"] - convenience flat key for quick access
     # * metadata["sharepoint"]["id"] - namespaced SharePoint metadata
     #
     # @param [String] key The Active Storage blob key
-    # @param [Net::HTTPResponse] response The successful upload response body
+    # @param [Net::HTTPResponse, String] response The upload response or JSON payload string
     # @return [void]
-    def persist_sharepoint_id(key, response)
-      return if response.body.to_s.strip.empty?
 
-      payload = JSON.parse(response.body)
+    def persist_sharepoint_id_from_response(key, response)
+      body = response.is_a?(String) ? response : response.body.to_s
+      return if body.to_s.strip.empty?
+
+      payload = JSON.parse(body)
       sharepoint_id = payload["id"]
       return if sharepoint_id.to_s.empty?
 
@@ -525,11 +519,12 @@ module ActiveStorage
     #
     # Each path segment is CGI-encoded individually so that "/" separators
     # are preserved and not encoded as "%2F".
+    # Spaces are encoded as "%20" (not "+") to ensure proper URL path handling.
     #
     # @param [String] path The path to encode (e.g. "my folder/sub folder/file.pdf")
-    # @return [String] URL-safe encoded path (e.g. "my+folder/sub+folder/file.pdf")
+    # @return [String] URL-safe encoded path (e.g. "my%20folder/sub%20folder/file.pdf")
     def encode_storage_path(path)
-      path.split("/").map { |s| CGI.escape(s) }.join("/")
+      path.split("/").map { |s| CGI.escape(s).gsub("+", "%20") }.join("/")
     end
 
     # Ensure the full folder hierarchy exists in SharePoint.

data/lib/m365_active_storage/controllers/blobs_controller.rb

@@ -43,6 +43,8 @@ module M365ActiveStorage
   # @see ActiveStorage::Blob
   # @see ActiveStorage::Service::SharepointService
   class BlobsController < ActionController::Base
+    protect_from_forgery with: :exception
+
     # Display/download a blob
     #
     # Retrieves a blob by its signed ID and sends it to the client with appropriate

data/lib/m365_active_storage/files.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "pathname"
+
 module M365ActiveStorage
   # == File Discovery and Loading
   #
@@ -52,8 +54,17 @@ module M365ActiveStorage
     # @see #controller_files
     def self.controller_classes
       controller_files.map do |path|
-        path.remove("#{root}/lib/").remove("controllers/").remove(".rb").camelize.constantize
-      end
+        # Extract the relative path from the gem root, then convert to class name
+        root_path = Pathname.new("#{root}/lib")
+        file_path = Pathname.new(path)
+        
+        # Skip files that are not within the gem's lib directory (e.g., from other gem installations)
+        next nil if file_path.relative_path_from(root_path).to_s.start_with?("..")
+        
+        relative_path = file_path.relative_path_from(root_path).to_s
+        class_name = relative_path.remove("controllers/").remove(".rb").camelize.constantize
+        class_name
+      end.compact
     end
   end
 end

data/lib/m365_active_storage/railtie.rb

@@ -42,8 +42,10 @@ module M365ActiveStorage
     # Hook into Rails initialization to set up gem components
     config.after_initialize do
       # Add before_destroy callback to ActiveStorage::Blob to capture deletion identifiers
+      # Add after_commit callback to persist SharePoint ID after blob is fully saved
       ::ActiveStorage::Blob.class_eval do
         before_destroy :store_filename_for_deletion, if: proc { |blob| blob.service.is_a?(::ActiveStorage::Service::SharepointService) }
+        after_commit :persist_sharepoint_id_from_thread_storage, on: [:create], if: proc { |blob| blob.service.is_a?(::ActiveStorage::Service::SharepointService) }
 
         private
 
@@ -66,6 +68,22 @@ module M365ActiveStorage
           }
           M365ActiveStorage::PendingDelete.store(key, pending_delete_data)
         end
+
+        # Persist the SharePoint ID from the upload response after blob is saved
+        #
+        # This callback fires after the blob has been successfully committed to the database
+        # via the after_commit hook. It retrieves the upload response stored in thread-local
+        # storage by the service.upload method and persists the SharePoint ID to avoid
+        # being overwritten by Active Storage's blob.save.
+        #
+        # @return [void]
+        def persist_sharepoint_id_from_thread_storage
+          upload_response = Thread.current[:sharepoint_upload_response]
+          return unless upload_response.present?
+
+          Thread.current[:sharepoint_upload_response] = nil # Clean up thread storage
+          service.send(:persist_sharepoint_id_from_response, key, upload_response)
+        end
       end
     end
   end

data/lib/m365_active_storage/version.rb

@@ -2,5 +2,5 @@
 
 module M365ActiveStorage
   # The version of the m365_active_storage gem
-  VERSION = "1.1.0"
+  VERSION = "1.1.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: m365_active_storage
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Óscar León
@@ -51,7 +51,7 @@ metadata:
   allowed_push_host: https://rubygems.org
   homepage_uri: https://github.com/oei-int/m365-active-storage
   source_code_uri: https://github.com/oei-int/m365-active-storage
-  changelog_uri: https://github.com/oei-int/m365-active-storage/CHANGELOG.md
+  changelog_uri: https://github.com/oei-int/m365-active-storage/blob/main/CHANGELOG.md
   documentation_uri: https://rubydoc.info/gems/m365_active_storage
   bug_tracker_uri: https://github.com/oei-int/m365-active-storage/issues
 rdoc_options: