nondisposable 0.2.1 → 0.3.0

data/lib/generators/nondisposable/install_generator.rb

@@ -29,8 +29,8 @@ module Nondisposable
       def display_post_install_message
         say "\tThe `nondisposable` gem has been successfully installed!", :green
         say "\nTo complete the setup:"
-        say "  1. Run 'rails db:migrate' to create the necessary tables."
-        say "  2. Run 'Nondisposable::DomainListUpdater.update' to populate the initial list of disposable domains."
+        say "  1. Run 'rails db:migrate' to create the necessary tables (this also seeds an initial list of disposable domains bundled with the gem)."
+        say "  2. Run 'Nondisposable::DomainListUpdater.update' to fetch the latest list of disposable domains."
         say "  3. Add 'validates :email, nondisposable: true' to your User model (or any model with an email field)."
         say "  4. Configure your recurrent job according to the README, and make sure you have a functional queuing system (like solid_queue) that can run jobs properly so the disposable emails list is updated regularly."
         say "\nEnjoy your new `nondisposable` users!", :green

data/lib/generators/nondisposable/templates/create_nondisposable_disposable_domains.rb.erb

@@ -7,6 +7,15 @@ class CreateNondisposableDisposableDomains < ActiveRecord::Migration<%= migratio
 
       t.timestamps
     end
+
+    reversible do |dir|
+      dir.up do
+        # Seed from the blocklist snapshot bundled with the gem so the app is
+        # protected immediately, before the first remote update runs.
+        # Guarded so this migration still runs if the gem is ever removed.
+        Nondisposable::DomainListUpdater.seed if defined?(Nondisposable::DomainListUpdater)
+      end
+    end
   end
 
   private

data/lib/generators/nondisposable/templates/nondisposable.rb

@@ -7,4 +7,13 @@ Nondisposable.configure do |config|
   #
   # Exclude domains that are considered disposable but you want to allow anyways
   # config.excluded_domains = ['false-positive-domain.com']
+  #
+  # What to do when the disposable check itself fails (e.g. database hiccup):
+  #   :allow  - let the signup through and log an error (availability-first, default)
+  #   :reject - block the signup with a validation error (fail closed)
+  # config.on_check_failure = :allow
+  #
+  # Also match parent domains: an email at x.tempmail.com is blocked when
+  # tempmail.com is on the list (checks up to 3 parent labels). Default: true
+  # config.check_parent_domains = true
 end

data/lib/nondisposable/domain_list_updater.rb

@@ -1,19 +1,27 @@
 # frozen_string_literal: true
 
-require 'open-uri'
 require 'net/http'
+require 'uri'
 
 module Nondisposable
   class DomainListUpdater
 
+    LIST_URL = 'https://raw.githubusercontent.com/disposable-email-domains/disposable-email-domains/master/disposable_email_blocklist.conf'
+
+    # Snapshot of the upstream blocklist vendored into the gem, used to seed
+    # fresh installs so they are protected before the first remote update.
+    BUNDLED_LIST_PATH = File.expand_path('../../data/disposable_email_blocklist.conf', __dir__)
+
+    # Network timeouts (seconds). Without these, a hung connection would block
+    # the calling job/thread indefinitely (Net::HTTP defaults to 60s open / 60s read).
+    OPEN_TIMEOUT = 10
+    READ_TIMEOUT = 10
+
     def self.update
       Rails.logger.info "[nondisposable] Refreshing list of disposable domains..."
 
-      url = 'https://raw.githubusercontent.com/disposable-email-domains/disposable-email-domains/master/disposable_email_blocklist.conf'
-
       begin
-        uri = URI(url)
-        response = Net::HTTP.get_response(uri)
+        response = fetch_list
 
         if response.is_a?(Net::HTTPSuccess)
           downloaded_domains = response.body.split("\n")
@@ -21,29 +29,98 @@ module Nondisposable
 
           Rails.logger.info "[nondisposable] Downloaded list of disposable domains..."
 
