product_tours 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fab25758d2c1f8d2c5671555ddfcc04a1c473c60271635ec1e1c191bf9791718
-  data.tar.gz: 42217e9e5f0f89d25c5bebafb93ad3918e77933707d98cd4d3277f9cc0e3920e
+  metadata.gz: fd91edac94c4a143630f7ba27c3892e750fbce4ea6f4c59490389ceae46a3e63
+  data.tar.gz: ab9eac5f0d14a4548bd49b89ccb7ad195031db2967123be5637953f318a439b3
 SHA512:
-  metadata.gz: 3f2943f106b77da806858a18c719bd63311ad744b1fe08f637a747cf4f0f6dddb89d5399afe53d121acd6bb81da0b9db5cf560c5a307de39d45fe1440c6adc0f
-  data.tar.gz: 75b8e54316db23fecbe7ab4398993afd616893bd8d2bd75e3c4bf0b0c834b65e29f6a6d97ff0d2302736e3067fe2952509677def0bc2abb607a167f0b98e375c
+  metadata.gz: b92ad9c92502b29411417e0c98764068df9dc1b9f6cd73c6751887d263124beee0261f1deddb4ed75bac5ae0b09b137cf20ae6e00eb83cda1f0d790979b0987a
+  data.tar.gz: 835576cf29da8b9210d42565494a3595fa6d76c7816b7e0aaef05be5a2cb2574324a5cd1e3524879998896d56a4b6bc63e66e48de2458986c538eee3671b360e

data/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 0.2.0
+
+- **`config.admin_layout` now works on its own.** The dashboard's stylesheet and
+  script were declared in the gem's layout, so replacing that layout dropped
+  both and the dashboard rendered unstyled with its client-side behaviour dead.
+  They move into the views, so every layout gets them with nothing asked of the
+  host.
+- **The dashboard stylesheet no longer claims selectors it does not own.** It
+  styled bare `*`, `html`, `body` and `a`, and its `.container`, `.card` and
+  `.tabs` are names other frameworks use too, so a host that did load it had its
+  own chrome restyled. Component rules now nest inside a `.pt-dashboard` wrapper
+  the views render, and every custom property is `--pt-` prefixed so it can
+  neither overwrite a host's nor be overwritten. The page-frame rules stay keyed
+  to the body classes only the gem's own layout sets.
+- **Added `config.base_controller_class`.** Name the controller your own admin
+  inherits from and the dashboard adopts its layout, helpers, authentication and
+  request context — the things `admin_layout` cannot give you. It reparents the
+  dashboard only; the widget, tour-resolution and media endpoints stay on the
+  engine's public controller, so it can never demand a staff session from a
+  visitor. Default is unchanged.
+- **Migrations follow the host's `primary_key_type`,** the same
+  `Rails.configuration.generators` lookup Rails' own Active Storage, Action Text
+  and Action Mailbox migrations do. A uuid-keyed app has a uuid
+  `active_storage_attachments.record_id`, so a bigint table here could never
+  hold a video: `attach` raised `NotNullViolation`. A host that set nothing gets
+  an identical migration to before.
+- **Dropped the `id: /\d+/` constraint on the media route,** which was what
+  forced the table to be bigint. It was never load-bearing: every fixed-name
+  route is declared first.
+- **Dropped the redundant `(locale)` index.** A B-tree serves any leftmost
+  prefix, so `(locale, key)` already covered it; it only cost write time and
+  disk. Existing installs keep theirs until they drop it:
+  `remove_index :product_tours_posts, :locale`.
+- A `BackboneTest` now fails the build on any of the above regressing.
+
 ## [Unreleased]
 
 ## [0.1.2] - 2026-08-04

data/README.md

@@ -226,7 +226,8 @@ Everything is optional — a development install works with zero config. In
 | --- | --- | --- |
 | `enabled` | everyone | Who can resolve and open published tutorials |
 | `authorize_admin` | development only | **Who can manage content at the mount path** |
-| `admin_layout` | gem layout | Render the dashboard inside your admin shell |
+| `base_controller_class` | `ActionController::Base` | Controller the dashboard inherits — name your admin's and it adopts its layout, helpers and auth |
+| `admin_layout` | gem layout | Just the shell, if you don't want the whole controller |
 | `storage_service` | app default | Named Active Storage service for uploaded videos |
 | `mount_path` | `/product_tours` | Keep in sync only when mounting the engine manually |
 

data/app/controllers/concerns/product_tours/request_context.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require 'uri'
+
+module ProductTours
+  # Who is asking, which locale they are in, and the gates that answer both.
+  #
+  # A concern rather than inherited behaviour because the engine has two
+  # controller roots: the public endpoints hang off ActionController::Base, and
+  # the dashboard hangs off whatever the host set as `base_controller_class`.
+  module RequestContext
+    extend ActiveSupport::Concern
+
+    private
+
+    def product_tours_admin_layout
+      ProductTours.config.admin_layout
+    end
+
+    def require_admin
+      return if ProductTours.admin?(request)
+
+      render plain: 'Forbidden. Set ProductTours.config.authorize_admin to grant access.', status: :forbidden
+    end
+
+    def current_product_tours_locale
+      requested_locale = params[:locale].to_s
+      return requested_locale if I18n.available_locales.map(&:to_s).include?(requested_locale)
+
+      ProductTours.locale(request)
+    end
+
+    def find_post_by_locale(scope, key)
+      locales = [current_product_tours_locale, I18n.default_locale.to_s].uniq
+      posts = scope.where(locale: locales, key: key).index_by(&:locale)
+      locales.filter_map { |locale| posts[locale] }.first
+    end
+
+    def clean_page_url(value)
+      uri = URI.parse(value.to_s)
+      return unless uri.is_a?(URI::HTTP) && uri.host.present?
+
+      uri.query = nil
+      uri.fragment = nil
+      uri.to_s
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    def unresolved_payload(key, reason)
+      {
+        key: key.to_s,
+        locale: current_product_tours_locale,
+        reason: reason.to_s,
+        page_url: clean_page_url(params[:page_url])
+      }
+    end
+
+    def handle_unresolved_trigger(key, reason)
+      payload = unresolved_payload(key, reason)
+      error = ProductTours::UnresolvedTriggerError.new(payload)
+      raise error if Rails.env.development? || Rails.env.test?
+
+      if defined?(Rails.error) && Rails.error.respond_to?(:report)
+        Rails.error.report(error, handled: true, context: payload)
+      else
+        Rails.logger.error("product_tours: #{error.message} #{payload.inspect}")
+      end
+      ActiveSupport::Notifications.instrument('product_tours.unresolved_trigger', payload)
+      render json: { error: 'unresolved_trigger', reason: reason.to_s }, status: :not_found
+    end
+  end
+end

data/app/controllers/product_tours/application_controller.rb

@@ -1,68 +1,16 @@
 # frozen_string_literal: true
 
-require 'uri'
-
 module ProductTours
+  # Root of the engine's PUBLIC surface: widget.js, tour resolution, signals and
+  # media. These stay on a plain ActionController::Base deliberately — a visitor
+  # loading a tour must not be routed through a host's admin controller, which
+  # would demand a staff session for the widget.
+  #
+  # The dashboard's root is DashboardController, and that is where
+  # `config.base_controller_class` applies.
   class ApplicationController < ActionController::Base
-    protect_from_forgery with: :exception
-
-    private
-
-    def product_tours_admin_layout
-      ProductTours.config.admin_layout
-    end
-
-    def require_admin
-      return if ProductTours.admin?(request)
-
-      render plain: 'Forbidden. Set ProductTours.config.authorize_admin to grant access.', status: :forbidden
-    end
-
-    def current_product_tours_locale
-      requested_locale = params[:locale].to_s
-      return requested_locale if I18n.available_locales.map(&:to_s).include?(requested_locale)
+    include RequestContext
 
-      ProductTours.locale(request)
-    end
-
-    def find_post_by_locale(scope, key)
-      locales = [current_product_tours_locale, I18n.default_locale.to_s].uniq
-      posts = scope.where(locale: locales, key: key).index_by(&:locale)
-      locales.filter_map { |locale| posts[locale] }.first
-    end
-
-    def clean_page_url(value)
-      uri = URI.parse(value.to_s)
-      return unless uri.is_a?(URI::HTTP) && uri.host.present?
-
-      uri.query = nil
-      uri.fragment = nil
-      uri.to_s
-    rescue URI::InvalidURIError
-      nil
-    end
-
-    def unresolved_payload(key, reason)
-      {
-        key: key.to_s,
-        locale: current_product_tours_locale,
-        reason: reason.to_s,
-        page_url: clean_page_url(params[:page_url])
-      }
-    end
-
-    def handle_unresolved_trigger(key, reason)
-      payload = unresolved_payload(key, reason)
-      error = ProductTours::UnresolvedTriggerError.new(payload)
-      raise error if Rails.env.development? || Rails.env.test?
-
-      if defined?(Rails.error) && Rails.error.respond_to?(:report)
-        Rails.error.report(error, handled: true, context: payload)
-      else
-        Rails.logger.error("product_tours: #{error.message} #{payload.inspect}")
-      end
-      ActiveSupport::Notifications.instrument('product_tours.unresolved_trigger', payload)
-      render json: { error: 'unresolved_trigger', reason: reason.to_s }, status: :not_found
-    end
+    protect_from_forgery with: :exception
   end
 end

data/app/controllers/product_tours/dashboard_controller.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module ProductTours
+  # Root of the STAFF surface: the post editor and its list.
+  #
+  # Inherits from `config.base_controller_class` — by default a plain
+  # ActionController::Base, which is why `authorize_admin` exists. Point it at
+  # the controller your own admin already inherits from and the dashboard picks
+  # up that stack wholesale: your layout, your helpers, your authentication, and
+  # whatever request context your before_actions establish. `config.admin_layout`
+  # only ever solved the first of those.
+  #
+  # Only the dashboard hangs off it. The widget's endpoints stay on
+  # ApplicationController, so wiring an admin base controller here can never
+  # demand a staff session from a visitor being shown a tour.
+  class DashboardController < ProductTours.base_controller
+    include RequestContext
+
+    # A host base controller brings its own layout, and declaring one here would
+    # override it. So the gem only claims the layout when it owns the decision:
+    # no host base controller, or a host that named an `admin_layout` explicitly.
+    layout :product_tours_admin_layout unless superclass != ActionController::Base &&
+                                              ProductTours.config.admin_layout ==
+                                              Configuration::DEFAULT_ADMIN_LAYOUT
+
+    before_action :require_admin
+
+    # A host base controller has configured CSRF already; declaring it twice
+    # would run the check twice.
+    protect_from_forgery with: :exception if superclass == ActionController::Base
+  end
+end

data/app/controllers/product_tours/posts_controller.rb

@@ -1,11 +1,9 @@
 # frozen_string_literal: true
 
 module ProductTours
-  class PostsController < ApplicationController
+  class PostsController < DashboardController
     PER_PAGE = 50
 
-    layout :product_tours_admin_layout
-    before_action :require_admin
     before_action :set_post,
                   only: %i[show edit update destroy refresh_video_metadata add_translation publish unpublish]
     before_action :load_linkable_posts, only: %i[new create edit update]

data/app/views/layouts/product_tours/application.html.erb

@@ -5,16 +5,17 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <%= csrf_meta_tags %>
   <%= csp_meta_tag %>
-  <%= stylesheet_link_tag "#{dashboard_stylesheet_path}?v=#{ProductTours::Widget.dashboard_stylesheet_fingerprint}",
-                          "data-turbo-track": "reload" %>
-  <%= javascript_include_tag "#{dashboard_script_path}?v=#{ProductTours::Widget.dashboard_fingerprint}",
-                             "data-turbo-track": "reload", defer: true, nonce: true %>
+  <%# The dashboard's stylesheet and script are declared by the views
+      (product_tours/shared/_dashboard), not here, so they survive a host
+      replacing this layout via config.admin_layout. %>
 </head>
-<body class="<%= content_for?(:body_class) ? yield(:body_class) : '' %>">
-  <div class="container">
-    <% if notice.present? %><div class="flash notice"><%= notice %></div><% end %>
-    <% if alert.present? %><div class="flash alert"><%= alert %></div><% end %>
-    <%= yield %>
+<body class="pt-page <%= content_for?(:body_class) ? yield(:body_class) : '' %>">
+  <div class="pt-dashboard">
+    <div class="container">
+      <% if notice.present? %><div class="flash notice"><%= notice %></div><% end %>
+      <% if alert.present? %><div class="flash alert"><%= alert %></div><% end %>
+      <%= yield %>
+    </div>
   </div>
 </body>
 </html>

data/app/views/product_tours/posts/edit.html.erb

@@ -1,5 +1,7 @@
 <% content_for :body_class, "pt-form-page" %>
 
-<div class="breadcrumb"><%= link_to t("product_tours.dashboard.title", default: "Product tours"), posts_path %> / <%= link_to @post.title, post_path(@post) %> / <%= t("product_tours.dashboard.edit", default: "Edit") %></div>
-<h1><%= t("product_tours.dashboard.edit_post", default: "Edit tutorial") %></h1>
-<%= render "form", post: @post %>
+<%= render layout: 'product_tours/shared/dashboard' do %>
+  <div class="breadcrumb"><%= link_to t("product_tours.dashboard.title", default: "Product tours"), posts_path %> / <%= link_to @post.title, post_path(@post) %> / <%= t("product_tours.dashboard.edit", default: "Edit") %></div>
+  <h1><%= t("product_tours.dashboard.edit_post", default: "Edit tutorial") %></h1>
+  <%= render "form", post: @post %>
+<% end %>

data/app/views/product_tours/posts/index.html.erb

@@ -1,92 +1,94 @@
 <% content_for :body_class, "pt-index" %>
 
-<div class="page-head">
-  <h1><%= t("product_tours.dashboard.title", default: "Product tours") %></h1>
-  <%= link_to t("product_tours.dashboard.new_post", default: "New product tour"), new_post_path, class: "button primary" %>
-</div>
+<%= render layout: 'product_tours/shared/dashboard' do %>
+  <div class="page-head">
+    <h1><%= t("product_tours.dashboard.title", default: "Product tours") %></h1>
+    <%= link_to t("product_tours.dashboard.new_post", default: "New product tour"), new_post_path, class: "button primary" %>
+  </div>
 
-<div class="dashboard-shell <%= "has-selected" if @selected_post %>">
-  <aside class="dashboard-sidebar" aria-label="<%= t("product_tours.dashboard.posts", default: "Tutorials") %>">
-    <nav class="tabs">
-      <% ProductTours::Post::DASHBOARD_STATUSES.each do |status| %>
-        <%= link_to posts_path(status: status, q: @query),
-                    class: ("active" if status == @status) do %>
-          <%= status.humanize %>
-          <span class="count"><%= @counts.fetch(status, 0) %></span>
+  <div class="dashboard-shell <%= "has-selected" if @selected_post %>">
+    <aside class="dashboard-sidebar" aria-label="<%= t("product_tours.dashboard.posts", default: "Tutorials") %>">
+      <nav class="tabs">
+        <% ProductTours::Post::DASHBOARD_STATUSES.each do |status| %>
+          <%= link_to posts_path(status: status, q: @query),
+                      class: ("active" if status == @status) do %>
+            <%= status.humanize %>
+            <span class="count"><%= @counts.fetch(status, 0) %></span>
+          <% end %>
         <% end %>
-      <% end %>
-    </nav>
+      </nav>
 
