rails_onboarding 0.8.13 → 0.8.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 593e5e47988a8b3f81d6ea034f186669a099d98b09707723ed723128bcdad01d
-  data.tar.gz: 790f85934b3f9573cc6421488b882fcf3ac80340e27a0b6b587cc2de93bcdcab
+  metadata.gz: df859b74947576d40a44a8a6ce1e37ceb1c9b92297875ac06faa3926f19489cc
+  data.tar.gz: 360a0d59bece71c30df19f549bea51cba322b7d0abf0e657d2e77d8b4b9e9d3b
 SHA512:
-  metadata.gz: f9bc4b4bd26ace6d84e153b906a0b687035e6d0ccb1b81d13ed15f6219bcc1e7be6c02ae30aa85658fc3c79933c5a7c374243bdffc9bf0197b923172ce1c2a36
-  data.tar.gz: 1d1bed61cc8462db8e23fe1e92a114d7df9be93cc7254e6f0cecfe8d56a8fcae765ffe072769c768044f5315795510c0c9533339f9835ac57fc48213a6f83e77
+  metadata.gz: 0fce05257f5c3f4af31cd191dc961ea151e2b753988758e53315e9914f6db67d4d22f1759ae81562b60b8bbe177a2cd3b59ddeb0f840f42ff46b0834f32b63fe
+  data.tar.gz: 83404bc6ac100510474a792a1ff245dbb09f53166df47325117b4f3551cacdeca9bf60dc54550d6c07794c8f371a93f9c2779dc1c48d6d1ffae01d0c4a9ef16e

data/app/assets/stylesheets/rails_onboarding/flash_messages.css

@@ -8,6 +8,9 @@
   max-width: 500px;
   width: 100%;
   pointer-events: none;
+  /* Outside .onboarding-container, which is where the engine sets its font, so it would otherwise
+     take the browser's serif default. */
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
 }
 
 .onboarding-flash {
@@ -29,25 +32,46 @@
   box-shadow: 0 6px 16px rgba(0, 0, 0, 0.2);
 }
 
-/* Flash types */
+/* Each message is an open <dialog> (see shared/_flash), so it closes without JavaScript. Undo
+   what the browser gives a dialog - centred, absolutely placed, bordered all round - leaving the
+   coloured left border from the type rules below. */
+dialog.onboarding-flash {
+  inset: auto;
+  margin: 0 0 12px;
+  width: auto;
+  max-width: none;
+  max-height: none;
+  border-top: 0;
+  border-right: 0;
+  border-bottom: 0;
+}
+
+/* The close form is only there for method="dialog"; its button is the flex item. */
+.onboarding-flash form {
+  display: contents;
+}
+
+/* Flash types. Each pair is at least 4.5:1 (WCAG AA): white on the 500-weight greens, ambers and
+   reds these used was 2-4:1, unreadable on amber in particular. Amber keeps its colour and takes
+   dark text instead. */
 .flash-notice,
 .flash-success {
-  background-color: #10b981;
+  background-color: #047857;
   color: white;
-  border-left: 4px solid #059669;
+  border-left: 4px solid #065f46;
 }
 
 .flash-alert,
 .flash-warning {
   background-color: #f59e0b;
-  color: white;
-  border-left: 4px solid #d97706;
+  color: #451a03;
+  border-left: 4px solid #b45309;
 }
 
 .flash-error {
-  background-color: #ef4444;
+  background-color: #b91c1c;
   color: white;
-  border-left: 4px solid #dc2626;
+  border-left: 4px solid #7f1d1d;
 }
 
 .flash-info {
@@ -152,6 +176,9 @@
     right: 10px;
     left: 10px;
     max-width: none;
+    /* Not 100%: with both left and right set, a width overrides right, and the message ran 10px
+       off the screen. */
+    width: auto;
   }
 
