rails_pulse 0.2.4 → 0.2.5.pre.pre.2

data/app/controllers/rails_pulse/application_controller.rb

@@ -1,6 +1,6 @@
 module RailsPulse
   class ApplicationController < ActionController::Base
-    # Support both Pagy 8.x (Backend) and Pagy 9+ (Method)
+    # Support both Pagy 8.x (Backend) and Pagy 43+ (Method)
     if defined?(Pagy::Method)
       include Pagy::Method
     else
@@ -152,5 +152,15 @@ module RailsPulse
     def set_show_non_tagged_default
       session[:show_non_tagged] = true if session[:show_non_tagged].nil?
     end
+
+    # Returns Pagy options hash with correct parameter name for current version
+    # Pagy 8.x uses 'items:', Pagy 43+ uses 'limit:'
+    def pagy_options(count)
+      if defined?(Pagy::Method)
+        { limit: count }  # Pagy 43+
+      else
+        { items: count }  # Pagy 8.x
+      end
+    end
   end
 end

data/app/controllers/rails_pulse/assets_controller.rb

@@ -4,11 +4,17 @@ module RailsPulse
 
     def show
       asset_name = params[:asset_name]
-      asset_path = Rails.root.join("public", "rails-pulse-assets", asset_name)
+
+      # Prevent path traversal attacks by validating asset name
+      return head :not_found unless valid_asset_name?(asset_name)
+
+      # Use sanitized asset name to build path
+      sanitized_name = File.basename(asset_name)
+      asset_path = Rails.root.join("public", "rails-pulse-assets", sanitized_name)
 
       # Fallback to engine assets if not found in host app
       unless File.exist?(asset_path)
-        asset_path = RailsPulse::Engine.root.join("public", "rails-pulse-assets", asset_name)
+        asset_path = RailsPulse::Engine.root.join("public", "rails-pulse-assets", sanitized_name)
       end
 
       if File.exist?(asset_path)
@@ -29,5 +35,15 @@ module RailsPulse
         head :not_found
       end
     end
+
+    private
+
+    def valid_asset_name?(name)
+      return false if name.blank?
+      return false if name.include?("..")
+      return false if name.include?("/")
+      return false if name.include?("\\")
+      true
+    end
   end
 end

data/app/controllers/rails_pulse/job_runs_controller.rb

@@ -0,0 +1,37 @@
+module RailsPulse
+  class JobRunsController < ApplicationController
+    include TagFilterConcern
+
+    before_action :set_job
+    before_action :set_run, only: :show
+
+    def index
+      @ransack_query = @job.runs.ransack(params[:q])
+      @pagy, @runs = pagy(@ransack_query.result.order(occurred_at: :desc), **pagy_options(session_pagination_limit))
+      @table_data = @runs
+    end
+
+    def show
+      @operations = @run.operations.order(:start_time)
+      @operation_timeline = RailsPulse::Charts::OperationsChart.new(@operations)
+
+      # Group operations by type
+      @operations_by_type = @operations.group_by(&:operation_type)
+
+      # SQL queries
+      @sql_operations = @operations.where(operation_type: "sql")
+                                   .includes(:query)
+                                   .order(duration: :desc)
+    end
+
+    private
+
+    def set_job
+      @job = RailsPulse::Job.find(params[:job_id])
+    end
+
+    def set_run
+      @run = @job.runs.find(params[:id])
+    end
+  end
+end