-    <%= form_with url: posts_path, method: :get, class: "filters" do |form| %>
-      <%= form.hidden_field :status, value: @status %>
-      <%= form.search_field :q, value: @query,
-                            list: "product-tour-key-options",
-                            placeholder: t("product_tours.dashboard.search_key", default: "Search key"),
-                            aria: { label: t("product_tours.dashboard.search", default: "Search") } %>
-      <datalist id="product-tour-key-options">
-        <% @keys.each do |key| %>
-          <%= tag.option value: key %>
+      <%= form_with url: posts_path, method: :get, class: "filters" do |form| %>
+        <%= form.hidden_field :status, value: @status %>
+        <%= form.search_field :q, value: @query,
+                              list: "product-tour-key-options",
+                              placeholder: t("product_tours.dashboard.search_key", default: "Search key"),
+                              aria: { label: t("product_tours.dashboard.search", default: "Search") } %>
+        <datalist id="product-tour-key-options">
+          <% @keys.each do |key| %>
+            <%= tag.option value: key %>
+          <% end %>
+        </datalist>
+        <%= form.submit t("product_tours.dashboard.search", default: "Search") %>
+        <% if @query.present? %>
+          <%= link_to t("product_tours.dashboard.clear_filters", default: "Clear"), posts_path,
+                      class: "button filters-clear" %>
         <% end %>
-      </datalist>
-      <%= form.submit t("product_tours.dashboard.search", default: "Search") %>
-      <% if @query.present? %>
-        <%= link_to t("product_tours.dashboard.clear_filters", default: "Clear"), posts_path,
-                    class: "button filters-clear" %>
       <% end %>
-    <% end %>
 
-    <div class="record-list">
-      <% if @posts.any? %>
-        <% @posts.each do |post| %>
-          <% provider = post.resolved_video&.dig(:provider) %>
-          <%= link_to posts_path(status: @status, q: @query, page: @page, post_id: post.id),
-                      class: ["record-row", ("active" if @selected_post&.id == post.id)].compact do %>
-            <span class="record-main">
-              <span class="record-topline">
-                <span class="badge status-<%= post.status %>"><%= post.status.humanize %></span>
-              </span>
-              <span class="record-copy"><%= post.title %></span>
-              <span class="muted record-meta">
-                <code class="key"><%= post.key %></code>
-                <% if provider %><span><%= provider.humanize %></span><% end %>
+      <div class="record-list">
+        <% if @posts.any? %>
+          <% @posts.each do |post| %>
+            <% provider = post.resolved_video&.dig(:provider) %>
+            <%= link_to posts_path(status: @status, q: @query, page: @page, post_id: post.id),
+                        class: ["record-row", ("active" if @selected_post&.id == post.id)].compact do %>
+              <span class="record-main">
+                <span class="record-topline">
+                  <span class="badge status-<%= post.status %>"><%= post.status.humanize %></span>
+                </span>
+                <span class="record-copy"><%= post.title %></span>
+                <span class="muted record-meta">
+                  <code class="key"><%= post.key %></code>
+                  <% if provider %><span><%= provider.humanize %></span><% end %>
+                </span>
               </span>
-            </span>
-            <span class="record-side" aria-hidden="true"><%= provider ? "▶" : "→" %></span>
+              <span class="record-side" aria-hidden="true"><%= provider ? "▶" : "→" %></span>
+            <% end %>
           <% end %>
+        <% else %>
+          <div class="empty"><%= t("product_tours.dashboard.empty", default: "Nothing here yet.") %></div>
         <% end %>
-      <% else %>
-        <div class="empty"><%= t("product_tours.dashboard.empty", default: "Nothing here yet.") %></div>
-      <% end %>
-    </div>
+      </div>
 
-    <nav class="pager">
-      <span>
-        <% if @page > 1 %>
-          <%= link_to t("product_tours.dashboard.newer", default: "← Newer"),
-                      posts_path(status: @status, q: @query, page: @page - 1) %>
-        <% end %>
-      </span>
-      <span>
-        <% if @more %>
-          <%= link_to t("product_tours.dashboard.older", default: "Older →"),
-                      posts_path(status: @status, q: @query, page: @page + 1) %>
-        <% end %>
-      </span>
-    </nav>
-  </aside>
+      <nav class="pager">
+        <span>
+          <% if @page > 1 %>
+            <%= link_to t("product_tours.dashboard.newer", default: "← Newer"),
+                        posts_path(status: @status, q: @query, page: @page - 1) %>
+          <% end %>
+        </span>
+        <span>
+          <% if @more %>
+            <%= link_to t("product_tours.dashboard.older", default: "Older →"),
+                        posts_path(status: @status, q: @query, page: @page + 1) %>
+          <% end %>
+        </span>
+      </nav>
+    </aside>
 
-  <main class="dashboard-detail" aria-label="<%= t("product_tours.dashboard.current_post", default: "Current tutorial") %>">
-    <% if @selected_post %>
-      <p class="mobile-back">
-        <%= link_to t("product_tours.dashboard.back", default: "All tutorials"),
-                    posts_path(status: @status, q: @query, page: @page) %>
-      </p>
-      <%= render "post_panel", post: @selected_post, sidebar_context: true %>
-    <% else %>
-      <div class="empty-state">
-        <h2><%= t("product_tours.dashboard.select_post", default: "Select a tutorial") %></h2>
-        <p class="muted"><%= t("product_tours.dashboard.select_post_hint", default: "Open a tutorial to preview or edit it.") %></p>
-      </div>
-    <% end %>
-  </main>
-</div>
+    <main class="dashboard-detail" aria-label="<%= t("product_tours.dashboard.current_post", default: "Current tutorial") %>">
+      <% if @selected_post %>
+        <p class="mobile-back">
+          <%= link_to t("product_tours.dashboard.back", default: "All tutorials"),
+                      posts_path(status: @status, q: @query, page: @page) %>
+        </p>
+        <%= render "post_panel", post: @selected_post, sidebar_context: true %>
+      <% else %>
+        <div class="empty-state">
+          <h2><%= t("product_tours.dashboard.select_post", default: "Select a tutorial") %></h2>
+          <p class="muted"><%= t("product_tours.dashboard.select_post_hint", default: "Open a tutorial to preview or edit it.") %></p>
+        </div>
+      <% end %>
+    </main>
+  </div>
+<% end %>

data/app/views/product_tours/posts/new.html.erb

@@ -1,5 +1,7 @@
 <% content_for :body_class, "pt-form-page" %>
 
-<div class="breadcrumb"><%= link_to t("product_tours.dashboard.title", default: "Product tours"), posts_path %> / <%= t("product_tours.dashboard.new_post", default: "New product tour") %></div>
-<h1><%= t("product_tours.dashboard.new_post", default: "New product tour") %></h1>
-<%= render "form", post: @post %>
+<%= render layout: 'product_tours/shared/dashboard' do %>
+  <div class="breadcrumb"><%= link_to t("product_tours.dashboard.title", default: "Product tours"), posts_path %> / <%= t("product_tours.dashboard.new_post", default: "New product tour") %></div>
+  <h1><%= t("product_tours.dashboard.new_post", default: "New product tour") %></h1>
+  <%= render "form", post: @post %>
+<% end %>

data/app/views/product_tours/posts/show.html.erb

@@ -1,5 +1,7 @@
 <% content_for :body_class, "pt-show" %>
 
-<p class="breadcrumb"><%= link_to t("product_tours.dashboard.title", default: "Product tours"), posts_path %> / <%= @post.title %></p>
+<%= render layout: 'product_tours/shared/dashboard' do %>
+  <p class="breadcrumb"><%= link_to t("product_tours.dashboard.title", default: "Product tours"), posts_path %> / <%= @post.title %></p>
 
