rails-wayback 0.1.0 → 0.2.0

data/lib/rails_wayback/bar_middleware.rb

@@ -1,14 +1,34 @@
 # frozen_string_literal: true
 
 require "cgi"
+require "rails_wayback/asset_provenance"
 require "rails_wayback/bar_renderer"
+require "rails_wayback/engine_mount"
+require "rails_wayback/ref_policy"
 
 module RailsWayback
   # Rack middleware that appends the wayback bar to every successful
-  # HTML response of the host application while the gem is enabled.
-  # Skips assets, ActionCable, non-2xx responses and non-HTML bodies so
-  # it never touches anything but the developer-facing pages.
+  # or client-error HTML response of the host application while the gem
+  # is enabled. Only complete, bounded Rack-buffered documents are
+  # transformed; streaming and otherwise unsafe responses pass through.
   class BarMiddleware
+    UNSAFE_STATUSES = [204, 205, 206].freeze
+    UNSAFE_RESPONSE_HEADERS = %w[
+      transfer-encoding
+      content-range
+      rack.hijack
+      x-sendfile
+      x-accel-redirect
+    ].freeze
+    INVALIDATED_RESPONSE_HEADERS = %w[
+      etag
+      content-md5
+      digest
+      content-digest
+      repr-digest
+      content-range
+      accept-ranges
+    ].freeze
     SKIP_PATH_PREFIXES = %w[
       /assets
       /packs
@@ -22,60 +42,163 @@ module RailsWayback
     end
 
     def call(env)
-      # Always reset the per-request render tracker before invoking the
-      # app so the middleware can accurately report which templates the
-      # current page rendered. Cheap and thread-safe (Thread.current).
-      Thread.current[RailsWayback::RENDER_TRACKER_KEY] = []
+      tracker = RailsWayback::RenderTracker.new
+      RailsWayback::RenderContext.with(tracker) { call_with_tracker(env, tracker) }
+    ensure
+      tracker&.close
+    end
+
+    private
 
-      status, headers, body = @app.call(env)
-      return [status, headers, body] unless inject?(env, status, headers)
+    def call_with_tracker(env, tracker)
+      response = @app.call(env)
+      status, headers, body = response
+      return response unless inject?(env, status, headers, body)
 
-      html = read_body(body)
-      snippet = build_snippet(env)
-      new_html = inject(html, snippet)
+      parts = body.to_ary
+      return [status, headers, parts] unless body_within_limit?(parts)
+
+      html = parts.join
+      return [status, headers, parts] unless injectable_document?(html)
 
-      new_headers = headers.dup
-      length_key = new_headers.key?("Content-Length") ? "Content-Length" : (new_headers.key?("content-length") ? "content-length" : nil)
-      new_headers[length_key] = new_html.bytesize.to_s if length_key
+      snippet = build_snippet(env, tracker)
+      return [status, headers, parts] if snippet.empty?
 
-      [status, new_headers, [new_html]]
+      new_html = inject(html, snippet)
+      [status, repaired_headers(headers, new_html), [new_html]]
     end
 
-    private
+    def inject?(env, status, headers, body)
+      RailsWayback.enabled? &&
+        request_injectable?(env) &&
+        response_injectable?(status, headers) &&
+        body_injectable?(body, headers)
+    end
 
-    def inject?(env, status, headers)
-      return false unless RailsWayback.enabled?
-      return false unless status.to_i.between?(200, 299) || status.to_i.between?(400, 499)
+    def request_injectable?(env)
+      return false if env["REQUEST_METHOD"].to_s.casecmp?("HEAD")
 
       path = env["PATH_INFO"].to_s
-      return false if SKIP_PATH_PREFIXES.any? { |prefix| path.start_with?(prefix) }
+      SKIP_PATH_PREFIXES.none? { |prefix| path.start_with?(prefix) }
+    end
 
-      content_type = headers["Content-Type"] || headers["content-type"] || ""
-      return false unless content_type.include?("text/html")
+    def response_injectable?(status, headers)
+      injectable_status?(status) &&
+        html_response?(headers) &&
+        identity_encoded?(headers) &&
+        !attachment?(headers) &&
+        !no_transform?(headers)
+    end
 
-      true
+    def injectable_status?(status)
+      code = status.to_i
+      (code.between?(200, 299) || code.between?(400, 499)) && !UNSAFE_STATUSES.include?(code)
     end
 
-    def read_body(body)
-      buffer = +""
-      body.each { |chunk| buffer << chunk.to_s }
-      buffer
-    ensure
-      body.close if body.respond_to?(:close)
+    def body_injectable?(body, headers)
+      UNSAFE_RESPONSE_HEADERS.none? { |name| header_present?(headers, name) } &&
+        !body.respond_to?(:to_path) &&
+        body.respond_to?(:to_ary) &&
+        declared_body_within_limit?(headers)
+    end
+
+    def html_response?(headers)
+      media_type = header_value(headers, "content-type").to_s.split(";", 2).first
+      media_type.strip.casecmp?("text/html")
+    end
+
+    def identity_encoded?(headers)
+      value = header_value(headers, "content-encoding").to_s.strip
+      return true if value.empty?
+
+      value.split(",").all? { |encoding| encoding.strip.casecmp?("identity") }
+    end
+
+    def attachment?(headers)
+      header_value(headers, "content-disposition").to_s.match?(/\battachment\b/i)
+    end
+
+    def no_transform?(headers)
+      header_value(headers, "cache-control").to_s.match?(/\bno-transform\b/i)
+    end
+
+    def declared_body_within_limit?(headers)
+      length = integer_header(headers, "content-length")
+      return false if length&.zero?
+
+      limit = max_response_bytes
+      limit.nil? || length.nil? || length <= limit
+    end
+
+    def body_within_limit?(parts)
+      limit = max_response_bytes
+      limit.nil? || parts.sum(&:bytesize) <= limit
+    end
+
+    def max_response_bytes
+      value = RailsWayback.configuration.max_response_bytes
+      value.nil? ? nil : Integer(value)
+    end
+
+    def integer_header(headers, name)
+      value = header_value(headers, name)
+      value.nil? ? nil : Integer(value, 10)
+    rescue ArgumentError, TypeError
+      nil
+    end
+
+    def injectable_document?(html)
+      html.match?(/<body(?:\s|>)/i) &&
+        html.match?(%r{</body\s*>}i) &&
+        !html.match?(/\bid=(["'])rails-wayback-bar\1/i)
     end
 
     def inject(html, snippet)
-      if html.include?("</body>")
-        html.sub("</body>", "#{snippet}</body>")
-      else
-        html + snippet
-      end
+      html.sub(%r{</body\s*>}i) { |closing_tag| "#{snippet}#{closing_tag}" }
+    end
+
+    def repaired_headers(headers, html)
+      repaired = headers.dup
+      INVALIDATED_RESPONSE_HEADERS.each { |name| delete_header(repaired, name) }
+      set_header(repaired, "content-length", html.bytesize.to_s)
+      add_no_store(repaired)
+      repaired
     end
 
-    def build_snippet(env)
+    def add_no_store(headers)
+      current = header_value(headers, "cache-control").to_s
+      return if current.match?(/(?:\A|,)\s*no-store\s*(?:,|\z)/i)
+
+      set_header(headers, "cache-control", current.empty? ? "no-store" : "#{current}, no-store")
+    end
+
+    def header_present?(headers, name)
+      !header_key(headers, name).nil?
+    end
+
+    def header_value(headers, name)
+      key = header_key(headers, name)
+      key ? headers[key] : nil
+    end
+
+    def header_key(headers, name)
+      headers.keys.find { |key| key.to_s.casecmp?(name) }
+    end
+
+    def set_header(headers, name, value)
+      headers[header_key(headers, name) || name] = value
+    end
+
+    def delete_header(headers, name)
+      key = header_key(headers, name)
+      headers.delete(key) if key
+    end
+
+    def build_snippet(env, tracker)
       git = RailsWayback::Git.new
-      active_ref = extract_active_ref(env)
-      active_branch = active_ref ? active_branch_for(env, git, active_ref) : nil
+      selection = ref_selection(env)
+      active_ref = selection&.accepted? ? selection.sha : nil
+      active_branch = active_ref ? active_branch_for(env, git, selection) : nil
 
       renderer = BarRenderer.new(
         current_branch: safe(:current_branch, git),
@@ -83,7 +206,9 @@ module RailsWayback
         active_ref: active_ref,
         active_branch: active_branch,
         engine_mount: engine_mount,
-        diff_info: active_ref ? build_diff_info(git, active_ref) : nil
+        diff_info: active_ref ? build_diff_info(git, active_ref, tracker) : nil,
+        csp_nonce: content_security_policy_nonce(env),
+        ref_error: selection&.rejected? ? selection.message : nil
       )
       renderer.render
     rescue StandardError => e
@@ -97,38 +222,81 @@ module RailsWayback
       ""
     end
 
+    def content_security_policy_nonce(env)
+      return unless defined?(ActionDispatch::Request)
+
+      request = ActionDispatch::Request.new(env)
+      request.content_security_policy_nonce if request.respond_to?(:content_security_policy_nonce)
+    rescue StandardError
+      nil
+    end
+
     # Determines the branch label to show in the bar while traveling.
     # Prefers the branch the user explicitly picked in the bar (passed
     # via the `_wayback_branch` query param, so it survives the reload).
     # Falls back to inferring it from git — useful when a developer opens
     # a shared URL that only carries `_wayback_ref`.
-    def active_branch_for(env, git, ref)
+    def active_branch_for(env, git, selection)
       explicit = extract_active_branch(env)
-      return explicit if explicit && !explicit.empty?
+      explicit_ref = trusted_ref_for(explicit, selection.trusted_refs)
+      return reference_label(explicit_ref) if explicit_ref
+
+      inferred = git.resolve_branch_for(selection.sha)
+      inferred_ref = "refs/heads/#{inferred}"
+      return inferred if inferred && selection.trusted_refs.include?(inferred_ref)
 
-      git.resolve_branch_for(ref)
+      reference_label(selection.trusted_refs.first)
     rescue StandardError
       nil
     end
 
+    def trusted_ref_for(selector, trusted_refs)
+      return if selector.to_s.empty?
+      return selector if trusted_refs.include?(selector)
+
+      trusted_refs.find do |reference|
+        reference_name(reference) == selector || reference_label(reference) == selector
+      end
+    end
+
+    def reference_name(reference)
+      reference.to_s.sub(%r{\Arefs/(?:heads|tags|remotes)/}, "")
+    end
+
+    def reference_label(reference)
+      return if reference.to_s.empty?
+
+      name = reference_name(reference)
+      reference.start_with?("refs/tags/") ? "tag:#{name}" : name
+    end
+
     # Builds the diff summary shown in the bar when a ref is active.
     # `changed_files`: view/asset paths that differ between the ref and
     # the current working tree, always scoped to the paths the gem
-    # actually swaps. `rendered_from_ref`: relative paths (under
-    # app/views, app/components, ...) that the current request rendered
-    # from the sandbox. `matched`: intersection — the templates on this
-    # page that actually reflect a real diff between branches.
-    def build_diff_info(git, ref)
+    # actually swaps. Rendered paths are split by origin so the toolbar can
+    # warn when a successful page silently mixes historical templates with
+    # current-tree fallbacks.
+    def build_diff_info(git, ref, tracker)
       config = RailsWayback.configuration
       tracked_paths = (config.view_paths + config.asset_paths).uniq
       changed_files = git.diff_paths(ref, paths: tracked_paths)
 
-      rendered_from_ref = rendered_relative_paths(config)
+      rendered = RailsWayback::RenderProvenance.paths_by_origin(
+        tracker.entries,
+        configuration: config
+      )
+      rendered_from_ref = rendered[:historical]
+      rendered_from_current = rendered[:current]
+      assets = RailsWayback::AssetProvenance.paths_by_origin(tracker.entries)
       matched = changed_files & rendered_from_ref
 
       {
         changed_files: changed_files,
         rendered_from_ref: rendered_from_ref,
+        rendered_from_current: rendered_from_current,
+        historical_assets: assets[:historical],
+        current_asset_fallbacks: assets[:current],
+        preview_mode: preview_mode(rendered_from_ref, rendered_from_current),
         matched: matched
       }
     rescue StandardError => e
@@ -136,21 +304,12 @@ module RailsWayback
       nil
     end
 
-    def rendered_relative_paths(config)
-      tracker = Array(Thread.current[RailsWayback::RENDER_TRACKER_KEY])
-      return [] if tracker.empty?
+    def preview_mode(historical, current)
+      return :mixed if historical.any? && current.any?
+      return :historical if historical.any?
+      return :current_fallback if current.any?
 
-      sandbox_prefix = config.refs_cache_path.to_s
-      # Sandbox identifiers look like:
-      #   /.../tmp/rails_wayback/refs/<sha>/app/views/foo/_bar.html.haml
-      # Strip up to and including the sha directory to get back
-      # `app/views/foo/_bar.html.haml`, which matches `git diff --name-only`.
-      strip_re = %r{\A#{Regexp.escape(sandbox_prefix)}/[^/]+/}
-
-      tracker.filter_map do |identifier|
-        next unless identifier.start_with?(sandbox_prefix)
-        identifier.sub(strip_re, "")
-      end.uniq
+      :unknown
     end
 
     # Query params take priority (one-off overrides / shared links);
@@ -161,6 +320,17 @@ module RailsWayback
         extract_cookie(env, "rails_wayback_ref")
     end
 