data/app/controllers/rails_pulse/jobs_controller.rb

@@ -0,0 +1,80 @@
+module RailsPulse
+  class JobsController < ApplicationController
+    include TagFilterConcern
+    include TimeRangeConcern
+
+    # Override TIME_RANGE_OPTIONS from TimeRangeConcern
+    remove_const(:TIME_RANGE_OPTIONS) if const_defined?(:TIME_RANGE_OPTIONS)
+    TIME_RANGE_OPTIONS = [
+      [ "Recent", "recent" ],
+      [ "Custom Range", "custom" ]
+    ].freeze
+
+    before_action :set_job, only: :show
+
+    def index
+      setup_metric_cards
+
+      @ransack_query = RailsPulse::Job.ransack(params[:q])
+
+      # Apply tag filters from session
+      base_query = apply_tag_filters(@ransack_query.result)
+
+      @pagy, @jobs = pagy(base_query.order(runs_count: :desc),
+                          **pagy_options(session_pagination_limit),
+                          overflow: :last_page)
+      @table_data = @jobs
+      @available_queues = RailsPulse::Job.distinct.pluck(:queue_name).compact.sort
+    end
+
+    def show
+      setup_metric_cards
+
+      ransack_params = params[:q] || {}
+
+      # Check if user explicitly selected a time range
+      time_mode = params.dig(:q, :period_start_range) || "recent"
+
+      # Apply time range filter only if custom mode is selected
+      if time_mode == "custom"
+        # Get time range from TimeRangeConcern which parses custom_date_range
+        @start_time, @end_time, @selected_time_range, @time_diff_hours = setup_time_range
+
+        # Apply time filters using parsed times from concern
+        ransack_params = ransack_params.merge(
+          occurred_at_gteq: Time.at(@start_time),
+          occurred_at_lteq: Time.at(@end_time)
+        )
+      else
+        # Recent mode - no time filters, just rely on sort + pagination
+        @selected_time_range = "recent"
+      end
+
+      @ransack_query = @job.runs.ransack(ransack_params)
+      @ransack_query.sorts = "occurred_at desc" if @ransack_query.sorts.empty?
+
+      # Apply tag filters from session
+      base_query = apply_tag_filters(@ransack_query.result)
+
+      @pagy, @recent_runs = pagy(base_query,
+                                  **pagy_options(session_pagination_limit),
+                                  overflow: :last_page)
+      @table_data = @recent_runs
+    end
+
+    private
+
+    def set_job
+      @job = RailsPulse::Job.find(params[:id])
+    end
+
+    def setup_metric_cards
+      return if turbo_frame_request?
+
+      # Pass the job to scope the cards to the current job on the show page
+      @total_runs_metric_card = RailsPulse::Jobs::Cards::TotalRuns.new(job: @job).to_metric_card
+      @failure_rate_metric_card = RailsPulse::Jobs::Cards::FailureRate.new(job: @job).to_metric_card
+      @average_duration_metric_card = RailsPulse::Jobs::Cards::AverageDuration.new(job: @job).to_metric_card
+    end
+  end
+end

data/app/controllers/rails_pulse/operations_controller.rb

@@ -4,6 +4,8 @@ module RailsPulse
 
     def show
       @request = @operation.request
+      @job_run = @operation.job_run
+      @parent = @request || @job_run
       @related_operations = find_related_operations
       @performance_context = calculate_performance_context
       @optimization_suggestions = generate_optimization_suggestions
@@ -20,22 +22,24 @@ module RailsPulse
     end
 
     def find_related_operations
+      return [] unless @parent
+
       case @operation.operation_type
       when "sql"
-        # Find other SQL operations in the same request with similar queries
-        @operation.request.operations
+        # Find other SQL operations in the same request/job run with similar queries
+        @parent.operations
           .where(operation_type: [ "sql" ])
           .where.not(id: @operation.id)
           .limit(5)
       when "template", "partial", "layout", "collection"
-        # Find other view operations in the same request
-        @operation.request.operations
+        # Find other view operations in the same request/job run
+        @parent.operations
           .where(operation_type: [ "template", "partial", "layout", "collection" ])
           .where.not(id: @operation.id)
           .limit(5)
       else
-        # Find operations of the same type in the same request
-        @operation.request.operations
+        # Find operations of the same type in the same request/job run
+        @parent.operations
           .where(operation_type: @operation.operation_type)
           .where.not(id: @operation.id)
           .limit(5)
@@ -117,19 +121,25 @@ module RailsPulse
       end
 