-<%= render "post_panel", post: @post, sidebar_context: false %>
+  <%= render "post_panel", post: @post, sidebar_context: false %>
+<% end %>

data/app/views/product_tours/shared/_dashboard.html.erb

@@ -0,0 +1,16 @@
+<%# The dashboard's own shell, rendered by the views rather than the layout.
+    That is deliberate: `config.admin_layout` and `config.base_controller_class`
+    both let a host replace the layout, and assets declared in a layout the host
+    replaces simply vanish — the dashboard then renders unstyled with its
+    client-side behaviour dead. Declaring them here means every layout works,
+    host or gem, and a host has nothing to wire up.
+
+    The `pt-dashboard` wrapper is what scopes dashboard.css (see the comment at
+    the top of that file), so it has to enclose the content, not precede it. %>
+<%= stylesheet_link_tag "#{dashboard_stylesheet_path}?v=#{ProductTours::Widget.dashboard_stylesheet_fingerprint}",
+                        "data-turbo-track": "reload" %>
+<%= javascript_include_tag "#{dashboard_script_path}?v=#{ProductTours::Widget.dashboard_fingerprint}",
+                           "data-turbo-track": "reload", defer: true, nonce: true %>
+<div class="pt-dashboard">
+  <%= yield %>
+</div>

data/config/routes.rb

@@ -10,7 +10,11 @@ ProductTours::Engine.routes.draw do
     post :signal, to: 'tours#signal'
   end
 
-  get 'media/:id', to: 'media#show', as: :media, constraints: { id: /\d+/ }
+  # No `id: /\d+/` constraint: it made this route bigint-only, which forced the
+  # table to be bigint too, and a uuid-keyed host could then never attach a video
+  # (its active_storage_attachments.record_id is a uuid column). Every
+  # fixed-name route above is declared first, so ordering already disambiguates.
+  get 'media/:id', to: 'media#show', as: :media
 
   resources :posts do
     post :refresh_video_metadata, on: :member

data/lib/generators/product_tours/install/install_generator.rb

@@ -2,11 +2,13 @@
 
 require 'rails/generators'
 require 'rails/generators/active_record'
+require_relative '../migration_helpers'
 
 module ProductTours
   module Generators
     class InstallGenerator < Rails::Generators::Base
       include ActiveRecord::Generators::Migration
+      include MigrationHelpers
 
       source_root File.expand_path('templates', __dir__)
       desc 'Installs product_tours: initializer, posts migration, and engine mount.'
@@ -33,12 +35,6 @@ module ProductTours
         say 'Run `bin/rails active_storage:install` for uploads and '
         say '`bin/rails action_text:install` for rich descriptions.\n'
       end
-
-      private
-
-      def migration_version
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
     end
   end
 end

data/lib/generators/product_tours/install/templates/create_product_tours_posts.rb.tt

@@ -2,7 +2,7 @@
 
 class CreateProductToursPosts < ActiveRecord::Migration<%= migration_version %>
   def change
-    create_table :product_tours_posts do |t|
+    create_table :product_tours_posts<%= primary_key_type_option %> do |t|
       t.string :key, null: false
       t.string :locale, null: false
       t.string :status, null: false, default: "draft"
@@ -17,7 +17,6 @@ class CreateProductToursPosts < ActiveRecord::Migration<%= migration_version %>
     end
 
     add_index :product_tours_posts, %i[locale key], unique: true
-    add_index :product_tours_posts, :locale
     add_index :product_tours_posts, :status
 
     reversible do |direction|

data/lib/generators/product_tours/install/templates/initializer.rb

@@ -8,6 +8,14 @@ ProductTours.configure do |config|
   # config.authorize_admin = ->(request) { request.env["warden"]&.user&.admin? }
 
   # Render the dashboard in your own admin shell.
+  # Two ways to put the dashboard inside an admin you already have.
+  #
+  # The whole stack — your layout, helpers, authentication and any request
+  # context your before_actions set up. Only the dashboard inherits it; the
+  # widget's endpoints stay public, so this cannot gate a visitor's tour.
+  # config.base_controller_class = "Admin::BaseController"
+  #
+  # Or the layout alone:
   # config.admin_layout = "admin/application"
 
   # Tutorials resolve in the page's current I18n.locale and fall back to

data/lib/generators/product_tours/migration_helpers.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module ProductTours
+  module Generators
+    # Shared bits every migration-writing generator needs.
+    module MigrationHelpers
+      private
+
+      def migration_version
+        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
+      end
+
+      # Follow the host's own key type instead of forcing bigint. An app that
+      # keys its models with uuids has a uuid
+      # `active_storage_attachments.record_id`, so a bigint table here could
+      # never take a video attachment: the foreign key has nowhere to point and
+      # `attach` raises NotNullViolation.
+      #
+      # Same lookup Rails' own Active Storage, Action Text and Action Mailbox
+      # migrations do, so a host that set it once gets consistent tables from
+      # all of them.
+      #
+      # Rendered as a `create_table` option rather than a bare value, because a
+      # template is expanded at generate time: emitting the method name would
+      # put `id: primary_key_type` in the migration, where nothing defines it.
+      # A host with no setting gets no option at all, so the migration reads
+      # exactly as it always did.
+      def primary_key_type_option
+        config = Rails.configuration.generators
+        type = config.options[config.orm][:primary_key_type]
+        type ? ", id: :#{type}" : ''
+      end
+    end
+  end
+end

data/lib/product_tours/configuration.rb

@@ -2,13 +2,33 @@
 
 module ProductTours
   class Configuration
+    # The gem's own dashboard layout. Compared against, so DashboardController
+    # can tell "the host left this alone" from "the host chose this".
+    DEFAULT_ADMIN_LAYOUT = 'product_tours/application'
+
     attr_accessor :enabled, :authorize_admin, :admin_layout, :mount_path,
                   :storage_service
 
