public_code 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 391563ed134d7ff113b44b5608ddf2068dd18ca6048190aa1913e03a7313adc8
-  data.tar.gz: 7b1e6be8d4b8bb9abdac10b8aaabf5a269c37b2fe119437f1387562985537538
+  metadata.gz: 85226caa9d5bbc68eedc7aecda5105a079c13733853522736aa1fb04f6d99477
+  data.tar.gz: 5bfe2a1075d98348dad53b5b569d86e21c16938908f91ef08ea97015076df351
 SHA512:
-  metadata.gz: d84156a63e7644dd3df2f9beb2c33b20cc12c2936db07c0f2d30770aad3cfaa2572439e91a0fabb33691fdcbbbaf333b1b09c577ebcf3e0aae7221db28b4a736
-  data.tar.gz: ea22466225e19e92fe4fbe4d737153bd0c03c0d8ffa26aaac497d2fb38548066157e3aba9442e3a8b66712b4233f5ae966d40b7e04a7ca545de6cf8149ddd800
+  metadata.gz: 7b25139d8cc38a6ef010df8bd0167022f39e35469d89a80c026386603224d23128d21079c193981c074bd4ff0bedf4212c826668568f36792b81479be1519b25
+  data.tar.gz: 5909c90e24ef0e6dc33956b1454b20b7d0f37c47c327f3923649774da7a8a26a00712195359041436d9e7c06fbbcee5256d26cd1516c9308fa51e05cd3b96a57

data/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-12
+
+### Added
+
+- `bin/rails public_code:status` lists every model that declares a code and whether it is addressed by code or by id.
+- With `STRICT=1` the status task fails naming each model still addressed by id.
+
+## [0.2.0] - 2026-10-12
+
+### Added
+
+- A record whose table has no code column yet is addressed and found by its id, so a gem can give its records codes before every app has migrated.
+- A record whose table has the code column is not found by an all-digit address.
+- `assert_no_numbered_links` fails a test naming each page that links to an address with an all-digit path segment or query value.
+
+### Changed
+
+- A record gets its code when the app's secure token setting says, as with Rails' own secure tokens.
+
+## [0.1.0]
+
 ### Added
 
 - A model that calls `has_public_code` gives each new record a random 24 character code, and every address Rails builds for the record carries that code in place of its id.

data/README.md

@@ -61,3 +61,63 @@ A column with its own name works the same way:
 ```ruby
 has_public_code :code
 ```
+
+## Codes are for addresses only
+
+A code replaces the id only where a person or an outside caller sees it: page
+addresses, API and MCP addresses, and links sent out. Records still point at
+each other by id, and a record's id never changes.
+
+## A gem whose records take codes in some apps first
+
+A gem declares the code on its model the same way:
+
+```ruby
+module EasyFlow
+  class Run < ApplicationRecord
+    has_public_code
+  end
+end
+```
+
+Until an app's table has the code column, a record is addressed and found by
+its id exactly as before, so a gem can release this without every app
+migrating at once. Once the table has the column, every address carries the
+code and an all-digit address is not found. Ship the migration that adds the
+column with the gem and name it in the gem's changelog.
+
+An app switches a gem's records to codes by copying and running that migration,
+then restarting so the new column is seen.
+
+## Seeing which models still use ids
+
+In a Rails app:
+
+```
+bin/rails public_code:status
+```
+
+It lists every model that declares a code and says whether it is addressed by
+code or by id. With `STRICT=1` it fails when any model is still addressed by
+id, and names each one, so a deploy or CI step can require every migration to
+have run.
+
+## Checking pages for numbered links
+
+In an integration test:
+
+```ruby
+require "public_code/test_help"
+
+class ClientAddressesTest < ActionDispatch::IntegrationTest
+  include PublicCode::TestHelp
+
+  test "no client page links to a numbered address" do
+    assert_no_numbered_links([ "/home", "/products/#{product.public_code}" ], safe: [ "page" ])
+  end
+end
+```
+
+It fails when a link or form on any page has an all-digit path segment, or an
+all-digit query value whose name is not in `safe:`, and names each page and
+link. Links to other sites, asset files and stored files are not checked.