       # Check for potential N+1 queries
-      similar_queries = @operation.request.operations
-        .where(operation_type: [ "sql" ])
-        .where("label LIKE ?", "%#{@operation.label.split.first(3).join(' ')}%")
-        .where.not(id: @operation.id)
+      if @parent
+        # Sanitize LIKE pattern to prevent SQL injection via wildcards
+        label_prefix = @operation.label.split.first(3).join(" ")
+        sanitized_pattern = ActiveRecord::Base.sanitize_sql_like(label_prefix, "\\")
 
-      if similar_queries.count > 2
-        suggestions << {
-          type: "n_plus_one",
-          icon: "alert-triangle",
-          title: "Potential N+1 Query",
-          description: "#{similar_queries.count + 1} similar queries detected. Consider using includes() or joins().",
-          priority: "high"
-        }
+        similar_queries = @parent.operations
+          .where(operation_type: [ "sql" ])
+          .where("label LIKE ?", "%#{sanitized_pattern}%")
+          .where.not(id: @operation.id)
+
+        if similar_queries.count > 2
+          suggestions << {
+            type: "n_plus_one",
+            icon: "alert-triangle",
+            title: "Potential N+1 Query",
+            description: "#{similar_queries.count + 1} similar queries detected. Consider using includes() or joins().",
+            priority: "high"
+          }
+        end
       end
 
       suggestions
@@ -149,20 +159,22 @@ module RailsPulse
       end
 
       # Check for database queries in views
-      view_db_operations = @operation.request.operations
-        .where(operation_type: [ "sql" ])
-        .where("occurred_at >= ? AND occurred_at <= ?",
-               @operation.occurred_at,
-               @operation.occurred_at + @operation.duration)
+      if @parent
+        view_db_operations = @parent.operations
+          .where(operation_type: [ "sql" ])
+          .where("occurred_at >= ? AND occurred_at <= ?",
+                 @operation.occurred_at,
+                 @operation.occurred_at + @operation.duration)
 
-      if view_db_operations.count > 0
-        suggestions << {
-          type: "database",
-          icon: "database",
-          title: "Database Queries in View",
-          description: "#{view_db_operations.count} database queries during view rendering. Move data fetching to the controller.",
-          priority: "medium"
-        }
+        if view_db_operations.count > 0
+          suggestions << {
+            type: "database",
+            icon: "database",
+            title: "Database Queries in View",
+            description: "#{view_db_operations.count} database queries during view rendering. Move data fetching to the controller.",
+            priority: "medium"
+          }
+        end
       end
 
       suggestions

data/app/controllers/rails_pulse/queries_controller.rb

@@ -163,7 +163,7 @@ module RailsPulse
       table_results = build_table_results
       handle_pagination
 
-      @pagy, @table_data = pagy(table_results, items: session_pagination_limit)
+      @pagy, @table_data = pagy(table_results, **pagy_options(session_pagination_limit))
     end
 
     def handle_pagination

data/app/controllers/rails_pulse/requests_controller.rb

@@ -18,7 +18,7 @@ module RailsPulse
     end
 
     def show
-      @operation_timeline = RailsPulse::Requests::Charts::OperationsChart.new(@request.operations)
+      @operation_timeline = RailsPulse::Charts::OperationsChart.new(@request.operations)
     end
 
     private
@@ -118,18 +118,12 @@ module RailsPulse
     def setup_table_data(ransack_params)
       table_ransack_params = build_table_ransack_params(ransack_params)
       @ransack_query = table_model.ransack(table_ransack_params)
-
-      # Only apply default sort if not using Requests::Tables::Index (which handles its own sorting)
-      # For requests, we always use the Tables::Index on the index action
-      unless action_name == "index"
-        @ransack_query.sorts = default_table_sort if @ransack_query.sorts.empty?
-      end
+      @ransack_query.sorts = default_table_sort if @ransack_query.sorts.empty?
 
       table_results = build_table_results
       handle_pagination
 
-      # Use 'items:' for Pagy 8.x compatibility ('limit:' is for Pagy 43+)
-      @pagy, @table_data = pagy(table_results, items: session_pagination_limit)
+      @pagy, @table_data = pagy(table_results, **pagy_options(session_pagination_limit))
     end
 
     def handle_pagination

data/app/controllers/rails_pulse/routes_controller.rb

@@ -142,7 +142,7 @@ module RailsPulse
       table_results = build_table_results
       handle_pagination
 
