mbeditor 0.12.1 → 0.12.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b6645751ebceaf2b9754d5aabb417549334518db35027e1bd6c08d9fede2d7a5
-  data.tar.gz: edb2a8a2696f5aac16fcdcd4bbbf728f5d05a7af14ffca326a59ec7c0d40b860
+  metadata.gz: 88d963e43c97cf6974b3e38c079ffd2dba642dc1c13a68237f1a3a4f7c21e9a0
+  data.tar.gz: 9e32a366d6ea7ce5014fff94ee89adba7f6909d09aa29f6404142b4155688a3a
 SHA512:
-  metadata.gz: 5f9d7559b69d80a1d8d9d094d5513a69048ce62ea385630ca59811e0dafd50ca65afa988e1f560cc32d78fc7b71dceedb78b30f1ba190e00b465d1026e3554d5
-  data.tar.gz: a8a3de31439ff3a937db30a04dbfd631694f50ccbcce4c3fb3571dfa66cd798cf8df29b45855467a9ff783a919893829472b241523d7230468944a3accad04f9
+  metadata.gz: 100805339d3956837f0ec5349de86b5bcf4315ef5dd261e76b80c0acb589cd9036264b70bb65677be3d27be9575007daee02e08c1cbad86ac3136bd331312a6b
+  data.tar.gz: d1d0681c8962251ceb0d9f18db0937e20f3c1ae1e2d30754a08a88ee10a47b6a6492641de84b9e83c0b2ab81963e79d1f3d86bb61a985bfa7b4a5eb579d0548d

data/CHANGELOG.md

@@ -7,6 +7,83 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.12.3] - 2026-08-03
+
+### Added
+- **`config.cable_authenticate_with`** — authentication for the collaboration
+  WebSocket, falling back to `authenticate_with` when unset.
+- **A "Pairing off" chip and diagnostics panel.** When collaboration cannot
+  work, the editor now says so and lists every condition it depends on — the
+  vendored libraries, Action Cable's JavaScript, whether the server advertises
+  it, whether the socket actually connected, and whether anyone else is here —
+  with the fix written beside each failure. Nothing is shown when everything is
+  healthy and you are simply alone.
+
+### Fixed
+- **A WebSocket subscribe runs no controller, and this made pairing silently
+  impossible for most authenticated apps.** `authenticate_with` is evaluated on
+  the cable against a probe exposing `session`, `cookies`, `request` and
+  `params` — so a hook reading `Current.user`, calling `UserSession.find`, or
+  using a memoised `current_user` gets `nil` or a `NameError`, denies, and the
+  socket is rejected. The hook keeps working perfectly over HTTP, so nothing
+  looks wrong; collaboration simply never connects.
+
+  Rejections are now logged as `[mbeditor] WebSocket subscription rejected: …`
+  naming the cause, `cable_authenticate_with` provides an escape hatch when one
+  proc cannot serve both contexts, and the README says this plainly instead of
+  noting that request-scoped state "may be narrower". The README's own example
+  used `UserSession.find`, which is exactly the pattern that cannot work.
+
+## [0.12.2] - 2026-08-03
+
+### Added
+- **Inline route hints in controllers.** Every action in a controller file is
+  annotated with the verb and path that reach it — `GET /orders/:id` beside
+  `def show` — and a public action nothing routes to is flagged `no route`.
+  Hovering adds the named-route helper. Answering "is this actually reachable?"
+  previously meant reading `config/routes.rb` and expanding `resources` in your
+  head.
+
+  Routes come from the host app's own route set rather than by parsing
+  `config/routes.rb`. mbeditor runs inside the app, so the routes are already
+  built — and they are the only source that accounts for `resources` expansion,
+  `member`/`collection` blocks, scopes, constraints and mounted engines.
+
+- **`config.model_graph_max_models`** (default 1000, was a hard-coded 300).
+  A schema over the cap silently lost models and only said "(truncated)".
+
+### Changed
+- **Model boxes are sized to their contents** rather than all being one width,
+  so a long model or column name is no longer truncated while a model called
+  `Tag` wastes most of its box. Layer positions accumulate per layer, since a
+  fixed stride would let a wide box overlap the next layer.
+- **Cluster blocks are packed in two dimensions** instead of stacked in a single
+  column, which left a schema with one big core and several small islands
+  running off the bottom with the right-hand side empty.
+- **The dummy app now carries a real ActiveRecord schema** — 20 models and 44
+  associations covering a hub, a chain, a self-reference, a join table, a
+  polymorphic association and unconnected islands — so the model graph can be
+  demonstrated and tested against something representative.
+
+### Fixed
+- **mbeditor could stop a host app from booting.** The pending-migrations
+  middleware was installed whenever `ActiveRecord::Migration::CheckPending` was
+  defined, but Rails only puts that middleware in the stack when
+  `config.active_record.migration_error` is `:page_load`. Any app loading
+  ActiveRecord with a different setting raised "No such middleware to insert
+  before" during boot. It now tests the same condition Rails does.
+- **Long labels drew straight out past the edge of their model box.** SVG text
+  neither wraps nor ellipsises; labels are now measured against the font the
+  theme actually resolves and cut to fit.
+- **"no database connection" hung below the box it belonged to** — the box
+  height did not count that placeholder line.
+- **The model search is a real dropdown.** The native `<datalist>` rendered in
+  the browser's own chrome: unstyleable, and unable to show the table name and
+  column count beside each model. Arrow keys and Enter work as before.
+- **The titlebar wrapped to two lines in a narrow window**, pushing the toolbar
+  out of its 32px row. It no longer wraps, and below the width where the toolbar
+  drops its button labels the title gives way to the icon alone.
+
 ## [0.12.1] - 2026-08-03
 
 ### Added

data/README.md

@@ -67,8 +67,12 @@ Mbeditor.configure do |config|
   config.excluded_paths = %w[.git tmp log node_modules .bundle coverage vendor/bundle]
   config.rubocop_command = "bundle exec rubocop"
 
-  # Optional authentication (runs as a before_action in the engine controllers)
-  # config.authenticate_with = proc { redirect_to login_path unless UserSession.find }
+  # Optional authentication (runs as a before_action in the engine controllers,
+  # and on the collaboration WebSocket subscribe). Resolve the user from
+  # `session` — a WebSocket subscribe runs no controller, so Current.user,
+  # UserSession.find and a memoised current_user are all unavailable there.
+  # config.authenticate_with = proc { redirect_to login_path unless User.find_by(id: session[:user_id]) }
+  # config.cable_authenticate_with = proc { ... }  # when one proc cannot serve both
 
   # Optional test runner (Minitest or RSpec)
   # config.test_framework = :minitest   # :minitest or :rspec — auto-detected when nil
@@ -123,6 +127,7 @@ end
 | Option | Default | Description |
 |--------|---------|-------------|
 | `authenticate_with` | `nil` | Proc run as a `before_action` in all engine controllers. Executed via `instance_exec` inside the controller, so it has access to `session`, `cookies`, `redirect_to`, and auth-library class methods (e.g. Authlogic's `UserSession.find`) — but not helper methods from the host's `ApplicationController`. The same hook is also evaluated when the collaboration / editor **WebSocket** subscribes (see [Collaborative pairing](#collaborative-pairing-optional)); if it halts or raises, that subscription is rejected (fail-closed). Over the cable the proc runs against a request-derived probe, so request-scoped state may be narrower than over HTTP. |
+| `cable_authenticate_with` | `nil` | Authentication for the collaboration WebSocket; `nil` falls back to `authenticate_with`. Set this when the HTTP hook cannot work on the cable — a WebSocket subscribe runs no controller, so `Current.*`, an Authlogic `UserSession` and a memoised `current_user` are `nil` or raise, and the hook then denies the socket while working perfectly over HTTP. See [Collaborative pairing](#collaborative-pairing-optional). |
 | `authentication_cache_ttl` | `0` | Seconds to cache the auth result in the session (`0` = no caching). Set e.g. `300` to avoid calling `authenticate_with` on every request when the proc is expensive. Trade-off: after host logout, mbeditor stays accessible for up to TTL seconds. |
 