data/lib/public_code/model.rb

@@ -4,9 +4,14 @@ module PublicCode
 
     class_methods do
       def has_public_code(column = :public_code)
-        has_secure_token column, length: PublicCode::LENGTH
-        define_method(:to_param) { public_send(column) }
-        define_singleton_method(:find_by_public_code!) { |code| find_by!(column => code) }
+        PublicCode.models << self
+        define_singleton_method(:public_code_column?) { table_exists? && column_names.include?(column.to_s) }
+        define_method(:give_public_code) { self[column] ||= PublicCode.generate if self.class.public_code_column? }
+        define_method(:"regenerate_#{column}") { update!(column => PublicCode.generate) }
+        after_initialize :give_public_code, if: -> { new_record? && ActiveRecord.generate_secure_token_on == :initialize }
+        before_create :give_public_code
+        define_method(:to_param) { self.class.public_code_column? ? public_send(column) : super() }
+        define_singleton_method(:find_by_public_code!) { |address| public_code_column? ? find_by!(column => address) : find(address) }
       end
     end
   end

data/lib/public_code/railtie.rb

@@ -0,0 +1,5 @@
+module PublicCode
+  class Railtie < Rails::Railtie
+    rake_tasks { load File.expand_path("../tasks/public_code.rake", __dir__) }
+  end
+end

data/lib/public_code/test_help.rb

@@ -0,0 +1,32 @@
+require "uri"
+
+module PublicCode
+  module TestHelp
+    def assert_no_numbered_links(pages, safe: [])
+      found = pages.flat_map do |page|
+        get page
+        TestHelp.numbered_links(links_on_page, safe: safe).map { |link| "#{page} links to #{link}" }
+      end
+      assert found.empty?, ([ "Pages link to numbered addresses:" ] + found).join("\n")
+    end
+
+    def links_on_page = css_select("a[href], form[action]").map { |element| element["href"] || element["action"] }
+
+    def self.numbered_links(addresses, safe: [])
+      addresses.select do |address|
+        next false unless own_page?(address)
+
+        uri = URI(address)
+        numbered_path?(uri.path) || numbered_query?(uri.query, safe)
+      end
+    end
+
+    def self.own_page?(address) = address.start_with?("/") && !address.start_with?("//", "/assets/", "/rails/active_storage/")
+
+    def self.numbered_path?(path) = path.split("/").any? { |segment| number?(segment) }
+
+    def self.numbered_query?(query, safe) = URI.decode_www_form(query.to_s).any? { |name, value| !safe.include?(name) && number?(value) }
+
+    def self.number?(value) = value.match?(/\A\d+\z/)
+  end
+end

data/lib/public_code/version.rb

@@ -1,3 +1,3 @@
 module PublicCode
-  VERSION = "0.1.0"
+  VERSION = "0.3.0"
 end

data/lib/public_code.rb

@@ -1,5 +1,6 @@
 require "active_record"
 require "active_support"
+require "active_support/core_ext/securerandom"
 require "public_code/version"
 require "public_code/model"
 
@@ -7,6 +8,10 @@ module PublicCode
   LENGTH = 24
 
   def self.generate = ActiveRecord::Base.generate_unique_secure_token(length: LENGTH)
+
+  def self.models = @models ||= []
 end
 
 ActiveSupport.on_load(:active_record) { include PublicCode::Model }
+
+require "public_code/railtie" if defined?(Rails::Railtie)

data/lib/tasks/public_code.rake

@@ -0,0 +1,11 @@
+namespace :public_code do
+  desc "List each model that declares a code and whether it is addressed by code or by id, failing on any by id when STRICT=1"
+  task status: :environment do
+    Rails.application.eager_load! if defined?(Rails.application) && Rails.application
+    models = PublicCode.models.sort_by(&:name)
+    models.each { |model| puts "#{model.name} addressed by #{model.public_code_column? ? "code" : "id"}" }
+
+    by_id = models.reject(&:public_code_column?)
+    abort "Still addressed by id: #{by_id.map(&:name).join(", ")}" if ENV["STRICT"] == "1" && by_id.any?
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: public_code
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Tyler Schneider
@@ -50,7 +50,10 @@ files:
 - README.md
 - lib/public_code.rb
 - lib/public_code/model.rb
+- lib/public_code/railtie.rb
+- lib/public_code/test_help.rb
 - lib/public_code/version.rb
+- lib/tasks/public_code.rake
 homepage: https://github.com/DYB-Development/public_code
 licenses:
 - MIT