-      @pagy, @table_data = pagy(table_results, items: session_pagination_limit)
+      @pagy, @table_data = pagy(table_results, **pagy_options(session_pagination_limit))
     end
 
     def handle_pagination

data/app/controllers/rails_pulse/tags_controller.rb

@@ -2,17 +2,26 @@ module RailsPulse
   class TagsController < ApplicationController
     before_action :set_taggable
 
+    # Tag validation rules
+    TAG_NAME_REGEX = /\A[a-z0-9_-]+\z/i
+    MAX_TAG_LENGTH = 50
+
     def create
       tag = params[:tag]
 
-      if tag.blank?
-        render turbo_stream: turbo_stream.replace("tag_manager_#{@taggable.class.name.demodulize.underscore}_#{@taggable.id}",
-          partial: "rails_pulse/tags/tag_manager",
-          locals: { taggable: @taggable, error: "Tag cannot be blank" })
+      # Validate tag name
+      error_message = validate_tag(tag)
+      if error_message
+        render_error(error_message)
+        return
+      end
+
+      # Add tag to taggable
+      unless @taggable.add_tag(tag)
+        render_error("Failed to add tag")
         return
       end
 
-      @taggable.add_tag(tag)
       @taggable.reload
 
       render turbo_stream: turbo_stream.replace("tag_manager_#{@taggable.class.name.demodulize.underscore}_#{@taggable.id}",
@@ -32,6 +41,19 @@ module RailsPulse
 
     private
 
+    def validate_tag(tag)
+      return "Tag cannot be blank" if tag.blank?
+      return "Tag must be #{MAX_TAG_LENGTH} characters or less" if tag.length > MAX_TAG_LENGTH
+      return "Tag can only contain letters, numbers, hyphens, and underscores" unless tag.match?(TAG_NAME_REGEX)
+      nil
+    end
+
+    def render_error(message)
+      render turbo_stream: turbo_stream.replace("tag_manager_#{@taggable.class.name.demodulize.underscore}_#{@taggable.id}",
+        partial: "rails_pulse/tags/tag_manager",
+        locals: { taggable: @taggable, error: message })
+    end
+
     def set_taggable
       @taggable_type = params[:taggable_type]
       @taggable_id = params[:taggable_id]
@@ -43,6 +65,10 @@ module RailsPulse
         Request.find(@taggable_id)
       when "query"
         Query.find(@taggable_id)
+      when "job"
+        Job.find(@taggable_id)
+      when "job_run"
+        JobRun.find(@taggable_id)
       else
         head :not_found
       end

data/app/helpers/rails_pulse/application_helper.rb

@@ -18,9 +18,25 @@ module RailsPulse
       width = options[:width] || options["width"] || 24
       height = options[:height] || options["height"] || 24
       css_class = options[:class] || options["class"] || ""
+      custom_style = options[:style] || options["style"]
+
+      # Normalize numeric width/height values into px for layout stability
+      width_css = normalize_dimension(width)
+      height_css = normalize_dimension(height)
+
+      default_style = [
+        "display:inline-flex",
+        "align-items:center",
+        "justify-content:center",
+        "width:#{width_css}",
+        "height:#{height_css}",
+        "flex-shrink:0"
+      ].join(";")
+
+      style_attribute = [ default_style, custom_style ].compact.join(";")
 
       # Additional HTML attributes
-      attrs = options.except(:width, :height, :class, "width", "height", "class")
+      attrs = options.except(:width, :height, :class, :style, "width", "height", "class", "style")
 
       content_tag("rails-pulse-icon",
         "",
@@ -31,6 +47,7 @@ module RailsPulse
           'rails-pulse--icon-height-value': height
         },
         class: css_class,
+        style: style_attribute,
         **attrs
       )
     end
@@ -38,6 +55,20 @@ module RailsPulse
     # Backward compatibility alias - can be removed after migration
     alias_method :lucide_icon, :rails_pulse_icon
 