   .onboarding-flash {

data/app/models/concerns/rails_onboarding/ab_testable.rb

@@ -26,7 +26,14 @@ module RailsOnboarding
     included do
       # Store A/B test assignments as JSON
       # Expected column: ab_test_assignments (jsonb or text)
-      serialize :ab_test_assignments, coder: JSON unless column_names.include?("ab_test_assignments") && columns_hash["ab_test_assignments"].type == :jsonb
+      # column_names and columns_hash both query the database, and this runs
+      # when the host model is loaded -- possibly before the table exists.
+      # See RailsOnboarding::SchemaGuard.
+      if RailsOnboarding::SchemaGuard.columns_queryable?(self)
+        unless column_names.include?("ab_test_assignments") && columns_hash["ab_test_assignments"].type == :jsonb
+          serialize :ab_test_assignments, coder: JSON
+        end
+      end
 
       # Callbacks
       after_initialize :assign_ab_test_variants, if: :new_record?

data/app/models/concerns/rails_onboarding/onboardable.rb

@@ -7,43 +7,10 @@ module RailsOnboarding
     MAX_MILESTONES_ACHIEVED = 500
     MAX_JSON_SIZE_BYTES = 65_535 # ~64KB for TEXT columns
 
-    # Whether the host model's table can be inspected right now.
-    #
-    # `columns_hash` and `column_names` both query the database, and the
-    # `included do` block below runs the moment the host model is loaded --
-    # which can be long before that table exists. A host that references its
-    # user model from an initializer hits this immediately: the common OmniAuth
-    # `:identity` setup passes `model: User`, so the model loads during boot,
-    # the include queries `columns_hash`, and against an empty database the
-    # whole process dies with "Table 'users' doesn't exist".
-    #
-    # That is circular and unrecoverable: loading the schema requires booting
-    # the app, and booting the app requires the schema. It stops `db:prepare`
-    # bootstrapping a genuinely new database, a restore into an empty schema,
-    # and CI against a fresh database service.
-    #
-    # A missing table, a missing database and an absent connection all mean the
-    # same thing here -- the column types cannot be known yet -- so degrade
-    # instead of raising. Nothing is lost: a process that boots against an empty
-    # database is bootstrapping it, not serving from it, and the next process
-    # configures everything normally once the schema is in place.
-    #
-    # Only ever answers false when the table is positively known to be absent.
-    # This concern is deliberately includable into plain classes that are not
-    # ActiveRecord models -- hence the `respond_to?(:has_many)` and
-    # `respond_to?(:validate)` guards below -- and such a class has no
-    # `table_exists?` while still answering `columns_hash`. Saying "not
-    # available" for those would silently stop configuring them, so anything
-    # that cannot be asked is treated as queryable and left to the callers'
-    # own guards, exactly as before this check existed.
+    # Whether the host model's columns can be read yet. See
+    # RailsOnboarding::SchemaGuard, which three concerns share.
     def self.columns_queryable?(model)
-      return true unless model.respond_to?(:table_exists?)
-
-      model.table_exists?
-    rescue ActiveRecord::NoDatabaseError,
-           ActiveRecord::ConnectionNotEstablished,
-           ActiveRecord::StatementInvalid
-      false
+      SchemaGuard.columns_queryable?(model)
     end
 
     included do
@@ -62,8 +29,8 @@ module RailsOnboarding
 
       # Fix for Rails 8: Use the new serialize syntax.
       # Guarded because columns_hash queries the database -- see
-      # Onboardable.columns_queryable? above.
-      if RailsOnboarding::Onboardable.columns_queryable?(self)
+      # RailsOnboarding::SchemaGuard.
+      if RailsOnboarding::SchemaGuard.columns_queryable?(self)
         if columns_hash["feature_tooltips_shown"]&.type == :text
           serialize :feature_tooltips_shown, coder: JSON
         end
@@ -99,7 +66,7 @@ module RailsOnboarding
       # than raising on a column that isn't there.
       def onboarding_replay_supported?
         return false unless respond_to?(:column_names)
-        return false unless RailsOnboarding::Onboardable.columns_queryable?(self)
+        return false unless RailsOnboarding::SchemaGuard.columns_queryable?(self)
 
         column_names.include?("onboarding_replay_started_at") &&
           column_names.include?("onboarding_replay_steps")
@@ -763,8 +730,18 @@ module RailsOnboarding
       { onboarding_replay_started_at: nil, onboarding_replay_steps: [] }
     end
 
