openreceive-rails 0.3.3 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96a850e9b25d9797bff5f7b668b8e8bf26c891991058bf58ffd911c0abcdcbb4
-  data.tar.gz: 33d4e8872eb37baf2d77f0f47b5224dafa4851f056e43ff0c047f9b3e05ab647
+  metadata.gz: d96bcbf6cbe2379c285d8fc0f61b59438d75c27af55465be700f0c18ea498dcb
+  data.tar.gz: 6e97b4d45559953ffca5380313692559579e322df6700f4d165970bced786023
 SHA512:
-  metadata.gz: 2447535630f828c0185846df6f79b995ac0968c8a7a0e22ccf02104e3b9003333e3754476f65addb09823ae1678004639c8dfeb95e6f914f54c26fd610f575f0
-  data.tar.gz: c01e0905acbd634606783b0b6fe05eb16002238f7987cb92ac48c97da788f49a82b42242e82ca60d19624d359a6841583bf7a9caab73f2f8902c44f0a567a70d
+  metadata.gz: 79214e11c2cd614f5eaac640a65180468d06218775d74415db20f9a3064e097db16575816f8da8acafc2bdd1402fe69019485476db6a44cf7ab336b2a4faa4ff
+  data.tar.gz: 78e9da4d3da20415f49683c6866b4ef44892b8be1bba3ea637e27080fb0474d64b462871fbce8fb0c40eb8059519f5e2653ff617ef1d9b8e23a70094c76be721

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.4.1 - 2026-09-02
+
+Version lockstep with the 0.4.1 npm release. First version published from CI
+through RubyGems Trusted Publishing (`.github/workflows/publish-gems.yml`)
+instead of a maintainer's API key and OTP. No functional change in this gem.
+
+## 0.4.0 - 2026-09-02
+
+Version lockstep with the 0.4.0 npm release. The generated initializer's
+`config.authorize` comment now states the resource guarantee:
+`context[:resource][:reference]` is always a validated non-empty String
+(200 characters or fewer) by the time the lambda runs, and `payment_hash` is
+nil except on `payment.check`, `swap.read`, and `swap.refund`. No functional
+change.
+
 ## 0.3.3 - 2026-09-02
 
 ### A missing migration says so, with the fix

data/lib/generators/openreceive/install/templates/initializer.rb

@@ -18,7 +18,9 @@ OpenReceive.configure do |config|
   #                        cookies, or headers from it, as in a controller
   #   context[:resource] — { reference:, payment_hash: } copied from the
   #                        payer's JSON body. It names an order; it does not
-  #                        prove this caller owns it.
+  #                        prove this caller owns it. reference is always a
+  #                        validated non-empty String (≤200 chars); payment_hash
+  #                        is nil except on payment.check / swap.read / swap.refund.
   # Return true to allow the request, false for a 403.
   #
   # The default below is a NAMED PLACEHOLDER, and the engine warns at boot for

data/lib/openreceive/rails/version.rb

@@ -5,6 +5,6 @@ module OpenReceive
   # top-level `::Rails` framework constant — engine code always references the framework as
   # `::Rails` to avoid shadowing.
   module Rails
-    VERSION = "0.3.3"
+    VERSION = "0.4.1"
   end
 end

data/skills/debug-openreceive-payment/SKILL.md

@@ -40,6 +40,7 @@ same diagnostics redacted, always exit 0 — safe to share.
 | Status | Meaning | Where to look |
 | --- | --- | --- |
 | 403 FORBIDDEN | Your own `authorize` hook denied it, or the request looked cross-site. Check the session/cookie actually reaches the checkout routes. https://openreceive.org/guides/authorization.md |
+| Never 403s — any visitor can mint, poll, or refund for any reference | The opposite failure: on Rails the generated `config.authorize = OpenReceive::ALLOW_ALL_AUTHORIZE` placeholder is still installed (the engine warns at boot; `bin/rails openreceive:doctor` reports it). Replace it with the app's real ownership check. https://openreceive.org/guides/authorization.md |
 | 404 NOT_FOUND | `amountFor` returned `null` (unknown reference), or the `payment_hash` does not belong to that reference. |
 | 409 CONFLICT | **Normal state, not a bug**: the reference already settled, or an unpaid checkout for that method is already live. Show it as order state; never retry-loop. |
 | 503 retryable | The host hook failed while persisting the attempt (instructions withheld), or the wallet is unavailable. Read the server log for the underlying error. |

data/skills/integrate-openreceive/references/node.md

@@ -1,6 +1,6 @@
 # OpenReceive agent directions (Node.js)
 
-These directions describe OpenReceive 0.3.3.
+These directions describe OpenReceive 0.4.1.
 
 Add OpenReceive to a Node application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the packages are on npm, and the
@@ -374,6 +374,8 @@ const openreceive = openReceiveExpress({
       : null;
   },
   // Your own access check: may this caller do this action to this reference?
+  // `resource.reference` is your own order id, sent back by the payer's
+  // browser — a claim, not proof — already validated as a non-empty string.
   authorize: async ({ action, request, resource }) =>
     orders.viewerMay(
       await sessions.currentUser(request),
@@ -451,11 +453,13 @@ so a white card never lands on a dark page. The checkout is styled by CSS
 variables under `data-theme`; [Frontend checkout](https://openreceive.org/guides/frontend-checkout.md) has
 the knobs.
 