+    # The controller the DASHBOARD inherits from, as a String so it resolves
+    # lazily rather than at config time. Default: a plain
+    # 'ActionController::Base', where `authorize_admin` is the only gate.
+    #
+    # Name the controller your own admin already inherits from and the dashboard
+    # adopts that whole stack — layout, helpers, authentication, and any request
+    # context your before_actions set up. `admin_layout` covers only the layout,
+    # which leaves a host layout calling its own helpers to raise NameError under
+    # the engine's isolated namespace.
+    #
+    # Only the dashboard uses it. The widget's endpoints stay on the engine's own
+    # public controller, so an admin base controller here can never demand a
+    # staff session from a visitor being shown a tour.
+    attr_accessor :base_controller_class
+
     def initialize
       @enabled = ->(_request) { true }
       @authorize_admin = ->(_request) { Rails.env.development? }
-      @admin_layout = 'product_tours/application'
+      @admin_layout = DEFAULT_ADMIN_LAYOUT
+      @base_controller_class = 'ActionController::Base'
       @mount_path = '/product_tours'
       @storage_service = nil
     end

data/lib/product_tours/dashboard.css

@@ -1,196 +1,222 @@
+/* Dashboard styles.
+ *
+ * Three layers, and the split is what lets a host replace the layout:
+ *
+ *   :root            custom properties, all `--pt-` prefixed so they can
+ *                    neither overwrite a host's nor be overwritten by them.
+ *   .pt-page          the page frame (was bare html/body). Only the gem's own
+ *                    layout puts this class on <body>, so inside a host admin
+ *                    these rules simply do not apply.
+ *   .pt-dashboard     everything else, nested. Names like .container, .card
+ *                    and .tabs are confined to the dashboard's own markup, so
+ *                    loading this file inside a host cannot restyle its chrome.
+ *
+ * Nothing here styles a bare `body`, `a`, `table` or `*` at the top level.
+ */
+
+
 :root {
   color-scheme: light dark;
-  --bg: #f6f7f9;
-  --surface: #ffffff;
-  --text: #1c2024;
-  --muted: #6b7280;
-  --border: #e5e7eb;
-  --accent: #2563eb;
-  --accent-text: #ffffff;
-  --draft: #6b7280;
-  --published: #16a34a;
-  --danger: #dc2626;
-  --code: #f0f1f3;
+  --pt-bg: #f6f7f9;
+  --pt-surface: #ffffff;
+  --pt-text: #1c2024;
+  --pt-muted: #6b7280;
+  --pt-border: #e5e7eb;
+  --pt-accent: #2563eb;
+  --pt-accent-text: #ffffff;
+  --pt-draft: #6b7280;
+  --pt-published: #16a34a;
+  --pt-danger: #dc2626;
+  --pt-code: #f0f1f3;
 }
-
 @media (prefers-color-scheme: dark) {
   :root {
-    --bg: #111418;
-    --surface: #1a1f26;
-    --text: #e6e8ea;
-    --muted: #9aa2ab;
-    --border: #2a313a;
-    --accent: #3b82f6;
-    --code: #232a33;
-  }
+    --pt-bg: #111418;
+    --pt-surface: #1a1f26;
+    --pt-text: #e6e8ea;
+    --pt-muted: #9aa2ab;
+    --pt-border: #2a313a;
+    --pt-accent: #3b82f6;
+    --pt-code: #232a33;
 }
-
-* { box-sizing: border-box; }
-html { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; letter-spacing: 0; }
-body { margin: 0; min-height: 100vh; background: var(--bg); color: var(--text); font: 15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; }
-a { color: var(--accent); text-decoration: none; }
-a:hover { text-decoration: underline; }
-:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
-.container { max-width: 1020px; margin: 0 auto; padding: 24px 16px 64px; }
-h1 { margin: 0 0 16px; font-size: 22px; }
-h2 { margin: 0 0 12px; font-size: 16px; }
-.page-head { display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-bottom: 14px; }
-.page-head h1 { margin: 0; }
-.muted { color: var(--muted); font-size: 13px; }
-
-button, .button {
-  width: auto;
-  display: inline-flex; align-items: center; justify-content: center; min-height: 38px; padding: 8px 14px;
-  border: 1px solid var(--border); border-radius: 8px; background: var(--surface); color: var(--text);
-  font: inherit; cursor: pointer;
 }
-button:hover, .button:hover { border-color: var(--muted); text-decoration: none; }
-button.primary, .button.primary { border-color: var(--accent); background: var(--accent); color: var(--accent-text); }
-button.danger, .button.danger { color: var(--danger); }
-button.small, .button.small { min-height: 32px; padding: 4px 10px; font-size: 13px; }
-
-.tabs { display: flex; gap: 6px; }
-.tabs a {
-  position: relative; display: flex; flex: 1 1 0; align-items: center; justify-content: center; gap: 6px;
-  min-height: 34px; padding: 5px 10px 8px; border-radius: 8px; color: var(--muted); font-weight: 600;
-}
-.tabs a:hover { background: var(--bg); color: var(--text); text-decoration: none; }
-.tabs a.active { color: var(--text); }
-.tabs a.active::after { content: ""; position: absolute; right: 20px; bottom: 0; left: 20px; height: 2px; border-radius: 999px; background: var(--accent); }
-.count { min-width: 20px; padding: 0 6px; border-radius: 999px; background: color-mix(in srgb, var(--muted) 14%, transparent); font-size: 12px; text-align: center; }
-
-.filters { display: grid; grid-template-columns: minmax(0, 1fr) auto auto; gap: 8px; padding: 12px; border-bottom: 1px solid var(--border); }
-.filters input[type="search"] { min-width: 0; }
-input, select, textarea {
-  width: 100%; min-height: 38px; padding: 7px 9px; border: 1px solid var(--border); border-radius: 8px;
-  background: var(--surface); color: var(--text); font: inherit; font-size: 16px; letter-spacing: 0;
+@media (max-width: 760px) {
+  .pt-page { overflow-x: hidden; font-size: 14px; }
+  .pt-index { overflow-y: auto; overflow-x: hidden; }
+  .pt-index, .pt-index .container { min-height: 100vh; height: auto; }
+  .pt-index .container { padding-bottom: 10px; }
+  .pt-dashboard {
+  & .container { padding: 14px 10px 24px; }
+  & .page-head { align-items: center; }
+  & .page-head .button { min-height: 36px; }
+  & .dashboard-shell { display: block; min-height: calc(100vh - 58px); }
+  & .dashboard-sidebar,
+  & .dashboard-detail { min-height: calc(100vh - 58px); }
+  & .dashboard-shell.has-selected .dashboard-sidebar { display: none; }
+  & .dashboard-shell:not(.has-selected) .dashboard-detail { display: none; }
+  & .record-list { overflow: visible; }
+  & .record-row { padding: 12px; }
+  & .record-meta { display: none; }
+  & .dashboard-detail .post-panel { min-height: calc(100vh - 64px); }
+  & .mobile-back { display: block; flex: 0 0 auto; margin: 4px 0 10px; font-size: 13px; }
+  & .post-panel,
+  & .detail-scroll,
+  & .card,
+  & dl,
+  & dd { min-width: 0; max-width: 100%; }
+  & .dashboard-detail .card { width: 100%; }
+  & dl { grid-template-columns: 1fr; gap: 3px; }
+  & dd { margin-bottom: 8px; }
+  & .action-picker,
+  & .video-source-picker { grid-template-columns: 1fr; }
+  & .form-card { padding: 0; }
+  }
 }
-textarea { resize: vertical; }
-input:focus, select:focus, textarea:focus { border-color: var(--accent); outline: 2px solid color-mix(in srgb, var(--accent) 22%, transparent); outline-offset: 0; }
-
-.card { overflow: hidden; border: 1px solid var(--border); border-radius: 12px; background: var(--surface); }
-.card.pad { padding: 16px; overflow: visible; }
-.badge { display: inline-flex; padding: 2px 9px; border-radius: 999px; color: #ffffff; font-size: 12px; font-weight: 600; white-space: nowrap; }
-.badge.status-draft { background: var(--draft); }
-.badge.status-published { background: var(--published); }
-.badge.locale { border: 1px solid var(--border); background: transparent; color: var(--muted); }
-code.key { max-width: 100%; padding: 2px 7px; border-radius: 6px; background: var(--code); font: 12.5px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace; overflow-wrap: anywhere; }
-.flash, .errors { margin-bottom: 16px; padding: 10px 12px; border: 1px solid var(--border); border-radius: 8px; background: var(--surface); }
-.flash.notice { border-color: var(--published); }
-.flash.alert, .errors { border-color: var(--danger); }
-.errors ul { margin-bottom: 0; }
-.empty { padding: 48px 16px; color: var(--muted); text-align: center; }
-.empty-state { max-width: 320px; margin: auto; padding: 24px; text-align: center; }
-.empty-state h2 { margin: 0 0 6px; font-size: 18px; }
-.empty-state p { margin: 0; }
-.breadcrumb { margin: 0 0 12px; font-size: 13px; }
 