+    # column_names queries the database like the rest, so it takes the same
+    # guard -- but purely for symmetry: this one cannot actually be reached
+    # with the table missing. It is an instance method, and ActiveRecord cannot
+    # instantiate a model whose table is absent (`new` raises while building
+    # attribute types), so the guard can never fire. Kept so every column query
+    # in this file reads the same way, and it costs nothing: table_exists?
+    # reads the schema cache.
     def onboarding_column?(name)
-      self.class.respond_to?(:column_names) && self.class.column_names.include?(name)
+      return false unless self.class.respond_to?(:column_names)
+      return false unless RailsOnboarding::SchemaGuard.columns_queryable?(self.class)
+
+      self.class.column_names.include?(name)
     end
 
     def persist_and_track!(attributes = nil)

data/app/models/concerns/rails_onboarding/progressive_disclosure.rb

@@ -36,7 +36,14 @@ module RailsOnboarding
     included do
       # Store revealed features as JSON
       # Expected column: revealed_features (jsonb or text)
-      serialize :revealed_features, coder: JSON unless column_names.include?("revealed_features") && columns_hash["revealed_features"].type == :jsonb
+      # column_names and columns_hash both query the database, and this runs
+      # when the host model is loaded -- possibly before the table exists.
+      # See RailsOnboarding::SchemaGuard.
+      if RailsOnboarding::SchemaGuard.columns_queryable?(self)
+        unless column_names.include?("revealed_features") && columns_hash["revealed_features"].type == :jsonb
+          serialize :revealed_features, coder: JSON
+        end
+      end
 
       # Callback to check and reveal features
       after_save :check_progressive_features, if: :saved_change_to_onboarding_current_step?

data/app/models/concerns/rails_onboarding/schema_guard.rb

@@ -0,0 +1,38 @@
+module RailsOnboarding
+  # Whether a host model's columns can be read yet.
+  #
+  # Three concerns inspect columns the moment they are included -- to decide
+  # whether to configure JSON serialization -- and `columns_hash` and
+  # `column_names` both query the database. That runs when the host model is
+  # loaded, which can be long before the table exists.
+  #
+  # A host that references its user model from an initializer hits this
+  # immediately. The common OmniAuth `:identity` setup passes `model: User`, so
+  # the model loads during boot and the process dies with
+  # `Table 'users' doesn't exist`. That is circular and unrecoverable: loading
+  # the schema requires booting the app, and booting the app requires the
+  # schema. It stops `db:prepare` bootstrapping a genuinely new database, a
+  # restore into an empty schema, and CI against a fresh database service.
+  module SchemaGuard
+    module_function
+
+    # Only ever answers false when the table is positively known to be absent.
+    #
+    # These concerns are deliberately includable into plain classes that are not
+    # ActiveRecord models -- hence the `respond_to?(:has_many)` and
+    # `respond_to?(:validate)` guards in Onboardable -- and such a class answers
+    # `columns_hash` while having no `table_exists?`. Vetoing those would
+    # silently stop configuring them, so anything that cannot be asked is
+    # treated as queryable and left to the callers' own guards, exactly as
+    # before this check existed.
+    def columns_queryable?(model)
+      return true unless model.respond_to?(:table_exists?)
+
+      model.table_exists?
+    rescue ActiveRecord::NoDatabaseError,
+           ActiveRecord::ConnectionNotEstablished,
+           ActiveRecord::StatementInvalid
+      false
+    end
+  end
+end

data/app/views/layouts/rails_onboarding/application.html.erb

@@ -51,6 +51,11 @@
 </head>
 <body>
 
+<%# Without this, a message on the way to onboarding was lost: a host's redirect_to with an alert,
+    the engine's own redirect_to onboarding_path, alert:, and the Turbo Stream errors, which replace
+    #flash-messages and found nothing to replace. Fixed-position, so it sits over the page. %>
+<%= render "rails_onboarding/shared/flash" %>
+
 <%# .onboarding-container/.onboarding-content provide the page-level
     min-height/centering/responsive padding that the stylesheets (see
     application.css and mobile.css) already define for every onboarding