-Outside Vite/Rollup (esbuild, webpack, a plain script tag) the packaged
-payment-method icons cannot resolve their own URLs — the drop-in needs this
-exactly as a custom UI does. Serve the two packages' `dist/assets` trees and
-pass the base as `assetBaseUrl="/openreceive-assets"`
-([Provider registry](https://openreceive.org/guides/provider-registry.md#assets-are-files-your-host-serves)).
+The payment-method icons are compiled into `@openreceive/browser` and need
+nothing from your bundler. The wallet logos and pay tutorials are files in
+`@openreceive/provider-data`, and outside Vite/Rollup (esbuild, webpack, a
+plain script tag) they cannot resolve their own URLs — the drop-in needs this
+exactly as a custom UI does. Serve that package's `dist/assets` tree and pass
+the base as `assetBaseUrl="/openreceive-assets"`
+([Provider registry](https://openreceive.org/guides/provider-registry.md#assets)).
 
 That is the whole loop: your server owns the price and the order, the payer gets
 an invoice, and `onPaid` runs once inside the settlement transaction.

data/skills/integrate-openreceive/references/rails.md

@@ -1,6 +1,6 @@
 # OpenReceive agent directions (Rails)
 
-These directions describe OpenReceive 0.3.3.
+These directions describe OpenReceive 0.4.1.
 
 Add OpenReceive to a Rails application — the app you are already working in. You
 do not need a copy of the OpenReceive source: the gem is on RubyGems, the
@@ -106,7 +106,9 @@ itself, and they hold for every integration.
   reject payer-supplied amounts.
 - `config.authorize` runs on every request, and the `resource` it receives is a
   CLAIM the payer made, not proof. Read the framework session; never trust a
-  body field.
+  body field. The generator installs `OpenReceive::ALLOW_ALL_AUTHORIZE`, a
+  placeholder that allows everything (the engine warns at boot while it is
+  set) — replace it with this app's real ownership check, same as `on_paid`.
 - `config.on_paid` must be idempotent. It runs once per `reference` — your order
   id, one per thing you fulfill, created before checkout, kept across retries,
   never reused. A fresh id per page load lets one order be paid twice.
@@ -409,7 +411,9 @@ OpenReceive.configure do |config|
   #                        cookies, or headers from it, as in a controller
   #   context[:resource] — { reference:, payment_hash: } copied from the
   #                        payer's JSON body. It names an order; it does not
-  #                        prove this caller owns it.
+  #                        prove this caller owns it. reference is always a
+  #                        validated non-empty String (≤200 chars); payment_hash
+  #                        is nil except on payment.check / swap.read / swap.refund.
   # Return true to allow, false for a 403. Here: only the signed-in customer
   # who placed the order may act on it.
   config.authorize = lambda do |context|
@@ -455,7 +459,12 @@ The generated initializer ships
 the settlement and fulfills nothing. Replace it with your real fulfillment (as
 above); the engine warns every time your application boots while the
 placeholder is still configured, because orders would otherwise be recorded as settled without ever
-being fulfilled.
+being fulfilled. The same applies to
+`config.authorize = OpenReceive::ALLOW_ALL_AUTHORIZE`, the generated
+allow-all placeholder: it treats possession of the reference as
+authorization, which is safe only while references are unguessable, and the
+engine warns at boot until you replace it with your own ownership check (as
+above). Replace both, not just `on_paid`.
 
 The amount always comes from your own order record; payer-supplied amounts are
 rejected. Advanced hooks (`resolve_checkout`, `on_checkout_created`) remain as
@@ -510,13 +519,13 @@ Bundling with esbuild (jsbundling-rails)? Two things:
    <%= javascript_include_tag "application", type: "module" %>
    ```
 
-2. Serve the payment-method icons. They are files shipped in
-   `@openreceive/browser` and `@openreceive/provider-data` — not in
-   `@openreceive/elements` — and only Vite-style bundlers resolve them from
-   the import. Merge both packages' `dist/assets` trees into
-   `public/openreceive-assets/assets/` and set
+2. Serve the provider images. The payment-method icons are compiled into
+   `@openreceive/browser` and need nothing, but the wallet logos and pay
+   tutorials are files shipped in `@openreceive/provider-data`, and only
+   Vite-style bundlers resolve them from the import. Copy that package's
+   `dist/assets` tree to `public/openreceive-assets/assets/` and set
    `asset-base-url="/openreceive-assets"` on the element
-   ([Provider registry](https://openreceive.org/guides/provider-registry.md#assets-are-files-your-host-serves)).
+   ([Provider registry](https://openreceive.org/guides/provider-registry.md#assets)).
 
 The element creates the checkout for `reference`, then renders and polls
 itself. React/Vue/Svelte/Angular apps use the matching wrapper package

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openreceive-rails
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.4.1
 platform: ruby
 authors:
 - OpenReceive
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.3.3
+        version: 0.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.3.3
+        version: 0.4.1
 - !ruby/object:Gem::Dependency
   name: openreceive-server
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.3.3
+        version: 0.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.3.3
+        version: 0.4.1
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -153,7 +153,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.8
+rubygems_version: 3.6.9
 specification_version: 4
 summary: OpenReceive mountable Rails engine with engine-owned payment attempts in
   the host database.