+/* Page frame — the gem's own layout only. */
+.pt-page { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; letter-spacing: 0; }
+.pt-page { margin: 0; min-height: 100vh; background: var(--pt-bg); color: var(--pt-text); font: 15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; }
 .pt-index, .pt-index .container { height: 100vh; height: 100dvh; }
 .pt-index { overflow: hidden; }
 .pt-index .container { display: flex; max-width: 1280px; flex-direction: column; padding-bottom: 16px; }
 .pt-index .page-head { flex: 0 0 auto; }
-.dashboard-shell { display: grid; flex: 1 1 auto; grid-template-columns: minmax(330px, 410px) 1fr; gap: 16px; min-height: 0; }
-.dashboard-sidebar { display: flex; min-width: 0; min-height: 0; flex-direction: column; overflow: hidden; border: 1px solid var(--border); border-radius: 8px; background: var(--surface); }
-.dashboard-sidebar .tabs { flex: 0 0 auto; margin: 12px 12px 0; }
-.record-list { flex: 1 1 auto; min-height: 0; overflow-y: auto; }
-.record-row { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 12px; padding: 13px 14px; border-bottom: 1px solid var(--border); color: var(--text); }
-.record-row:hover { background: var(--bg); text-decoration: none; }
-.record-row.active { background: color-mix(in srgb, var(--accent) 9%, var(--surface)); box-shadow: inset 3px 0 0 var(--accent); }
-.record-main { display: flex; min-width: 0; flex-direction: column; gap: 5px; }
-.record-topline, .record-meta { display: flex; align-items: center; gap: 8px; min-width: 0; }
-.record-copy { display: block; overflow: hidden; font-weight: 600; text-overflow: ellipsis; white-space: nowrap; }
-.record-meta span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.record-side { align-self: center; color: var(--muted); }
-.pager { display: flex; flex: 0 0 auto; justify-content: space-between; min-height: 42px; padding: 10px 12px; border-top: 1px solid var(--border); }
-.dashboard-detail { display: flex; min-width: 0; min-height: 0; flex-direction: column; overflow: hidden; }
-.dashboard-detail .post-panel { flex: 1 1 auto; min-height: 0; }
-.dashboard-detail .detail-scroll { flex: 1 1 auto; overflow-y: auto; padding-right: 2px; }
-.mobile-back { display: none; }
-
-.post-panel { display: flex; min-width: 0; flex-direction: column; }
-.detail-scroll { display: flex; min-height: 0; flex-direction: column; gap: 12px; }
-.preview-card { width: 100%; }
-.video-preview { width: 100%; aspect-ratio: 16 / 9; margin-bottom: 16px; overflow: hidden; border-radius: 6px; background: #05070a; }
-.video-preview iframe, .video-preview video { display: block; width: 100%; height: 100%; border: 0; object-fit: contain; }
-.description-preview { color: var(--muted); overflow-wrap: anywhere; }
-.preview-action { display: flex; justify-content: flex-end; margin-top: 16px; }
-.details-card { width: 100%; }
-dl { display: grid; grid-template-columns: max-content minmax(0, 1fr); gap: 6px 16px; margin: 0; }
-dt { color: var(--muted); }
-dd { margin: 0; overflow-wrap: anywhere; }
-.refresh-button { margin-top: 14px; }
-.metadata { max-width: 100%; overflow-x: auto; margin: 14px 0 0; padding: 12px; border-radius: 6px; background: var(--code); font-size: 12px; }
-.translation-list { border-top: 1px solid var(--border); }
-.translation-row { display: flex; align-items: center; justify-content: space-between; gap: 12px; padding: 10px 0; border-bottom: 1px solid var(--border); }
-.translation-name { display: flex; min-width: 0; align-items: center; flex-wrap: wrap; gap: 8px; }
-.translation-form { display: flex; align-items: flex-end; gap: 8px; margin-top: 16px; }
-.translation-form .field { flex: 1 1 auto; margin: 0; }
-.translation-complete { margin: 14px 0 0; }
-.actions, .form-actions { display: flex; align-items: center; flex-wrap: wrap; gap: 8px; }
-.actions { margin: 0; }
-.details-actions { margin-top: 16px; }
-.actions form { display: inline; }
-.form-actions input[type="submit"] { width: auto; }
-
 .pt-show { min-height: 100vh; overflow: auto; }
 .pt-show .post-panel { width: 100%; }
 .pt-show .detail-scroll { overflow: visible; }
 .pt-form-page .container { max-width: 820px; }
-.post-form { width: 100%; }
-.form-card { padding: 0; }
-.form-section { padding: 12px 0 4px; }
-.form-section + .form-section { margin-top: 4px; }
-.form-section h2 { margin-bottom: 12px; }
-.field { margin-bottom: 16px; }
-.field label { display: block; margin-bottom: 5px; font-weight: 600; }
-.field small { display: block; margin-top: 5px; color: var(--muted); }
-.section-intro { margin: -4px 0 12px; color: var(--muted); }
-.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; overflow: hidden; clip: rect(0, 0, 0, 0); white-space: nowrap; border: 0; }
-.action-picker, .video-source-picker { display: grid; gap: 10px; min-width: 0; margin: 0 0 18px; padding: 0; border: 0; }
-.action-picker { grid-template-columns: repeat(3, 1fr); }
-.video-source-picker { grid-template-columns: repeat(2, 1fr); }
-.action-choice { display: flex; align-items: flex-start; gap: 10px; min-width: 0; margin: 0; padding: 12px; border: 1px solid var(--border); border-radius: 8px; cursor: pointer; }
-.action-choice:hover { border-color: var(--muted); }
-.action-choice.selected { border-color: var(--accent); background: color-mix(in srgb, var(--accent) 7%, var(--surface)); box-shadow: 0 0 0 1px var(--accent); }
-.action-choice input { width: 18px; min-width: 18px; min-height: 18px; margin: 2px 0 0; }
-.action-choice span { min-width: 0; }
-.action-choice strong, .action-choice small { display: block; }
-.action-choice small { margin-top: 3px; color: var(--muted); font-weight: 400; line-height: 1.35; }
-.preview-action { align-items: center; gap: 12px; }
-.preview-back { margin-right: auto; color: var(--muted); }
-.checkbox { display: flex !important; align-items: center; gap: 8px; margin-top: 8px; font-weight: 400 !important; }
-.checkbox input { width: 18px; min-height: 18px; }
-.form-actions { padding-top: 12px; }
-.form-video-preview { margin: 2px 0 16px; }
-.form-video-preview .video-preview { margin-bottom: 6px; }
-.form-video-preview > small { color: var(--muted); }
-.rich-editor { overflow: hidden; border: 1px solid var(--border); border-radius: 8px; background: var(--surface); }
-.rich-toolbar { display: flex; gap: 4px; padding: 7px; border-bottom: 1px solid var(--border); background: var(--bg); }
-.rich-toolbar button { width: 36px; height: 34px; min-height: 34px; padding: 0; border-color: transparent; background: transparent; font-weight: 600; }
-.rich-content { min-height: 160px; padding: 12px; outline: none; overflow-wrap: anywhere; }
-.rich-content:focus { box-shadow: inset 0 0 0 2px var(--accent); }
 