 ### Test runner
@@ -335,20 +340,45 @@ should be able to reach the port.
 
 **2. Set an authentication hook — it runs on the WebSocket handshake.**
 Configure `authenticate_with` (see the [Authentication](#authentication) options).
-The same hook that gates the HTTP editor is now also evaluated when the collaboration /
+The same hook that gates the HTTP editor is also evaluated when the collaboration /
 editor WebSocket subscribes: if it halts (e.g. `redirect_to`/`render`/`head`) — or raises —
 the socket subscription is **rejected (fail-closed)**, so pairing cannot bypass your auth.
 
+> **A WebSocket subscribe runs no controller.** This is the single most common reason
+> pairing appears to do nothing. Anything a `before_action` populates is unavailable on
+> the cable: `Current.user` (and any other `ActiveSupport::CurrentAttributes`) is `nil`,
+> `UserSession.find` raises because Authlogic's controller adapter was never activated,
+> and a memoised `current_user` is undefined. The hook then denies — correctly, given it
+> was handed nobody — and the socket is rejected. It works perfectly over HTTP the whole
+> time, so nothing looks wrong until you notice collaboration never connects.
+
+The hook is evaluated against a probe exposing `session`, `cookies`, `request`, `params`
+and the halt methods. Resolve the user from `session` so the same hook works in both
+contexts:
+
+```ruby
+Mbeditor.configure do |c|
+  c.authenticate_with = proc do
+    user = Current.user || User.find_by(id: session[:user_credentials_id])
+    head :forbidden unless user&.super_admin_access?
+  end
+end
+```
+
+When one proc genuinely cannot serve both, give the cable its own:
+
 ```ruby
 Mbeditor.configure do |c|
-  # Runs as a controller before_action AND on the cable subscribe.
-  c.authenticate_with = proc { head :forbidden unless UserSession.find }
+  c.authenticate_with       = proc { head :forbidden unless Current.user&.super_admin_access? }
+  c.cable_authenticate_with = proc do
+    head :forbidden unless User.find_by(id: session[:user_credentials_id])&.super_admin_access?
+  end
 end
 ```
 
-Because the cable mount can bypass parts of the host middleware stack, a hook that leans on
-request-scoped state (full `session`, encrypted `cookies`) may see less over the WebSocket
-than it does over HTTP. For defence in depth, also authenticate at your host app's
+Every rejection is logged as `[mbeditor] WebSocket subscription rejected: …` with the
+reason, so a denial is visible rather than silent. The editor also shows a **Pairing off**
+chip when collaboration cannot work, listing each failing condition. For defence in depth, also authenticate at your host app's
 `ApplicationCable::Connection` (the standard `identified_by` / `reject_unauthorized_connection`
 pattern) — mbeditor's hook is an additional gate, not a replacement for securing the cable
 connection itself.