+    def normalize_dimension(value)
+      string = value.to_s
+      return string if string.empty?
+
+      if string.match?(/[a-z%]+\z/i)
+        string
+      else
+        number = Float(string)
+        formatted = number == number.to_i ? number.to_i.to_s : number.to_s
+        "#{formatted}px"
+      end
+    end
+
+    private :normalize_dimension
     # Get items per page from Pagy instance (compatible with Pagy 8.x and 43+)
     def pagy_items(pagy)
       # Pagy 43+ uses options[:items] or has a limit method

data/app/helpers/rails_pulse/breadcrumbs_helper.rb

@@ -49,9 +49,23 @@ module RailsPulse
 
         is_last = index == path_segments.length - 1
 
+        # For nested resources, if this is a collection name followed by an ID,
+        # link to the parent resource's show page instead of the nested index
+        breadcrumb_path = if !is_last &&
+                            segment !~ /^\d+$/ &&
+                            index > 0 &&
+                            path_segments[index - 1] =~ /^\d+$/ &&
+                            path_segments[index + 1] =~ /^\d+$/
+          # This is a nested collection (e.g., /jobs/5/runs/291)
+          # Link to parent show page (e.g., /jobs/5)
+          path_segments[0..index-1].inject(main_app.rails_pulse_path.chomp("/")) { |path, seg| path + "/#{seg}" }
+        else
+          current_path
+        end
+
         crumbs << {
           title: title,
-          path: current_path,
+          path: breadcrumb_path,
           current: is_last
         }
       end

data/app/helpers/rails_pulse/status_helper.rb

@@ -281,5 +281,21 @@ module RailsPulse
         [ "Critical (≥ #{thresholds[:critical]}ms)", :critical ]
       ]
     end
+
+    def duration_threshold_filter_options(type = :route)
+      thresholds = RailsPulse.configuration.public_send("#{type}_thresholds")
+
+      all_label =
+        case type
+        when :job then "All Job Runs"
+        else "All #{type.to_s.humanize.pluralize}"
+        end
+
+      threshold_options = thresholds.map do |name, value|
+        [ "#{name.to_s.humanize} (≥ #{value}ms)", value ]
+      end.sort_by { |_, value| value }
+
+      [ [ all_label, nil ] ] + threshold_options
+    end
   end
 end

data/app/helpers/rails_pulse/tags_helper.rb

@@ -1,5 +1,43 @@
 module RailsPulse
   module TagsHelper
+    # Render a single tag badge
+    # Options:
+    # - variant: :default (no class), :secondary, :positive
+    # - removable: boolean - whether to include a remove button
+    # - taggable_type: string - type of taggable object (for remove button)
+    # - taggable_id: integer - id of taggable object (for remove button)
+    def render_tag_badge(tag, variant: :default, removable: false, taggable_type: nil, taggable_id: nil)
+      badge_class = case variant
+      when :secondary
+        "badge badge--secondary font-normal"
+      when :positive
+        "badge badge--positive font-normal"
+      else
+        "badge font-normal"
+      end
+
+      if removable && taggable_type && taggable_id
+        # For removable tags, render the full structure with button_to
+        content_tag(:span, class: badge_class) do
+          concat tag.humanize
+          concat " "
+          concat(
+            button_to(
+              remove_tag_path(taggable_type, taggable_id, tag: tag),
+              method: :delete,
+              class: "tag-remove",
+              data: { turbo_frame: "_top" }
+            ) do
+              content_tag(:span, "×", "aria-hidden": "true")
+            end
+          )
+        end
+      else
+        # For non-removable tags, just render the badge
+        content_tag(:span, tag, class: badge_class)
+      end
+    end
+
     # Display tags as badge elements
     # Accepts:
     # - Taggable objects (with tag_list method)
@@ -23,7 +61,7 @@ module RailsPulse
 
       return content_tag(:span, "-", class: "text-subtle") if tag_array.empty?
 
-      safe_join(tag_array.map { |tag| content_tag(:div, tag, class: "badge") }, " ")
+      safe_join(tag_array.map { |tag| content_tag(:div, tag.humanize, class: "badge") }, " ")
     end
   end
 end