-@media (max-width: 760px) {
-  body { overflow-x: hidden; font-size: 14px; }
-  .container { padding: 14px 10px 24px; }
-  .page-head { align-items: center; }
-  .page-head .button { min-height: 36px; }
-  .pt-index { overflow-y: auto; overflow-x: hidden; }
-  .pt-index, .pt-index .container { min-height: 100vh; height: auto; }
-  .pt-index .container { padding-bottom: 10px; }
-  .dashboard-shell { display: block; min-height: calc(100vh - 58px); }
-  .dashboard-sidebar, .dashboard-detail { min-height: calc(100vh - 58px); }
-  .dashboard-shell.has-selected .dashboard-sidebar { display: none; }
-  .dashboard-shell:not(.has-selected) .dashboard-detail { display: none; }
-  .record-list { overflow: visible; }
-  .record-row { padding: 12px; }
-  .record-meta { display: none; }
-  .dashboard-detail .post-panel { min-height: calc(100vh - 64px); }
-  .mobile-back { display: block; flex: 0 0 auto; margin: 4px 0 10px; font-size: 13px; }
-  .post-panel, .detail-scroll, .card, dl, dd { min-width: 0; max-width: 100%; }
-  .dashboard-detail .card { width: 100%; }
-  dl { grid-template-columns: 1fr; gap: 3px; }
-  dd { margin-bottom: 8px; }
-  .action-picker, .video-source-picker { grid-template-columns: 1fr; }
-  .form-card { padding: 0; }
+/* Dashboard components — any layout. */
+.pt-dashboard {
+  & * { box-sizing: border-box; }
+  & a { color: var(--pt-accent); text-decoration: none; }
+  & a:hover { text-decoration: underline; }
+  & :focus-visible { outline: 2px solid var(--pt-accent); outline-offset: 2px; }
+  & .container { max-width: 1020px; margin: 0 auto; padding: 24px 16px 64px; }
+  & h1 { margin: 0 0 16px; font-size: 22px; }
+  & h2 { margin: 0 0 12px; font-size: 16px; }
+  & .page-head { display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-bottom: 14px; }
+  & .page-head h1 { margin: 0; }
+  & .muted { color: var(--pt-muted); font-size: 13px; }
+  & button,
+  & .button { width: auto; display: inline-flex; align-items: center; justify-content: center; min-height: 38px; padding: 8px 14px; border: 1px solid var(--pt-border); border-radius: 8px; background: var(--pt-surface); color: var(--pt-text); font: inherit; cursor: pointer; }
+  & button:hover,
+  & .button:hover { border-color: var(--pt-muted); text-decoration: none; }
+  & button.primary,
+  & .button.primary { border-color: var(--pt-accent); background: var(--pt-accent); color: var(--pt-accent-text); }
+  & button.danger,
+  & .button.danger { color: var(--pt-danger); }
+  & button.small,
+  & .button.small { min-height: 32px; padding: 4px 10px; font-size: 13px; }
+  & .tabs { display: flex; gap: 6px; }
+  & .tabs a { position: relative; display: flex; flex: 1 1 0; align-items: center; justify-content: center; gap: 6px; min-height: 34px; padding: 5px 10px 8px; border-radius: 8px; color: var(--pt-muted); font-weight: 600; }
+  & .tabs a:hover { background: var(--pt-bg); color: var(--pt-text); text-decoration: none; }
+  & .tabs a.active { color: var(--pt-text); }
+  & .tabs a.active::after { content: ""; position: absolute; right: 20px; bottom: 0; left: 20px; height: 2px; border-radius: 999px; background: var(--pt-accent); }
+  & .count { min-width: 20px; padding: 0 6px; border-radius: 999px; background: color-mix(in srgb, var(--pt-muted) 14%, transparent); font-size: 12px; text-align: center; }
+  & .filters { display: grid; grid-template-columns: minmax(0, 1fr) auto auto; gap: 8px; padding: 12px; border-bottom: 1px solid var(--pt-border); }
+  & .filters input[type="search"] { min-width: 0; }
+  & input,
+  & select,
+  & textarea { width: 100%; min-height: 38px; padding: 7px 9px; border: 1px solid var(--pt-border); border-radius: 8px; background: var(--pt-surface); color: var(--pt-text); font: inherit; font-size: 16px; letter-spacing: 0; }
+  & textarea { resize: vertical; }
+  & input:focus,
+  & select:focus,
+  & textarea:focus { border-color: var(--pt-accent); outline: 2px solid color-mix(in srgb, var(--pt-accent) 22%, transparent); outline-offset: 0; }
+  & .card { overflow: hidden; border: 1px solid var(--pt-border); border-radius: 12px; background: var(--pt-surface); }
+  & .card.pad { padding: 16px; overflow: visible; }
+  & .badge { display: inline-flex; padding: 2px 9px; border-radius: 999px; color: #ffffff; font-size: 12px; font-weight: 600; white-space: nowrap; }
+  & .badge.status-draft { background: var(--pt-draft); }
+  & .badge.status-published { background: var(--pt-published); }
+  & .badge.locale { border: 1px solid var(--pt-border); background: transparent; color: var(--pt-muted); }
+  & code.key { max-width: 100%; padding: 2px 7px; border-radius: 6px; background: var(--pt-code); font: 12.5px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace; overflow-wrap: anywhere; }
+  & .flash,
+  & .errors { margin-bottom: 16px; padding: 10px 12px; border: 1px solid var(--pt-border); border-radius: 8px; background: var(--pt-surface); }
+  & .flash.notice { border-color: var(--pt-published); }
+  & .flash.alert,
+  & .errors { border-color: var(--pt-danger); }
+  & .errors ul { margin-bottom: 0; }
+  & .empty { padding: 48px 16px; color: var(--pt-muted); text-align: center; }
+  & .empty-state { max-width: 320px; margin: auto; padding: 24px; text-align: center; }
+  & .empty-state h2 { margin: 0 0 6px; font-size: 18px; }
+  & .empty-state p { margin: 0; }
+  & .breadcrumb { margin: 0 0 12px; font-size: 13px; }
+  & .dashboard-shell { display: grid; flex: 1 1 auto; grid-template-columns: minmax(330px, 410px) 1fr; gap: 16px; min-height: 0; }
+  & .dashboard-sidebar { display: flex; min-width: 0; min-height: 0; flex-direction: column; overflow: hidden; border: 1px solid var(--pt-border); border-radius: 8px; background: var(--pt-surface); }
+  & .dashboard-sidebar .tabs { flex: 0 0 auto; margin: 12px 12px 0; }
+  & .record-list { flex: 1 1 auto; min-height: 0; overflow-y: auto; }
+  & .record-row { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 12px; padding: 13px 14px; border-bottom: 1px solid var(--pt-border); color: var(--pt-text); }
+  & .record-row:hover { background: var(--pt-bg); text-decoration: none; }
+  & .record-row.active { background: color-mix(in srgb, var(--pt-accent) 9%, var(--pt-surface)); box-shadow: inset 3px 0 0 var(--pt-accent); }
+  & .record-main { display: flex; min-width: 0; flex-direction: column; gap: 5px; }
+  & .record-topline,
+  & .record-meta { display: flex; align-items: center; gap: 8px; min-width: 0; }
+  & .record-copy { display: block; overflow: hidden; font-weight: 600; text-overflow: ellipsis; white-space: nowrap; }
+  & .record-meta span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  & .record-side { align-self: center; color: var(--pt-muted); }
+  & .pager { display: flex; flex: 0 0 auto; justify-content: space-between; min-height: 42px; padding: 10px 12px; border-top: 1px solid var(--pt-border); }
+  & .dashboard-detail { display: flex; min-width: 0; min-height: 0; flex-direction: column; overflow: hidden; }
+  & .dashboard-detail .post-panel { flex: 1 1 auto; min-height: 0; }
+  & .dashboard-detail .detail-scroll { flex: 1 1 auto; overflow-y: auto; padding-right: 2px; }
+  & .mobile-back { display: none; }
+  & .post-panel { display: flex; min-width: 0; flex-direction: column; }
+  & .detail-scroll { display: flex; min-height: 0; flex-direction: column; gap: 12px; }
+  & .preview-card { width: 100%; }
+  & .video-preview { width: 100%; aspect-ratio: 16 / 9; margin-bottom: 16px; overflow: hidden; border-radius: 6px; background: #05070a; }
+  & .video-preview iframe,
+  & .video-preview video { display: block; width: 100%; height: 100%; border: 0; object-fit: contain; }
+  & .description-preview { color: var(--pt-muted); overflow-wrap: anywhere; }
+  & .preview-action { display: flex; justify-content: flex-end; margin-top: 16px; }
+  & .details-card { width: 100%; }
+  & dl { display: grid; grid-template-columns: max-content minmax(0, 1fr); gap: 6px 16px; margin: 0; }
+  & dt { color: var(--pt-muted); }
+  & dd { margin: 0; overflow-wrap: anywhere; }
+  & .refresh-button { margin-top: 14px; }
+  & .metadata { max-width: 100%; overflow-x: auto; margin: 14px 0 0; padding: 12px; border-radius: 6px; background: var(--pt-code); font-size: 12px; }
+  & .translation-list { border-top: 1px solid var(--pt-border); }
+  & .translation-row { display: flex; align-items: center; justify-content: space-between; gap: 12px; padding: 10px 0; border-bottom: 1px solid var(--pt-border); }
+  & .translation-name { display: flex; min-width: 0; align-items: center; flex-wrap: wrap; gap: 8px; }
+  & .translation-form { display: flex; align-items: flex-end; gap: 8px; margin-top: 16px; }
+  & .translation-form .field { flex: 1 1 auto; margin: 0; }
+  & .translation-complete { margin: 14px 0 0; }
+  & .actions,
+  & .form-actions { display: flex; align-items: center; flex-wrap: wrap; gap: 8px; }
+  & .actions { margin: 0; }
+  & .details-actions { margin-top: 16px; }
+  & .actions form { display: inline; }
+  & .form-actions input[type="submit"] { width: auto; }
+  & .post-form { width: 100%; }
+  & .form-card { padding: 0; }
+  & .form-section { padding: 12px 0 4px; }
+  & .form-section + .form-section { margin-top: 4px; }
+  & .form-section h2 { margin-bottom: 12px; }
+  & .field { margin-bottom: 16px; }
+  & .field label { display: block; margin-bottom: 5px; font-weight: 600; }
+  & .field small { display: block; margin-top: 5px; color: var(--pt-muted); }
+  & .section-intro { margin: -4px 0 12px; color: var(--pt-muted); }
+  & .sr-only { position: absolute; width: 1px; height: 1px; padding: 0; overflow: hidden; clip: rect(0, 0, 0, 0); white-space: nowrap; border: 0; }
+  & .action-picker,
+  & .video-source-picker { display: grid; gap: 10px; min-width: 0; margin: 0 0 18px; padding: 0; border: 0; }
+  & .action-picker { grid-template-columns: repeat(3, 1fr); }
+  & .video-source-picker { grid-template-columns: repeat(2, 1fr); }
+  & .action-choice { display: flex; align-items: flex-start; gap: 10px; min-width: 0; margin: 0; padding: 12px; border: 1px solid var(--pt-border); border-radius: 8px; cursor: pointer; }
+  & .action-choice:hover { border-color: var(--pt-muted); }
+  & .action-choice.selected { border-color: var(--pt-accent); background: color-mix(in srgb, var(--pt-accent) 7%, var(--pt-surface)); box-shadow: 0 0 0 1px var(--pt-accent); }
+  & .action-choice input { width: 18px; min-width: 18px; min-height: 18px; margin: 2px 0 0; }
+  & .action-choice span { min-width: 0; }
+  & .action-choice strong,
+  & .action-choice small { display: block; }
+  & .action-choice small { margin-top: 3px; color: var(--pt-muted); font-weight: 400; line-height: 1.35; }
+  & .preview-action { align-items: center; gap: 12px; }
+  & .preview-back { margin-right: auto; color: var(--pt-muted); }
+  & .checkbox { display: flex !important; align-items: center; gap: 8px; margin-top: 8px; font-weight: 400 !important; }
+  & .checkbox input { width: 18px; min-height: 18px; }
+  & .form-actions { padding-top: 12px; }
+  & .form-video-preview { margin: 2px 0 16px; }
+  & .form-video-preview .video-preview { margin-bottom: 6px; }
+  & .form-video-preview > small { color: var(--pt-muted); }
+  & .rich-editor { overflow: hidden; border: 1px solid var(--pt-border); border-radius: 8px; background: var(--pt-surface); }
+  & .rich-toolbar { display: flex; gap: 4px; padding: 7px; border-bottom: 1px solid var(--pt-border); background: var(--pt-bg); }
+  & .rich-toolbar button { width: 36px; height: 34px; min-height: 34px; padding: 0; border-color: transparent; background: transparent; font-weight: 600; }
+  & .rich-content { min-height: 160px; padding: 12px; outline: none; overflow-wrap: anywhere; }
+  & .rich-content:focus { box-shadow: inset 0 0 0 2px var(--pt-accent); }
 }