data/app/assets/javascripts/mbeditor/collaboration_service.js

@@ -120,6 +120,67 @@ var CollaborationService = (function () {
     });
   }
 
+  // Every condition collaboration depends on, reported separately.
+  //
+  // isAvailable() collapses five things into one boolean, which is useless when
+  // pairing does not work: "false" could be a missing vendored library, a cable
+  // the server never advertised, a rejected handshake, or simply nobody else
+  // being here. Someone debugging this on another machine cannot paste a console
+  // snippet back, so the editor has to be able to say which.
+  function diagnostics() {
+    var cableStatus = (typeof WebSocketService !== 'undefined' &&
+                       typeof WebSocketService.cableStatus === 'function')
+      ? WebSocketService.cableStatus() : 'unknown';
+
+    var checks = [
+      {
+        key: 'libraries',
+        label: 'Collaboration libraries loaded',
+        ok: typeof window.Y !== 'undefined' && typeof window.MonacoBinding !== 'undefined',
+        detail: 'vendor/assets/javascripts/yjs-collab.js is served by the asset pipeline. ' +
+                'If this fails, the host app is not serving it — try rails assets:clobber, ' +
+                'or check config.assets.precompile.'
+      },
+      {
+        key: 'actioncable',
+        label: 'Action Cable JavaScript present',
+        ok: typeof window.ActionCable !== 'undefined',
+        detail: 'The host app must make actioncable.js available to the page.'
+      },
+      {
+        key: 'advertised',
+        label: 'Server advertises Action Cable',
+        ok: typeof WebSocketService !== 'undefined' && WebSocketService.isCableAvailable(),
+        detail: 'Action Cable must be enabled and mounted in the host app routes.'
+      },
+      {
+        key: 'connected',
+        label: 'WebSocket connected',
+        ok: cableStatus === 'connected',
+        detail: cableStatus === 'rejected'
+          ? 'The server rejected the subscription. Usually action_cable.allowed_request_origins ' +
+            'not listing the origin you are reaching the editor through, or an authenticate_with ' +
+            'hook halting on the cable (it fails closed). Look for "Request origin not allowed" in the log.'
+          : 'Status: ' + cableStatus + '.'
+      },
+      {
+        key: 'peers',
+        label: 'Another participant connected',
+        ok: _peerPresent,
+        detail: 'Presence is held per web process. If two people are on different Puma workers ' +
+                'they never see each other — run a single worker (WEB_CONCURRENCY=0) while pairing.'
+      }
+    ];
+
+    return {
+      ok: checks.every(function (c) { return c.ok; }),
+      cableStatus: cableStatus,
+      checks: checks,
+      // The first failing check is the one worth acting on; the rest follow from it.
+      firstProblem: checks.filter(function (c) { return !c.ok; })[0] || null
+    };
+  }
+
   // Subscribe to availability transitions. Returns an unsubscribe function.
   function onAvailabilityChange(fn) {
     _availabilityListeners.push(fn);
@@ -674,6 +735,7 @@ var CollaborationService = (function () {
   return {
     isAvailable: isAvailable,
     setPeerPresent: setPeerPresent,
+    diagnostics: diagnostics,
     onAvailabilityChange: onAvailabilityChange,
     isEnabledFor: isEnabledFor,
     ensureRoom: ensureRoom,

data/app/assets/javascripts/mbeditor/components/EditorPanel.js

@@ -90,6 +90,7 @@ var EditorPanel = function EditorPanel(_ref) {
 
   var blameDecorationsRef = useRef([]);
   var gitLineDecorationsRef = useRef([]);
+  var routeDecorationsRef = useRef([]);
   // Latest git line-diff refresh, read by the poll effect so its interval does
   // not have to be torn down whenever the active tab changes.
   var gitLineRefreshRef = useRef(null);
@@ -1530,6 +1531,83 @@ var EditorPanel = function EditorPanel(_ref) {
     }
   }, [isBlameVisible, tab.path, blameData, isBlameLoading]);
 
