rails-markup 1.2.4 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c558fe97e361a67cf9bea35dda5c4477c631d14d4fe3883a252e7df41a9ffce5
-  data.tar.gz: e1c04335a8337fbb2a9f05031c12980be2fbf4eeffd6dc7c767840801238a910
+  metadata.gz: d852927076b8b5e1774675692c45b575eb9dd6337c934637e90c693310d96f4d
+  data.tar.gz: 3608bdd64056b7cb3373de2cd4ea0797a1e6dc3e021457ec96697a4d3f8c7919
 SHA512:
-  metadata.gz: 879ed444ed7087e294ae9ac493463f6e1ce93be51e1a32743c75e4a4de730eaa5c25637511feea145c4ec3825ccb716391f158528febd7c3e80acc46a382c14e
-  data.tar.gz: 4d6fefa5e2fd4f5f04aa60a0b8ba6d0ea7cfa6447d1303ed252d4b3a92dbe71b3b586337e7f60010c1236d34441c1adf36a449b8e24dfff50b19154ef3cc83be
+  metadata.gz: ac1ee4649e024d9a3fa306bf3fefb9f6443c2d89cec4d33de6b504831123228f1db3cc2e20414914fdec41150e832ea077d76cfe1c606859c2177626eb643251
+  data.tar.gz: e8942c6bcbff10487ab62170039b6c62c0c0ffe87a59cb77ac8df87792c6365109d222451fc8756831fad1284b1336f7d0adff3dbf3698b257e2c0e2b1346899

data/app/assets/javascripts/rails_markup/toolbar.js

@@ -381,7 +381,7 @@
       this._boundMouseUp = (e) => self._handleMouseUp(e);
       this._boundClick = (e) => self._handleClick(e);
       this._boundKeyDown = (e) => self._handleKeyDown(e);
-      this._boundTouchStart = (e) => { if (self.active && e.touches[0]) { const t = e.touches[0]; self._handleMouseDown({ clientX: t.clientX, clientY: t.clientY }); } };
+      this._boundTouchStart = (e) => { if (self.active && e.touches[0]) { const t = e.touches[0]; const el = document.elementFromPoint(t.clientX, t.clientY); if (el && !self._isToolbar(el) && e.cancelable) e.preventDefault(); self._handleMouseDown({ clientX: t.clientX, clientY: t.clientY }); } };
       this._boundTouchEnd = (e) => { if (self.active && e.changedTouches[0]) { const t = e.changedTouches[0]; const el = document.elementFromPoint(t.clientX, t.clientY); if (el && !self._isToolbar(el)) { e.preventDefault(); self._handleMouseUp({ clientX: t.clientX, clientY: t.clientY, preventDefault(){}, stopPropagation(){} }); } } };
 
       // Turbo Frames — partial DOM update, reposition pins
@@ -512,7 +512,14 @@
 
     _handleMouseDown(event) {
       const el = document.elementFromPoint(event.clientX, event.clientY);
-      if (el && !this._isToolbar(el)) this.clickedElement = el;
+      if (el && !this._isToolbar(el)) {
+        this.clickedElement = el;
+        // Suppress the press so host controls (buttons, drag handles, form
+        // fields) don't act before mouseup/click is blocked. Guard for the
+        // synthetic object passed from the touchstart handler.
+        if (typeof event.preventDefault === "function") event.preventDefault();
+        if (typeof event.stopPropagation === "function") event.stopPropagation();
+      }
     },
 
     async _handleMouseUp(event) {
@@ -1035,13 +1042,17 @@
 
     // ---- Storage ----
 
-    _storageKey() { return "rm-annotations"; },
+    _storageKey() {
+      const endpoint = (this.endpoint || "/feedback/api").replace(/\/+$/, "") || "/";
+      return `rm-annotations:${encodeURIComponent(endpoint)}`;
+    },
     _pageUrl() { return window.location.pathname + window.location.search; },
-    _pageStorageKey() { return "rm-annotations:" + this._pageUrl(); },
+    _pageStorageKey() { return this._storageKey() + ":" + this._pageUrl(); },
 
     _saveToStorage() {
       try {
-        // Save all annotations to a single global key
+        // Cross-tab storage-event merging is deferred: safely reconciling ordered
+        // upserts and tombstones needs conflict semantics, not a last-write merge.
         localStorage.setItem(this._storageKey(), JSON.stringify({
           annotations: this.annotations,
           nextId: this.nextId,
@@ -1436,7 +1447,8 @@
 
     _loadFromStorage() {
       try {
-        // Load from global key first
+        // Old unnamespaced keys are intentionally not read because they may belong
+        // to another user or toolbar mount on the same origin.
         let raw = localStorage.getItem(this._storageKey());
         if (raw) {
           const data = JSON.parse(raw);
@@ -1459,8 +1471,8 @@
     },
 
     _migratePageAnnotations() {
-      // Find and merge any legacy per-page annotation keys
-      const prefix = "rm-annotations:";
+      // Find and merge per-page annotation keys only within this endpoint namespace.
+      const prefix = this._storageKey() + ":";
       const migratedKeys = [];
       const seenIds = new Set(this.annotations.map(a => a.id));
       const consolidatedClientIds = new Set(this.annotations.map(a => a.clientId).filter(clientId => this._validClientId(clientId)));
@@ -1537,6 +1549,8 @@
         return { annotation, index };
       });
 
+      this._normalizeOutboxEnvelopes();
+
       const byClientId = new Map();
       normalized.forEach(candidate => {
         const current = byClientId.get(candidate.annotation.clientId);
@@ -1549,7 +1563,10 @@
       this._assignDisplayIds();
       this.annotations.forEach(annotation => {
         const mapped = annotation.serverId != null;
-        const queued = Boolean(this.outbox[annotation.clientId]);
+        const queuedEntry = this.outbox[annotation.clientId];
+        const queued = Boolean(queuedEntry);
+        const annotationRevision = Number.isInteger(annotation.revision) && annotation.revision >= 0 ? annotation.revision : 0;
+        annotation.revision = annotationRevision;
         annotation.syncState = (queued && annotation.syncState === "failed")
           ? "failed"
           : ((queued || !mapped) ? "pending" : "synced");
@@ -1557,6 +1574,9 @@
           annotation.dirtyFields = this._legacyDirtyFields(annotation);
           this.outbox[annotation.clientId] = {
             type: "upsert",
+            clientId: annotation.clientId,
+            revision: annotation.revision,
+            syncState: "pending",
             annotation: this._desiredState(annotation),
             dirtyFields: annotation.dirtyFields.slice()
           };
@@ -1564,6 +1584,45 @@
       });
     },
 
+    _normalizeOutboxEnvelopes() {
+      const normalized = {};
+
+      Object.entries(this.outbox).forEach(([storedClientId, candidate]) => {
+        if (!this._plainObject(candidate)) return;
+
+        const nestedClientId = candidate.annotation?.clientId;
+        const clientId = this._validClientId(nestedClientId)
+          ? nestedClientId
+          : (this._validClientId(candidate.clientId)
+            ? candidate.clientId
+            : (this._validClientId(storedClientId) ? storedClientId : null));
+        if (!clientId) return;
+
+        const type = candidate.type === "delete"
+          ? "delete"
+          : ((candidate.type === "upsert" || this._plainObject(candidate.annotation)) ? "upsert" : null);
+        if (!type) return;
+
+        const annotation = this.annotations.find(record => record.clientId === clientId);
+        const candidateRevision = Number.isInteger(candidate.revision) && candidate.revision >= 0 ? candidate.revision : 0;
+        const annotationRevision = Number.isInteger(annotation?.revision) && annotation.revision >= 0 ? annotation.revision : 0;
+        const envelope = Object.assign({}, candidate, {
+          type,
+          clientId,
+          revision: Math.max(candidateRevision, annotationRevision),
+          syncState: candidate.syncState === "failed" ? "failed" : "pending"
+        });
+
+        if (type === "upsert") {
+          envelope.annotation = Object.assign({}, candidate.annotation, { clientId });
+          envelope.dirtyFields = this._mergeDirtyFields(candidate.dirtyFields || envelope.annotation.dirtyFields || []);
+        }
+        normalized[clientId] = envelope;
+      });
+
+      this.outbox = normalized;
+    },
+
     _isNewerLocalRecord(candidate, current) {
       const timestamp = value => {
         const parsed = Date.parse(value || "");

data/app/controllers/rails_markup/dashboard_controller.rb

@@ -223,10 +223,22 @@ module RailsMarkup
         # each (not find_each) so the export keeps the scope's :recent ordering —
         # find_each ignores ORDER BY and batches by primary key.
         scope.each do |ann|
-          csv << [ann.id, ann.status, ann.intent, ann.severity, ann.content, ann.page_url,
-                  ann.author_name, ann.selected_text, ann.created_at.iso8601, ann.updated_at.iso8601]
+          csv << [ann.id, ann.status, ann.intent, ann.severity,
+                  csv_safe(ann.content), csv_safe(ann.page_url),
+                  csv_safe(ann.author_name), csv_safe(ann.selected_text),
+                  ann.created_at.iso8601, ann.updated_at.iso8601]
         end
       end
     end
+
+    # Neutralize CSV/spreadsheet formula injection: a leading =, +, -, @, or
+    # control char makes Excel/Sheets evaluate the cell as a formula. Prefix
+    # such values with an apostrophe so they're treated as literal text.
+    def csv_safe(value)
+      str = value.to_s
+      return str unless str.match?(/\A[=+\-@\t\r]/)
+
+      "'#{str}"
+    end
   end
 end

data/app/controllers/rails_markup/external/annotations_controller.rb

@@ -54,8 +54,11 @@ module RailsMarkup
       end
 
       def authenticate_token!
-        # Development — allow all requests without token (dev server may bind to LAN IP)
-        return if Rails.env.development?
+        # Development convenience: skip token auth so you can reach the API from
+        # another device on your LAN. This permits unauthenticated reads and
+        # writes from any network peer — set
+        # config.require_api_token_in_development to lock it down.
+        return if Rails.env.development? && !RailsMarkup.config.require_api_token_in_development
 
         token = RailsMarkup.config.api_token
         return head(:not_found) if token.nil?

data/app/models/rails_markup/annotation.rb

@@ -114,28 +114,35 @@ module RailsMarkup
     end
 
     def resolve!(summary: nil)
-      return self if status == "resolved" # idempotent — re-resolving is a no-op
-      raise "Cannot resolve a #{status} annotation" unless status.in?(%w[pending acknowledged])
+      # with_lock reloads under a row lock so a concurrent reply/resolve can't
+      # read a stale thread and silently drop the other write on save.
+      with_lock do
+        return self if status == "resolved" # idempotent — re-resolving is a no-op
+        raise "Cannot resolve a #{status} annotation" unless status.in?(%w[pending acknowledged])
 
-      transaction do
         add_thread_entry(role: "agent", message: summary) if summary.present?
         update!(status: "resolved")
       end
+      self
     end
 
     def dismiss!(reason: nil)
-      return self if status == "dismissed" # idempotent — re-dismissing is a no-op
-      raise "Cannot dismiss a #{status} annotation" unless status.in?(%w[pending acknowledged])
+      with_lock do
+        return self if status == "dismissed" # idempotent — re-dismissing is a no-op
+        raise "Cannot dismiss a #{status} annotation" unless status.in?(%w[pending acknowledged])
 
-      transaction do
         add_thread_entry(role: "agent", message: reason) if reason.present?
         update!(status: "dismissed")
       end
+      self
     end
 
     def add_reply!(message:, role: "agent")
-      add_thread_entry(role: role, message: message)
-      save!
+      with_lock do
+        add_thread_entry(role: role, message: message)
+        save!
+      end
+      self
     end
 
     def as_api_json

data/app/views/rails_markup/shared/_toolbar.html.erb

@@ -1,5 +1,11 @@
 <%# Rails Markup annotation toolbar — self-contained, no Tailwind/Stimulus dependency %>
 <% if RailsMarkup.config.toolbar_enabled %>
+<%# Authorization sentinel: present only when this partial renders (i.e. the
+    layout gate authorized the request). The turbo:load handler below checks for
+    it after each navigation and tears the toolbar down if it's gone — otherwise
+    the document-level listener would recreate the toolbar (and expose cached
+    annotations) after a logout Turbo visit whose new body omits the partial. %>
+<span id="rm-toolbar-gate" hidden aria-hidden="true"></span>
 <script>
 <%== File.read(File.expand_path("../../../assets/javascripts/rails_markup/toolbar.js", __dir__)) %>
 </script>
@@ -19,9 +25,15 @@
     };
     // Init immediately (DOM is ready — script is at end of body)
     RailsMarkupToolbar.init(opts);
-    // Re-init after Turbo Drive navigations (DOMContentLoaded won't fire again)
+    // After Turbo Drive navigations (DOMContentLoaded won't fire again), only
+    // re-init when the new page is still authorized (gate sentinel present);
+    // otherwise tear the toolbar down so it can't persist past a logout.
     document.addEventListener("turbo:load", function() {
-      RailsMarkupToolbar.init(opts);
+      if (document.getElementById("rm-toolbar-gate")) {
+        RailsMarkupToolbar.init(opts);
+      } else if (window.RailsMarkupToolbar && typeof RailsMarkupToolbar.destroy === "function") {
+        RailsMarkupToolbar.destroy();
+      }
     });
   })();
 </script>

data/lib/generators/rails_markup/install/templates/create_rails_markup_annotations.rb.erb

@@ -5,7 +5,10 @@ class CreateRailsMarkupAnnotations < ActiveRecord::Migration<%= migration_versio
 
     create_table :<%= options[:table_name] %> do |t|
       t.bigint :user_id
-      t.string :page_url, null: false
+      # 2048 to match the model's page_url length validation. The default
+      # string limit (255) would raise DB errors on PostgreSQL/MySQL for
+      # model-valid long URLs (SQLite is lax, so tests wouldn't catch it).
+      t.string :page_url, limit: 2048, null: false
       t.send json_type, :target, default: {}
       t.text :content, null: false
       t.string :intent, null: false, default: "change"
@@ -20,7 +23,13 @@ class CreateRailsMarkupAnnotations < ActiveRecord::Migration<%= migration_versio
     end
 
     add_index :<%= options[:table_name] %>, [:status, :created_at]
-    add_index :<%= options[:table_name] %>, :page_url
+    # A full 2048-char index blows past MySQL/InnoDB's key-length limit on
+    # utf8mb4, so index only a prefix there; other adapters index the column.
+    if connection.adapter_name.downcase.include?("mysql")
+      add_index :<%= options[:table_name] %>, :page_url, length: 191
+    else
+      add_index :<%= options[:table_name] %>, :page_url
+    end
     add_index :<%= options[:table_name] %>, :user_id
     add_index :<%= options[:table_name] %>, :client_uuid, unique: true
   end

data/lib/generators/rails_markup/install_generator.rb

@@ -70,8 +70,19 @@ module RailsMarkup
           <% end %>
         ERB
 
-        if File.read(File.join(destination_root, layout_path)).include?("rails_markup/shared/toolbar")
-          say_status :skip, "toolbar already present in #{layout_path}", :yellow
+        content = File.read(File.join(destination_root, layout_path))
+
+        if content.include?("rails_markup/shared/toolbar")
+          # Upgrade the pre-1.2.3 partial-existence gate, which rendered the
+          # toolbar for every visitor, to the admin-gated block. Leave any
+          # custom (hand-edited) block untouched so we don't clobber it.
+          legacy = /^[ \t]*<%#\s*Rails Markup annotation toolbar\s*%>\r?\n[ \t]*<%\s*if\s+lookup_context\.exists\?.*?<%\s*end\s*%>\r?\n?/m
+          if content =~ legacy
+            gsub_file layout_path, legacy, toolbar_block
+            say_status :update, "upgraded toolbar to admin-gated render in #{layout_path}", :green
+          else
+            say_status :skip, "toolbar already present in #{layout_path} (left as-is)", :yellow
+          end
           return
         end
 

data/lib/rails_markup/cli.rb

@@ -39,8 +39,10 @@ module RailsMarkup
         bin/markup server --port 5000   # custom port
     DESC
     method_option :port, type: :numeric, default: 4747, desc: "HTTP server port"
+    method_option :host, type: :string, default: "127.0.0.1",
+      desc: "Bind address (loopback by default; use 0.0.0.0 to expose on the LAN)"
     def server
-      srv = RailsMarkup::Server.new(port: options[:port])
+      srv = RailsMarkup::Server.new(port: options[:port], bind: options[:host])
       srv.start
     end
 
@@ -641,17 +643,25 @@ module RailsMarkup
       "local"
     end
 
-    # Check local first, then fall back to global/codex configs.
+    # Merge configs per-key with local taking precedence over global over codex.
+    # Merging (rather than returning the first non-empty config) means a local
+    # config that only defines dev values doesn't shadow production credentials
+    # stored globally or in the codex config.
     def resolve_mcp_env
-      McpConfig::SCOPES.each do |scope|
+      merged = {}
+      # Reverse so the highest-precedence scope (local) is applied last and wins.
+      McpConfig::SCOPES.reverse_each do |scope|
         config = McpConfig.new(scope: scope)
         next unless config.exist?
 
-        env = config.raw_env
-        return env unless env.empty?
+        # Skip blank values so an empty key in a higher-precedence config
+        # doesn't clobber a real value from a lower-precedence one.
+        config.raw_env.each do |key, value|
+          merged[key] = value unless value.to_s.strip.empty?
+        end
       end
 
-      {}
+      merged
     end
 
     def resolve_env(production)
@@ -674,6 +684,12 @@ module RailsMarkup
           return nil
         end
 
+        unless base_url.to_s.downcase.start_with?("https://")
+          say "Refusing to send the production token over an insecure connection.", :red
+          say "Production URL must use HTTPS (got: #{base_url})", :red
+          return nil
+        end
+
         { base_url: base_url, token: token, mount_path: mount }
       else
         base_url = options[:url] || mcp_env["RAILS_MARKUP_DEV_URL"]

data/lib/rails_markup/configuration.rb

@@ -15,6 +15,13 @@ module RailsMarkup
     # Set to nil to disable external API.
     attr_accessor :api_token
 
+    # In development the external API skips token auth by default so you can
+    # reach it from another device on your LAN (e.g. your phone). That allows
+    # unauthenticated reads AND writes from any network peer. Set to true to
+    # require the bearer token even in development.
+    # Default: false (open in development)
+    attr_accessor :require_api_token_in_development
+
     # Database table name for annotations.
     attr_accessor :table_name
 
@@ -77,6 +84,7 @@ module RailsMarkup
     def initialize
       @base_controller_class = "RailsMarkup::ApplicationController"
       @api_token = nil
+      @require_api_token_in_development = false
       @table_name = "rails_markup_annotations"
       @per_page = 25
       @toolbar_accent = "indigo"

data/lib/rails_markup/http_server.rb

@@ -9,15 +9,22 @@ module RailsMarkup
   class HttpServer
     attr_reader :port, :store
 
-    def initialize(store:, port: 4747, logger: nil)
+    attr_reader :bind
+
+    def initialize(store:, port: 4747, bind: "127.0.0.1", logger: nil)
       @store  = store
       @port   = port
+      @bind   = bind
       @logger = logger || WEBrick::Log.new($stderr, WEBrick::Log::WARN)
     end
 
     def start
+      # Bind to loopback by default — this store server is unauthenticated, so
+      # binding to 0.0.0.0 would expose it to the whole LAN. Pass bind: "0.0.0.0"
+      # (bin/markup server --host 0.0.0.0) to deliberately expose it.
       @server = WEBrick::HTTPServer.new(
         Port: @port,
+        BindAddress: @bind,
         Logger: @logger,
         AccessLog: [],
         DoNotReverseLookup: true

data/lib/rails_markup/server.rb

@@ -9,8 +9,9 @@ module RailsMarkup
   class Server
     attr_reader :store
 
-    def initialize(port: 4747, mcp_only: false)
+    def initialize(port: 4747, bind: "127.0.0.1", mcp_only: false)
       @port     = port
+      @bind     = bind
       @mcp_only = mcp_only
       @store    = Store.new
     end
@@ -44,8 +45,8 @@ module RailsMarkup
       if port_available?(@port)
         # We own the port — start HTTP + MCP with shared in-memory store
         http_thread = Thread.new do
-          http = HttpServer.new(store: @store, port: @port)
-          $stderr.puts "[rails-markup] HTTP server listening on port #{@port}"
+          http = HttpServer.new(store: @store, port: @port, bind: @bind)
+          $stderr.puts "[rails-markup] HTTP server listening on #{@bind}:#{@port}"
           http.start
         end
 
@@ -63,7 +64,7 @@ module RailsMarkup
     end
 
     def port_available?(port)
-      server = TCPServer.new("0.0.0.0", port)
+      server = TCPServer.new(@bind, port)
       server.close
       true
     rescue Errno::EADDRINUSE

data/lib/rails_markup/store.rb

@@ -214,6 +214,17 @@ module RailsMarkup
           false
         end
       end
+
+      # Hard cap: if every session is still fresh we'd otherwise grow without
+      # bound. Evict the oldest sessions to make room for the incoming one.
+      return if @sessions.size < MAX_SESSIONS
+
+      overflow = @sessions.size - MAX_SESSIONS + 1
+      oldest = @sessions.values.sort_by(&:created_at).first(overflow)
+      oldest.each do |session|
+        session.annotations.each { |a| @annotations_index.delete(a.id) }
+        @sessions.delete(session.id)
+      end
     end
   end
 end

data/lib/rails_markup/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsMarkup
-  VERSION = "1.2.4"
+  VERSION = "1.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-markup
 version: !ruby/object:Gem::Version
-  version: 1.2.4
+  version: 1.3.0
 platform: ruby
 authors:
 - InventList