+    def ref_selection(env)
+      return env[RailsWayback::RefPolicy::ENV_KEY] if env.key?(RailsWayback::RefPolicy::ENV_KEY)
+
+      ref = extract_active_ref(env)
+      return unless ref
+
+      RailsWayback::RefPolicy.new.authorize(ref).tap do |selection|
+        env[RailsWayback::RefPolicy::ENV_KEY] = selection
+      end
+    end
+
     def extract_active_branch(env)
       extract_query_param(env, "_wayback_branch") ||
         extract_cookie(env, "rails_wayback_branch")
@@ -169,6 +339,7 @@ module RailsWayback
     def extract_query_param(env, name)
       query = env["QUERY_STRING"].to_s
       return nil if query.empty?
+
       prefix = "#{name}="
       match = query.split("&").find { |pair| pair.start_with?(prefix) }
       return nil unless match
@@ -180,6 +351,7 @@ module RailsWayback
     def extract_cookie(env, name)
       header = env["HTTP_COOKIE"].to_s
       return nil if header.empty?
+
       prefix = "#{name}="
       match = header.split(/;\s*/).find { |pair| pair.start_with?(prefix) }
       return nil unless match
@@ -189,11 +361,7 @@ module RailsWayback
     end
 
     def engine_mount
-      RailsWayback::Engine.routes.default_url_options[:script_name] ||
-        RailsWayback::Engine.routes.find_script_name({}) ||
-        "/rails-wayback"
-    rescue StandardError
-      "/rails-wayback"
+      RailsWayback::EngineMount.path
     end
   end
 end

data/lib/rails_wayback/bar_renderer.css

@@ -0,0 +1,76 @@
+#rails-wayback-bar {
+  position: fixed; left: 0; right: 0; bottom: 0; z-index: 2147483000;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 12px; color: #e6e9ef;
+  background: rgba(15, 17, 21, 0.96);
+  border-top: 1px solid #2a2f3a;
+  box-shadow: 0 -8px 20px rgba(0,0,0,.35);
+}
+#rails-wayback-bar * { box-sizing: border-box; }
+#rails-wayback-bar .rw-bar-inner {
+  display: flex; align-items: end; gap: 12px; padding: 8px 12px;
+}
+#rails-wayback-bar .rw-field { display: flex; flex-direction: column; gap: 3px; min-width: 180px; }
+#rails-wayback-bar .rw-flex { flex: 1; }
+#rails-wayback-bar .rw-selector { display: flex; gap: 4px; }
+#rails-wayback-bar label {
+  color: #8a93a6; text-transform: uppercase; letter-spacing: .06em; font-size: 10px;
+}
+#rails-wayback-bar select,
+#rails-wayback-bar input[type="search"] {
+  background: #0b0d12; color: #e6e9ef;
+  border: 1px solid #2a2f3a; border-radius: 4px;
+  padding: 5px 8px; font-family: inherit; font-size: 12px; width: 100%;
+}
+#rails-wayback-bar input[type="search"] { flex: 0 1 150px; min-width: 90px; }
+#rails-wayback-bar select { flex: 1; min-width: 0; }
+#rails-wayback-bar select:focus-visible,
+#rails-wayback-bar input[type="search"]:focus-visible {
+  border-color: #6ea8fe; outline: 2px solid rgba(110, 168, 254, .35); outline-offset: 1px;
+}
+#rails-wayback-bar input[type="search"][aria-invalid="true"] { border-color: #ff7b72; }
+#rails-wayback-bar select:disabled,
+#rails-wayback-bar input[type="search"]:disabled { opacity: .55; }
+#rails-wayback-bar .rw-search-status { color: #8a93a6; font-size: 9px; min-height: 10px; }
+#rails-wayback-bar .rw-state { color: #8a93a6; font-size: 11px; margin: 0 4px; }
+#rails-wayback-bar .rw-state.rw-active { color: #ffd479; }
+#rails-wayback-bar .rw-btn {
+  border: 0; border-radius: 4px; padding: 8px 14px; cursor: pointer;
+  font-family: inherit; font-size: 12px; font-weight: 600;
+}
+#rails-wayback-bar .rw-btn-primary { background: #6ea8fe; color: #0b0d12; }
+#rails-wayback-bar .rw-btn-ghost { background: transparent; color: #8a93a6; border: 1px solid #2a2f3a; }
+#rails-wayback-bar .rw-btn:disabled { opacity: .5; cursor: not-allowed; }
+#rails-wayback-bar .rw-trust-notice {
+  border-top: 1px solid #2a2f3a; padding: 5px 12px;
+  color: #ffb86b; font-size: 10px;
+}
+#rails-wayback-bar .rw-ref-rejected { margin-left: 8px; color: #ff7b72; }
+#rails-wayback-bar .rw-diff {
+  border-top: 1px solid #2a2f3a;
+  padding: 6px 12px; font-size: 11px; color: #8a93a6;
+  display: flex; align-items: center; gap: 10px; flex-wrap: wrap;
+}
+#rails-wayback-bar .rw-diff-match .rw-diff-msg { color: #7ee787; }
+#rails-wayback-bar .rw-diff-miss .rw-diff-msg { color: #ffd479; }
+#rails-wayback-bar .rw-diff-neutral .rw-diff-msg { color: #8a93a6; }
+#rails-wayback-bar .rw-provenance { font-weight: 600; }
+#rails-wayback-bar .rw-provenance-historical { color: #7ee787; }
+#rails-wayback-bar .rw-provenance-mixed,
+#rails-wayback-bar .rw-provenance-current { color: #ffb86b; }
+#rails-wayback-bar .rw-diff-details { color: #8a93a6; }
+#rails-wayback-bar .rw-diff-details summary {
+  cursor: pointer; user-select: none;
+}
+#rails-wayback-bar .rw-diff-details[open] {
+  flex-basis: 100%;
+}
+#rails-wayback-bar .rw-diff-details ul {
+  margin: 6px 0 0; padding: 6px 10px; list-style: none;
+  background: #0b0d12; border: 1px solid #2a2f3a; border-radius: 4px;
+  max-height: 200px; overflow: auto;
+  font-family: inherit; font-size: 11px;
+}
+#rails-wayback-bar .rw-diff-details li { padding: 2px 0; color: #c8cfdc; }
+body { padding-bottom: 96px !important; }
+body:has(#rails-wayback-bar .rw-diff) { padding-bottom: 128px !important; }

data/lib/rails_wayback/bar_renderer.html.erb

@@ -0,0 +1,43 @@
+<link rel="stylesheet" href="<%= escape(stylesheet_url) %>" data-rails-wayback<%= nonce_attribute %>>
+<div id="rails-wayback-bar" data-mount="<%= escape(@engine_mount) %>"
+     data-branch="<%= escape(@current_branch) %>"
+     data-commit="<%= escape(@current_commit) %>"
+     data-active-ref="<%= escape(@active_ref.to_s) %>"
+     data-active-branch="<%= escape(@active_branch.to_s) %>"
+     data-ref-error="<%= escape(@ref_error) %>"
+     data-preview-mode="<%= escape(@diff_info&.dig(:preview_mode).to_s) %>">
+  <div class="rw-bar-inner">
+    <div class="rw-field">
+      <label for="rails-wayback-branches"><%= escape(branch_label) %></label>
+      <div class="rw-selector">
+        <input type="search" data-rw-branch-search aria-label="Search Git refs"
+               aria-controls="rails-wayback-branches" placeholder="Search refs"
+               autocomplete="off" spellcheck="false" disabled>
+        <select id="rails-wayback-branches" data-rw-branch aria-label="Git ref" disabled></select>
+      </div>
+      <span class="rw-search-status" data-rw-branch-results role="status" aria-live="polite"></span>
+    </div>
+    <div class="rw-field rw-flex">
+      <label for="rails-wayback-commits"><%= escape(commit_label) %></label>
+      <div class="rw-selector">
+        <input type="search" data-rw-commit-search aria-label="Search commits"
+               aria-controls="rails-wayback-commits" placeholder="Search commits"
+               autocomplete="off" spellcheck="false" disabled>
+        <select id="rails-wayback-commits" data-rw-commit aria-label="Git commit" disabled></select>
+      </div>
+      <span class="rw-search-status" data-rw-commit-results role="status" aria-live="polite"></span>
+    </div>
+    <div class="rw-state" data-rw-state></div>
+    <button type="button" data-rw-travel class="rw-btn rw-btn-primary">Travel</button>
+    <button type="button" data-rw-reset class="rw-btn rw-btn-ghost" hidden>Return to HEAD</button>
+  </div>
+  <div class="rw-trust-notice" data-rw-trust-notice>
+    Historical templates execute Ruby in this process. Only travel to commits you trust.
+    Historical JavaScript executes in this application's browser origin.
+    <% unless @ref_error.empty? %>
+      <strong class="rw-ref-rejected"><%= escape(@ref_error) %></strong>
+    <% end %>
+  </div>
+  <%= diff_summary_html %>
+</div>
+<script src="<%= escape(javascript_url) %>" defer data-rails-wayback<%= nonce_attribute %>></script>