+  // Inline route hints for controllers.
+  //
+  // Every `def` in a controller gets the verb and path that reach it drawn after
+  // the line, and a public action nothing routes to is called out — the question
+  // "is this actually reachable?" otherwise means reading config/routes.rb and
+  // mentally expanding `resources`. Routes come from the host app's own route
+  // set, which is the only thing that knows how those expand.
+  //
+  // Decorations, not view zones: a hint belongs on the line, and a zone would
+  // push the code around every time a file was opened.
+  useEffect(function () {
+    var editor = monacoRef.current;
+    if (!editor || !window.monaco) return;
+
+    var clear = function () {
+      if (!routeDecorationsRef.current.length) return;
+      routeDecorationsRef.current = editor.deltaDecorations(routeDecorationsRef.current, []);
+    };
+
+    if (!tab.path || !/^app\/controllers\/.+_controller\.rb$/.test(tab.path)) {
+      clear();
+      return;
+    }
+
+    var cancelled = false;
+    FileService.getRoutes(tab.path).then(function (data) {
+      if (cancelled) return;
+      var actions = (data && data.actions) || {};
+      var model = editor.getModel();
+      if (!model) return;
+
+      var decorations = [];
+      var text = model.getValue().split('\n');
+      // Only methods above the first `private`/`protected` are candidates for a
+      // route; flagging a helper below it as unrouted would be noise.
+      var visibilityEnded = false;
+
+      text.forEach(function (line, i) {
+        if (/^\s*(private|protected)\s*$/.test(line)) { visibilityEnded = true; return; }
+        var m = line.match(/^\s*def\s+(?:self\.)?([a-zA-Z_][a-zA-Z0-9_]*[?!=]?)/);
+        if (!m) return;
+
+        var name = m[1];
+        var routes = actions[name];
+        var lineNo = i + 1;
+        var col = line.length + 1;
+
+        if (routes && routes.length) {
+          var label = routes.map(function (r) { return r.verb + ' ' + r.path; }).join('  ·  ');
+          decorations.push({
+            range: new window.monaco.Range(lineNo, col, lineNo, col),
+            options: {
+              after: { content: '  ' + label, inlineClassName: 'mbeditor-route-hint' },
+              hoverMessage: routes.map(function (r) {
+                return { value: '`' + r.verb + ' ' + r.path + '`' + (r.name ? ' — `' + r.name + '_path`' : '') };
+              }),
+              showIfCollapsed: true
+            }
+          });
+        } else if (!visibilityEnded && !/[?!=]$/.test(name) && name !== 'initialize') {
+          decorations.push({
+            range: new window.monaco.Range(lineNo, col, lineNo, col),
+            options: {
+              after: { content: '  no route', inlineClassName: 'mbeditor-route-hint-none' },
+              hoverMessage: [{ value: 'No route in this application dispatches to this action.' }],
+              showIfCollapsed: true
+            }
+          });
+        }
+      });
+
+      routeDecorationsRef.current = editor.deltaDecorations(routeDecorationsRef.current, decorations);
+    }).catch(function () { /* hints are additive; a failure just means none */ });
+
+    return function () { cancelled = true; clear(); };
+  }, [tab.path, tab.externalContentVersion, monacoReady]);
+
   // Render Blame block headers (author + summary) above contiguous commit regions.
   useEffect(function () {
     if (!monacoRef.current || !window.monaco || !isBlameVisible || !blameData) return;

data/app/assets/javascripts/mbeditor/components/MbeditorApp.js

@@ -2450,6 +2450,30 @@ var MbeditorApp = function MbeditorApp() {
   // external-change detection for solo users. The service is told about the roster
   // from the presence handler above, not from an effect here, so it hears about
   // every message rather than only about a change in the participant count.
+  var _collabDiag = useState(false);
+  var collabDiagOpen = _collabDiag[0], setCollabDiagOpen = _collabDiag[1];
+  var _collabTrouble = useState(null);
+  var collabTrouble = _collabTrouble[0], setCollabTrouble = _collabTrouble[1];
+
+  // Re-checked on a slow interval because the failures worth reporting — a
+  // rejected handshake, a dropped socket — happen asynchronously and nothing
+  // else would notice. Only the first failing check's key is stored, so an
+  // unchanged state is an identical string and React bails rather than
+  // re-rendering the app every tick.
+  useEffect(function () {
+    function check() {
+      if (typeof CollaborationService === 'undefined' ||
+          typeof CollaborationService.diagnostics !== 'function') return;
+      var d = CollaborationService.diagnostics();
+      // "Nobody else is here" is not a fault; everything else is.
+      var problem = d.firstProblem && d.firstProblem.key !== 'peers' ? d.firstProblem.key : null;
+      setCollabTrouble(function (prev) { return prev === problem ? prev : problem; });
+    }
+    check();
+    var id = setInterval(check, 10000);
+    return function () { clearInterval(id); };
+  }, []);
+
   var collabPeerIds = Object.keys(collabRoster);
 
