public_code 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 391563ed134d7ff113b44b5608ddf2068dd18ca6048190aa1913e03a7313adc8
-  data.tar.gz: 7b1e6be8d4b8bb9abdac10b8aaabf5a269c37b2fe119437f1387562985537538
+  metadata.gz: 535f7f0cf97ddb8664e239bfb344ee344763f4f9992ae47a30bbdc23b7eb4c6a
+  data.tar.gz: f6b8b87729c7c566cb14b31f6579107f01880ea4e713649a6e8b2694ae4aca9a
 SHA512:
-  metadata.gz: d84156a63e7644dd3df2f9beb2c33b20cc12c2936db07c0f2d30770aad3cfaa2572439e91a0fabb33691fdcbbbaf333b1b09c577ebcf3e0aae7221db28b4a736
-  data.tar.gz: ea22466225e19e92fe4fbe4d737153bd0c03c0d8ffa26aaac497d2fb38548066157e3aba9442e3a8b66712b4233f5ae966d40b7e04a7ca545de6cf8149ddd800
+  metadata.gz: 044c101dcebc4c309d96a7fbe9a21d4b00f95f3e72b9685a843e08e2ac6475aead151f78b585e51a7a3ae705971543f46c71af7fcc8f2711579fc5a8a617407f
+  data.tar.gz: 4ac279aef93d9311b5450261df822179fe743f0c3c2a4d9293f25cf95c3ca117d06d6313c77a7271cec0e2510fe999b8fc99ff5c0d4d61402fbf7170b3261a87

data/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-10-12
+
+### Added
+
+- A record whose table has no code column yet is addressed and found by its id, so a gem can give its records codes before every app has migrated.
+- A record whose table has the code column is not found by an all-digit address.
+- `assert_no_numbered_links` fails a test naming each page that links to an address with an all-digit path segment or query value.
+
+### Changed
+
+- A record gets its code when the app's secure token setting says, as with Rails' own secure tokens.
+
+## [0.1.0]
+
 ### Added
 
 - A model that calls `has_public_code` gives each new record a random 24 character code, and every address Rails builds for the record carries that code in place of its id.

data/README.md

@@ -61,3 +61,50 @@ A column with its own name works the same way:
 ```ruby
 has_public_code :code
 ```
+
+## Codes are for addresses only
+
+A code replaces the id only where a person or an outside caller sees it: page
+addresses, API and MCP addresses, and links sent out. Records still point at
+each other by id, and a record's id never changes.
+
+## A gem whose records take codes in some apps first
+
+A gem declares the code on its model the same way:
+
+```ruby
+module EasyFlow
+  class Run < ApplicationRecord
+    has_public_code
+  end
+end
+```
+
+Until an app's table has the code column, a record is addressed and found by
+its id exactly as before, so a gem can release this without every app
+migrating at once. Once the table has the column, every address carries the
+code and an all-digit address is not found. Ship the migration that adds the
+column with the gem and name it in the gem's changelog.
+
+An app switches a gem's records to codes by copying and running that migration,
+then restarting so the new column is seen.
+
+## Checking pages for numbered links
+
+In an integration test:
+
+```ruby
+require "public_code/test_help"
+
+class ClientAddressesTest < ActionDispatch::IntegrationTest
+  include PublicCode::TestHelp
+
+  test "no client page links to a numbered address" do
+    assert_no_numbered_links([ "/home", "/products/#{product.public_code}" ], safe: [ "page" ])
+  end
+end
+```
+
+It fails when a link or form on any page has an all-digit path segment, or an
+all-digit query value whose name is not in `safe:`, and names each page and
+link. Links to other sites, asset files and stored files are not checked.

data/lib/public_code/model.rb

@@ -4,9 +4,13 @@ module PublicCode
 
     class_methods do
       def has_public_code(column = :public_code)
-        has_secure_token column, length: PublicCode::LENGTH
-        define_method(:to_param) { public_send(column) }
-        define_singleton_method(:find_by_public_code!) { |code| find_by!(column => code) }
+        define_singleton_method(:public_code_column?) { table_exists? && column_names.include?(column.to_s) }
+        define_method(:give_public_code) { self[column] ||= PublicCode.generate if self.class.public_code_column? }
+        define_method(:"regenerate_#{column}") { update!(column => PublicCode.generate) }
+        after_initialize :give_public_code, if: -> { new_record? && ActiveRecord.generate_secure_token_on == :initialize }
+        before_create :give_public_code
+        define_method(:to_param) { self.class.public_code_column? ? public_send(column) : super() }
+        define_singleton_method(:find_by_public_code!) { |address| public_code_column? ? find_by!(column => address) : find(address) }
       end
     end
   end

data/lib/public_code/test_help.rb

@@ -0,0 +1,32 @@
+require "uri"
+
+module PublicCode
+  module TestHelp
+    def assert_no_numbered_links(pages, safe: [])
+      found = pages.flat_map do |page|
+        get page
+        TestHelp.numbered_links(links_on_page, safe: safe).map { |link| "#{page} links to #{link}" }
+      end
+      assert found.empty?, ([ "Pages link to numbered addresses:" ] + found).join("\n")
+    end
+
+    def links_on_page = css_select("a[href], form[action]").map { |element| element["href"] || element["action"] }
+
+    def self.numbered_links(addresses, safe: [])
+      addresses.select do |address|
+        next false unless own_page?(address)
+
+        uri = URI(address)
+        numbered_path?(uri.path) || numbered_query?(uri.query, safe)
+      end
+    end
+
+    def self.own_page?(address) = address.start_with?("/") && !address.start_with?("//", "/assets/", "/rails/active_storage/")
+
+    def self.numbered_path?(path) = path.split("/").any? { |segment| number?(segment) }
+
+    def self.numbered_query?(query, safe) = URI.decode_www_form(query.to_s).any? { |name, value| !safe.include?(name) && number?(value) }
+
+    def self.number?(value) = value.match?(/\A\d+\z/)
+  end
+end

data/lib/public_code/version.rb

@@ -1,3 +1,3 @@
 module PublicCode
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/public_code.rb

@@ -1,5 +1,6 @@
 require "active_record"
 require "active_support"
+require "active_support/core_ext/securerandom"
 require "public_code/version"
 require "public_code/model"
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: public_code
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Tyler Schneider
@@ -50,6 +50,7 @@ files:
 - README.md
 - lib/public_code.rb
 - lib/public_code/model.rb
+- lib/public_code/test_help.rb
 - lib/public_code/version.rb
 homepage: https://github.com/DYB-Development/public_code
 licenses: