phlex-reactive 0.9.0 → 0.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e71368e7ea5c16983ff2be0b1ce7d33b50118290dd6467da7fccf6794860da65
-  data.tar.gz: 6a2a5aa30b74f206ed7a451ea64e46427a1552aeebbf1875af614e6b7615190a
+  metadata.gz: 0b8404995a25e3917e5785b4e7becaceff75359c5577dd82f8b44e8dd95e2049
+  data.tar.gz: f1a6e61d8d840aab2273f95405fc19e3e58295c54d2bf10e40ef21bc9bef2b75
 SHA512:
-  metadata.gz: b916d841203cf2cb0901cdf379e25bffb03331c49a4091a7436d1aa921f9d5c3a1dea1a35154e6553819e2b9e097a200bc7ead22b52bc5826444f6bb0fbab8d7
-  data.tar.gz: 36f9fb6e9772ed3f9e354fc32a9560a6dda70e0a156f1fa8429f4e2d9b9f35f3caba0ae7f43dcb72ee11c7a17157b278051f1ebb5cce58cfe17b4cc39496a003
+  metadata.gz: 4218da118f87bb6319b54ec8583437f5d208305d936eedbd81b9eaf01ff17941f5a8b7baac98ef141b29ace3b6dbae937b0cee10368b482b2fef2ba9268c49f4
+  data.tar.gz: ead67e058d25a3443286e70f9a245746604cc584de2a0160446e56a306a99c5f95f8ec0536ca0ec5a1fd1205a3c63ecf27d741e3f8eb992396155c06a84bdb58

data/CHANGELOG.md

@@ -6,6 +6,58 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-07-03
+
+Consolidates everything since 0.2.6; tags 0.2.7–0.4.8 shipped without changelog
+sections, so this section spans the whole run to 0.9.0. The jump from 0.4.8 to
+0.9.0 signals the Tier-2 API wave (#79–#120) and the run-up to 1.0, leaving 0.9.x
+room for dogfood fixes.
+
+### Upgrading from 0.4.x
+
+- **BREAKING — an unknown param-type symbol now raises at boot, not at click
+  time (#109).** A `params:` schema declared with a type the library doesn't know
+  (a typo like `:strng`, or a type you meant to register) raises
+  `Phlex::Reactive::UnknownParamType` when the component class loads — the schema
+  is compiled once at declaration. Fix the typo or register the type. Previously a
+  bad type symbol slipped through to the request and failed obscurely per click.
+- **Minimum Ruby is now 3.4** (was 3.2). Enabling the `it` block parameter
+  requires 3.4, so `required_ruby_version` is `>= 3.4.0`. Stay on the 0.3.x line
+  if you need Ruby 3.2/3.3.
+- **`optimistic:` / `loading:` / `disable_with:` are now RESERVED `on(...)`
+  keywords** (#98, #99), joining `window:` / `once:` / `outside:` / `throttle:`
+  from #80. If an action of yours took a free param literally named `optimistic`,
+  `loading`, or `disable_with`, rename it — those names now configure the
+  client-side hint/loading behavior instead of passing through as an action param.
+- **`flash_builder` → `stream_builder` rename (#113) — no action needed.** The
+  builder does far more than flashes, so it was renamed;
+  `Phlex::Reactive.flash_builder` and `reset_flash_builder!` remain **permanent
+  aliases** (no deprecation). Listed only for grep-ability if you referenced the
+  old names.
+- **The client runtime now ships pre-minified (#148) — zero change for importmap
+  consumers.** The engine pins the `.min.js` build (106 KB → 22 KB, ~7.7 KB
+  gzipped) with a linked sourcemap, so devtools still shows readable source. If
+  you vendor the client file by hand, re-vendor from the minified build (the
+  dummy app's `spec/dummy/public/vendor/reactive_controller.js` is that build).
+
+### Security
+
+- **The signed-token version (`v`) now fails closed on a malformed value.**
+  `upgrade_token` type-guards `v` before comparing it: a non-integer or negative
+  `v` (only producible with the signing key, or by operator error — `v` lives
+  inside the signed blob) now returns `nil` → `400` through the endpoint's
+  `|| raise(InvalidToken)`, instead of a 500 on the `v > TOKEN_VERSION`
+  comparison or silently treating a negative `v` as a legacy passthrough. The
+  fail-closed-on-rollback contract (a `v` newer than this code understands → 400)
+  is unchanged.
+- **The raw-array `js([...])` / `broadcast_js_to([...])` escape hatch now
+  re-applies the attribute-name allowlist server-side.** The `JS` builder rejects
+  event-handler (`on*`), URL-bearing, and `style` attribute names at build time;
+  the raw `[[op, args], …]` form skipped that Ruby-side check and relied on the
+  client interpreter alone. `Phlex::Reactive::JS.assert_ops_allowed!` restores
+  full server-side parity (defense in depth — the client still enforces it too),
+  so a hand-built ops array can't emit an `onclick`/`href`/`style` attr op.
+
 ### Changed
 
 - **One inheritance-aware registry behind the Component DSL; `component.rb` split
@@ -1552,7 +1604,10 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   scaffolds a reactive component (and an RSpec spec when the app uses RSpec),
   state-backed by default or record-backed with `--record`.
 