data/app/views/rails_onboarding/shared/_flash.html.erb

@@ -1,25 +1,26 @@
-<div id="flash-messages" class="flash-container">
-  <% if defined?(notice) && notice %>
-    <div class="onboarding-flash flash-notice" role="alert">
-      <span class="flash-icon">✓</span>
-      <span class="flash-message"><%= notice %></span>
-      <button class="flash-close" onclick="this.parentElement.remove()" aria-label="Dismiss">×</button>
-    </div>
-  <% end %>
+<%# The flash, on every page of the engine layout, and the target the onboarding controller's
+    Turbo Stream errors replace (#flash-messages). Each message comes from a local when one is
+    given - those streams pass the message they want shown - and from the flash otherwise.
 
-  <% if defined?(alert) && alert %>
-    <div class="onboarding-flash flash-alert" role="alert">
-      <span class="flash-icon">⚠</span>
-      <span class="flash-message"><%= alert %></span>
-      <button class="flash-close" onclick="this.parentElement.remove()" aria-label="Dismiss">×</button>
-    </div>
-  <% end %>
-
-  <% if defined?(error) && error %>
-    <div class="onboarding-flash flash-error" role="alert">
-      <span class="flash-icon">✕</span>
-      <span class="flash-message"><%= error %></span>
-      <button class="flash-close" onclick="this.parentElement.remove()" aria-label="Dismiss">×</button>
-    </div>
+    Each message is an open <dialog> closed by a form with method="dialog", which the browser
+    handles itself: no JavaScript, so nothing for a strict Content Security Policy to refuse. The
+    close buttons were onclick= attributes, which such a policy blocks without a word. Turbo
+    leaves method="dialog" forms alone. %>
+<% messages = {
+     notice: local_assigns.fetch(:notice) { flash[:notice] },
+     alert: local_assigns.fetch(:alert) { flash[:alert] },
+     error: local_assigns.fetch(:error) { flash[:error] }
+   } %>
+<% icons = { notice: "✓", alert: "⚠", error: "✕" } %>
+<div id="flash-messages" class="flash-container">
+  <% messages.each do |type, message| %>
+    <% next if message.blank? %>
+    <dialog open class="onboarding-flash flash-<%= type %>">
+      <span class="flash-icon" aria-hidden="true"><%= icons[type] %></span>
+      <span class="flash-message" role="alert"><%= message %></span>
+      <form method="dialog">
+        <button class="flash-close" aria-label="Dismiss">×</button>
+      </form>
+    </dialog>
   <% end %>
 </div>

data/lib/rails_onboarding/version.rb

@@ -1,3 +1,3 @@
 module RailsOnboarding
-  VERSION = "0.8.13"
+  VERSION = "0.8.15"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_onboarding
 version: !ruby/object:Gem::Version
-  version: 0.8.13
+  version: 0.8.15
 platform: ruby
 authors:
 - David Lewis
@@ -183,6 +183,7 @@ files:
 - app/models/concerns/rails_onboarding/onboardable.rb
 - app/models/concerns/rails_onboarding/personalizable.rb
 - app/models/concerns/rails_onboarding/progressive_disclosure.rb
+- app/models/concerns/rails_onboarding/schema_guard.rb
 - app/models/rails_onboarding/analytics.rb
 - app/models/rails_onboarding/analytics_event.rb
 - app/models/rails_onboarding/application_record.rb
@@ -282,7 +283,7 @@ licenses:
 metadata:
   allowed_push_host: https://rubygems.org
   homepage_uri: https://github.com/bunnahabhain/rails_onboarding
-  source_code_uri: https://github.com/bunnahabhain/rails_onboarding/tree/v0.8.13
+  source_code_uri: https://github.com/bunnahabhain/rails_onboarding/tree/v0.8.15
   changelog_uri: https://github.com/bunnahabhain/rails_onboarding/blob/master/docs/CHANGELOG.md
 rdoc_options: []
 require_paths:
@@ -298,7 +299,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.19
+rubygems_version: 4.0.22
 specification_version: 4
 summary: Flexible onboarding engine for Rails applications
 test_files: []