   // A labelled peer chip costs ~110px (name + filename), and the titlebar button
@@ -4217,6 +4241,28 @@ var MbeditorApp = function MbeditorApp() {
             !toolbarIconOnly && " Git"
           )
         ),
+        // Collaboration trouble chip. Deliberately not shown when everything is
+        // healthy and you are simply alone — that was the whole point of hiding
+        // the solo chip. It appears only when a condition pairing needs has
+        // actually failed, so silence means "nobody here" and never "quietly
+        // broken", which is exactly the ambiguity that made a real pairing
+        // failure impossible to diagnose from the other machine.
+        collabTrouble && React.createElement(
+          React.Fragment,
+          null,
+          React.createElement("div", { className: "statusbar-sep" }),
+          React.createElement(
+            "button",
+            {
+              type: "button",
+              className: "statusbar-btn mbeditor-collab-trouble",
+              title: "Pairing is not available — click for details",
+              onClick: function () { setCollabDiagOpen(true); }
+            },
+            React.createElement("i", { className: "fas fa-user-slash" }),
+            !toolbarIconOnly && " Pairing off"
+          )
+        ),
         // Your own chip appears only once someone else is actually connected.
         // Alone it told you nothing — Action Cable is up in any normal dev setup,
         // so it sat in the toolbar permanently announcing a session of one. While
@@ -4358,6 +4404,49 @@ var MbeditorApp = function MbeditorApp() {
         )
       );
     })(),
+    // The diagnostics panel. Every condition listed with its own state, because
+    // the person who needs this is usually on the other machine and cannot paste
+    // a console snippet back.
+    collabDiagOpen && (function () {
+      var d = CollaborationService.diagnostics();
+      return React.createElement(
+        'div',
+        { className: 'mbeditor-modal-backdrop', onClick: function () { setCollabDiagOpen(false); } },
+        React.createElement(
+          'div',
+          { className: 'mbeditor-collab-diag', onClick: function (e) { e.stopPropagation(); } },
+          React.createElement('div', { className: 'mbeditor-collab-diag-title' }, 'Pair programming status'),
+          React.createElement(
+            'ul',
+            { className: 'mbeditor-collab-diag-list' },
+            d.checks.map(function (c) {
+              return React.createElement(
+                'li',
+                { key: c.key, className: 'mbeditor-collab-diag-row' + (c.ok ? '' : ' is-bad') },
+                React.createElement('i', { className: c.ok ? 'fas fa-check' : 'fas fa-times' }),
+                React.createElement(
+                  'div',
+                  null,
+                  React.createElement('div', { className: 'mbeditor-collab-diag-label' }, c.label),
+                  !c.ok && React.createElement('div', { className: 'mbeditor-collab-diag-detail' }, c.detail)
+                )
+              );
+            })
+          ),
+          React.createElement(
+            'div',
+            { className: 'mbeditor-collab-diag-foot' },
+            d.ok
+              ? 'Pairing is working.'
+              : 'The first failing item above is the one to fix; the rest follow from it.'
+          ),
+          React.createElement('button', {
+            type: 'button', className: 'ide-model-graph-btn',
+            onClick: function () { setCollabDiagOpen(false); }
+          }, 'Close')
+        )
+      );
+    })(),
     showHelp && React.createElement(ShortcutHelp, { onClose: function () { return setShowHelp(false); } }),
     React.createElement(
       "div",