-[Unreleased]: https://github.com/mhenrixon/phlex-reactive/compare/v0.2.3...HEAD
+[Unreleased]: https://github.com/mhenrixon/phlex-reactive/compare/v0.9.0...HEAD
+[0.9.0]: https://github.com/mhenrixon/phlex-reactive/compare/v0.2.6...v0.9.0
+[0.2.6]: https://github.com/mhenrixon/phlex-reactive/compare/v0.2.5...v0.2.6
+[0.2.5]: https://github.com/mhenrixon/phlex-reactive/compare/v0.2.4...v0.2.5
 [0.2.4]: https://github.com/mhenrixon/phlex-reactive/compare/v0.2.3...v0.2.4
 [0.2.3]: https://github.com/mhenrixon/phlex-reactive/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/mhenrixon/phlex-reactive/compare/v0.2.1...v0.2.2

data/lib/phlex/reactive/js.rb

@@ -44,6 +44,44 @@ module Phlex
       URL_BEARING_ATTRS = %w[href src srcdoc action formaction xlink:href].freeze
       EVENT_HANDLER_ATTR = /\Aon/i
 
+      # The attr ops whose args carry a "name" the allowlist must gate. Used to
+      # re-validate a RAW [op, args] list (the js([...]) / broadcast_js_to([...])
+      # escape hatch) that skips the builder's build-time attr_args check.
+      ATTR_NAME_OPS = %w[set_attr remove_attr toggle_attr].freeze
+
+      # Validate a raw ops list ([[op, args], ...] as passed to js/broadcast_js_to
+      # without the builder) against the attribute allowlist, so the escape hatch
+      # gets the SAME server-side default-deny as the JS chain (defense in depth;
+      # the client also enforces it). Non-attr ops and malformed entries pass
+      # through untouched — the client interpreter default-denies unknown ops.
+      def self.assert_ops_allowed!(list)
+        Array(list).each do |op, args|
+          next unless ATTR_NAME_OPS.include?(op.to_s) && args.is_a?(::Hash)
+
+          name = args["name"] || args[:name]
+          assert_allowed_attr(name.to_s) if name
+        end
+      end
+
+      # The attribute-name allowlist (issue #96), case-insensitive. Refuses
+      # event-handler (on*), URL-bearing, and style attributes. Enforced at build
+      # time by the instance builder AND on the raw-list escape hatch — two-sided
+      # default-deny with the client interpreter.
+      def self.assert_allowed_attr(name)
+        lower = name.downcase
+        if name.match?(EVENT_HANDLER_ATTR)
+          raise ArgumentError,
+            "#{self}: attribute #{name.inspect} is an event handler (on*) — refused (XSS). " \
+            "Client attr ops target hidden/disabled/open/selected/aria-*/data-* and classes."
+        end
+        return unless URL_BEARING_ATTRS.include?(lower) || lower == "style"
+
+        raise ArgumentError,
+          "#{self}: attribute #{name.inspect} is refused — URL-bearing attributes " \
+          "(#{URL_BEARING_ATTRS.join(", ")}) and `style` can't be set from client ops " \
+          "(injection surface). Use classes for styling; target aria-*/data-*/boolean attrs."
+      end
+
       # The accumulated [name, args] op pairs, oldest first. Frozen.
       attr_reader :ops
 
@@ -169,21 +207,10 @@ module Phlex
         args.freeze
       end
 
-      # The attribute-name allowlist (issue #96), case-insensitive. Enforced here
-      # AND in the client interpreter — two-sided default-deny.
+      # Build-time attr-name allowlist for the instance builder — delegates to the
+      # shared class-method check (also used by the raw-list escape hatch).
       def assert_allowed_attr(name)
-        lower = name.downcase
-        if name.match?(EVENT_HANDLER_ATTR)
-          raise ArgumentError,
-            "#{self.class}: attribute #{name.inspect} is an event handler (on*) — refused (XSS). " \
-            "Client attr ops target hidden/disabled/open/selected/aria-*/data-* and classes."
-        end
-        return unless URL_BEARING_ATTRS.include?(lower) || lower == "style"
-
-        raise ArgumentError,
-          "#{self.class}: attribute #{name.inspect} is refused — URL-bearing attributes " \
-          "(#{URL_BEARING_ATTRS.join(", ")}) and `style` can't be set from client ops " \
-          "(injection surface). Use classes for styling; target aria-*/data-*/boolean attrs."
+        self.class.assert_allowed_attr(name)
       end
 
       # A transition must be exactly [during, from, to] class lists (strings).

data/lib/phlex/reactive/response.rb

@@ -275,6 +275,10 @@ data-reactive-ops="#{ERB::Util.html_escape(json)}"></turbo-stream>).html_safe
             list = Array(ops)
             raise ArgumentError, "js(...) got no ops — a dead reactive:js stream" if list.empty?
 
+            # The builder validates attr names at build time; a raw [op, args]
+            # list skips that, so re-apply the allowlist here (defense in depth —
+            # the client interpreter also refuses on*/URL/style attrs).
+            Phlex::Reactive::JS.assert_ops_allowed!(list)
             list.to_json
           end
         end

data/lib/phlex/reactive/version.rb

@@ -2,6 +2,6 @@
 
 module Phlex
   module Reactive
-    VERSION = "0.9.0"
+    VERSION = "0.9.1"
   end
 end

data/lib/phlex/reactive.rb

@@ -446,6 +446,10 @@ module Phlex
       #     through the endpoint's existing `|| raise(InvalidToken)` → 400.
       def upgrade_token(payload)
         version = payload.fetch("v", 0)
+        # "v" is inside the signed blob, so only our own key could produce a
+        # malformed one — but fail closed rather than 500 on the comparison
+        # (String vs Integer) or silently treat a negative "v" as legacy.
+        return nil unless version.is_a?(::Integer) && version >= 0
         return payload if version == TOKEN_VERSION
         return nil if version > TOKEN_VERSION
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: phlex-reactive
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.9.1
 platform: ruby
 authors:
 - Mikael Henriksson