data/lib/product_tours/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ProductTours
-  VERSION = '0.1.2'
+  VERSION = '0.2.0'
 end

data/lib/product_tours.rb

@@ -24,6 +24,14 @@ module ProductTours
       !!config.enabled.call(request)
     end
 
+    # The class ProductTours::DashboardController inherits from. Resolved on
+    # every call rather than memoized, so a host that reassigns
+    # base_controller_class in a reloadable initializer is not pinned to a
+    # stale, unloaded constant.
+    def base_controller
+      config.base_controller_class.to_s.constantize
+    end
+
     def admin?(request)
       !!config.authorize_admin.call(request)
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: product_tours
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Yaroslav Shmarov
@@ -40,7 +40,9 @@ files:
 - MIT-LICENSE
 - README.md
 - Rakefile
+- app/controllers/concerns/product_tours/request_context.rb
 - app/controllers/product_tours/application_controller.rb
+- app/controllers/product_tours/dashboard_controller.rb
 - app/controllers/product_tours/media_controller.rb
 - app/controllers/product_tours/posts_controller.rb
 - app/controllers/product_tours/tours_controller.rb
@@ -56,6 +58,7 @@ files:
 - app/views/product_tours/posts/index.html.erb
 - app/views/product_tours/posts/new.html.erb
 - app/views/product_tours/posts/show.html.erb
+- app/views/product_tours/shared/_dashboard.html.erb
 - config/locales/product_tours.ar.yml
 - config/locales/product_tours.bg.yml
 - config/locales/product_tours.bn.yml
@@ -90,6 +93,7 @@ files:
 - lib/generators/product_tours/install/install_generator.rb
 - lib/generators/product_tours/install/templates/create_product_tours_posts.rb.tt
 - lib/generators/product_tours/install/templates/initializer.rb
+- lib/generators/product_tours/migration_helpers.rb
 - lib/product_tours.rb
 - lib/product_tours/configuration.rb
 - lib/product_tours/content_security_policy.rb