-          domains = (downloaded_domains + Nondisposable.configuration.additional_domains).uniq
-          domains -= Nondisposable.configuration.excluded_domains
-
-          ActiveRecord::Base.transaction do
-            Rails.logger.info "[nondisposable] Updating disposable domains..."
-            Nondisposable::DisposableDomain.delete_all
-
-            domains.each { |domain| Nondisposable::DisposableDomain.create(name: domain.downcase) }
-          end
-
-          Rails.logger.info "[nondisposable] Finished updating disposable domains. Total domains: #{domains.count}"
+          replace_domains(downloaded_domains)
           true
         else
           Rails.logger.error "[nondisposable] Failed to download the list. HTTP Status: #{response.code}"
+          seed
           false
         end
       rescue SocketError => e
         Rails.logger.error "[nondisposable] Network error occurred: #{e.message}"
+        seed
         false
       rescue StandardError => e
         Rails.logger.error "[nondisposable] An error occurred when trying to update the list of disposable domains: #{e.message}"
+        seed
         false
       end
     end
+
+    # Seeds the domain table from the blocklist snapshot bundled with the gem,
+    # but ONLY when the table is empty. This closes the fresh-install fail-open
+    # window where every email passed validation until the first successful
+    # remote update. Returns true if it seeded, false otherwise.
+    #
+    # The bundled list is a snapshot from the gem's release date — always run
+    # DomainListUpdater.update (e.g. via the provided job) to stay current.
+    def self.seed
+      return false unless Nondisposable::DisposableDomain.none?
+
+      Rails.logger.info "[nondisposable] Domain table is empty; seeding from the blocklist bundled with the gem..."
+      count = replace_domains(bundled_domains)
+      Rails.logger.info "[nondisposable] Seeded #{count} disposable domains from the bundled snapshot. Run Nondisposable::DomainListUpdater.update to fetch the latest list."
+      true
+    rescue StandardError => e
+      Rails.logger.error "[nondisposable] Could not seed from the bundled list: #{e.message}"
+      false
+    end
+
+    def self.bundled_domains
+      File.readlines(BUNDLED_LIST_PATH, chomp: true)
+    end
+    private_class_method :bundled_domains
+
+    def self.fetch_list
+      uri = URI(LIST_URL)
+      Net::HTTP.start(
+        uri.host,
+        uri.port,
+        use_ssl: uri.scheme == 'https',
+        open_timeout: OPEN_TIMEOUT,
+        read_timeout: READ_TIMEOUT
+      ) do |http|
+        http.get(uri.request_uri)
+      end
+    end
+    private_class_method :fetch_list
+
+    # Atomically replaces the stored domain list with the given raw list,
+    # merged with `additional_domains` and minus `excluded_domains`.
+    # Reports (instead of silently swallowing) any rows the bulk insert skipped.
+    def self.replace_domains(raw_domains)
+      domains = normalize(raw_domains + Nondisposable.configuration.additional_domains)
+      domains -= normalize(Nondisposable.configuration.excluded_domains)
+
+      inserted_count = 0
+
+      ActiveRecord::Base.transaction do
+        Rails.logger.info "[nondisposable] Updating disposable domains..."
+        Nondisposable::DisposableDomain.delete_all
+
+        records = domains.map { |domain| { name: domain } }
+        Nondisposable::DisposableDomain.insert_all(records, record_timestamps: true) if records.any?
+        inserted_count = Nondisposable::DisposableDomain.count
+      end
+
+      skipped_count = domains.size - inserted_count
+      if skipped_count.positive?
+        skipped = domains - Nondisposable::DisposableDomain.where(name: domains).pluck(:name)
+        preview = skipped.take(20).join(', ')
+        preview += ", … (#{skipped.size - 20} more)" if skipped.size > 20
+        Rails.logger.warn "[nondisposable] Skipped #{skipped_count} row(s) during bulk insert (duplicate or conflicting values): #{preview}"
+      end
+
+      Rails.logger.info "[nondisposable] Finished updating disposable domains. Total domains: #{inserted_count}"
+      inserted_count
+    end
+    private_class_method :replace_domains
+
+    # Downcases, strips whitespace (including stray \r from CRLF payloads),
+    # drops blank lines, and dedupes.
+    def self.normalize(domains)
+      domains.map { |domain| domain.to_s.strip.downcase }.reject(&:empty?).uniq
+    end
+    private_class_method :normalize
   end
 end

data/lib/nondisposable/email_validator.rb

@@ -14,8 +14,12 @@ module ActiveModel
             record.errors.add(attribute, options[:message] || Nondisposable.configuration.error_message)
           end
         rescue StandardError => e
-          Rails.logger.error "[nondisposable] Nondisposable validation error: #{e.message}"
-          record.errors.add(attribute, "is an invalid email address, cannot check if it's disposable")
+          if Nondisposable.configuration.on_check_failure == :reject
+            Rails.logger.error "[nondisposable] Nondisposable validation error: #{e.message} — rejecting #{attribute} (on_check_failure = :reject)"
+            record.errors.add(attribute, "is an invalid email address, cannot check if it's disposable")
+          else
+            Rails.logger.error "[nondisposable] Nondisposable validation error: #{e.message} — ALLOWING #{attribute} through without a disposable check (on_check_failure = :allow). Set config.on_check_failure = :reject to fail closed instead."
+          end
         end
       end
     end

data/lib/nondisposable/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Nondisposable
-  VERSION = "0.2.1"
+  VERSION = "0.3.0"
 end

data/lib/nondisposable.rb

@@ -9,11 +9,17 @@ module Nondisposable
   class Error < StandardError; end
 
   class << self
-    attr_accessor :configuration
+    attr_writer :configuration
+
+    # Lazily initialized so the gem works safely even when the host app never
+    # runs an initializer (previously a nil configuration made every check
+    # raise, which the validator surfaced as a validation error on all emails).
+    def configuration
+      @configuration ||= Configuration.new
+    end
   end
 
   def self.configure
-    self.configuration ||= Configuration.new
     yield(configuration)
   end
 
@@ -25,12 +31,34 @@ module Nondisposable
   end
 
   class Configuration
+    ON_CHECK_FAILURE_MODES = [:allow, :reject].freeze
+
     attr_accessor :error_message, :additional_domains, :excluded_domains
+    # Whether to also match parent domains: with the default true, an email at
+    # x.tempmail.com is blocked when tempmail.com is on the list (checks up to
+    # DisposableDomain::PARENT_MATCH_DEPTH parent labels, never a bare TLD).
+    attr_accessor :check_parent_domains
+    attr_reader :on_check_failure
 
     def initialize
       @error_message = "provider is not allowed"
       @additional_domains = []
       @excluded_domains = []
+      @on_check_failure = :allow
+      @check_parent_domains = true
+    end
+
+    # What the validator does when the disposable check itself raises
+    # (e.g. the database is unavailable):
+    #   :allow  - let the record through and log an error (availability-first, default)
+    #   :reject - add a validation error, blocking the record (fail closed)
+    def on_check_failure=(mode)
+      mode = mode.to_sym if mode.respond_to?(:to_sym)
+      unless ON_CHECK_FAILURE_MODES.include?(mode)
+        raise ArgumentError, "on_check_failure must be one of #{ON_CHECK_FAILURE_MODES.map(&:inspect).join(', ')} (got #{mode.inspect})"
+      end
+
+      @on_check_failure = mode
     end
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: nondisposable
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - rameerez
 bindir: exe
 cert_chain: []
-date: 2026-01-17 00:00:00.000000000 Z
+date: 2026-08-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -41,6 +41,8 @@ files:
 - README.md
 - Rakefile
 - app/models/nondisposable/disposable_domain.rb
+- context7.json
+- data/disposable_email_blocklist.conf
 - gemfiles/rails_7.2.gemfile
 - gemfiles/rails_8.0.gemfile
 - gemfiles/rails_8.1.gemfile