railwatch 0.2.0.pre1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9500835353b9f428ff09ae908f9cbc360c44f0ea01740139738ec8c06ce73eb2
-  data.tar.gz: 7b4e2b48a881ef09243af6d2f51865609bd5615e55d27d9fca784f3e2740de7b
+  metadata.gz: e971a5ebd07d60e1ce62861a43de0d35961d1f12e439fc07a8e384e5fe7cd032
+  data.tar.gz: e3f9c39e07cc99599587b910ef777d8ce473f917bd85238414d5cfc7cc3892c1
 SHA512:
-  metadata.gz: 0d38ab1fced44ae3168de8f7864b858732ad07a26a4a9a96d82b74891d3b20144b9cc19a703743a127a2d270552ba422e9d51c1c9f8e768077c5a12364f613c8
-  data.tar.gz: 0e4ad6b17f76856cc2f160c64c992ed8405e50ba9485563c6e3b40495fdb11c1da756d8aa0317adec1d78b93f4b3dc6783de196c33c42d58dbbc606e3491310f
+  metadata.gz: 1e5bed88aee6554e1eb97f7e109a08f67b96ca286c378c8bcaba0c4284ab2f9b8b047ea5ceae073ff3c0ac800ed0e0386ebc7b0b25f5a66f0b144d042be62d59
+  data.tar.gz: 1ef06458ea5d88cd739def97a3e05b2755b8b0ba9c8666be531cc1e6e986f774f7c2e963a91c9affb9815f2770bab5e2f1b643a5477b41e2b766ad831948a2b9

data/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## Unreleased
+## 0.2.0 (2026-09-18)
 
 - Embedded mode: `bin/rails generate railwatch:install --local` keeps
   every record in two SQLite databases the app owns (`railwatch` for
@@ -166,6 +166,13 @@
   the bundle yet (a `LoadError` rather than `AdapterNotSpecified`), which
   is the state a PostgreSQL app is in between the installer adding
   `gem "sqlite3"` and the `bundle install` that follows.
+- Host user ids are opaque. The columns behind comments, issue activity,
+  saved views and issue assignment were integers, which assumed every
+  application numbers its users: an app with UUID primary keys could not
+  write a comment at all, and one with ids past the signed range could
+  not either. They are strings now, a `dashboard_user` resolver may
+  return whatever shape the app already uses, and rows written as numbers
+  before the change still match the same person after it.
 - The embedded dashboard authenticates the way Mission Control Jobs
   does: HTTP Basic is on and closed by default, so with no credentials
   every dashboard page answers 401 (with a note saying what to run), the

data/app/controllers/railwatch/saved_views_controller.rb

@@ -37,7 +37,7 @@ module Railwatch
     # dashboard_user resolver returns one identity for everybody is unaffected
     # either way: one owner, one editor.
     def editable?(view)
-      view.viewer_id == Viewer.user.id
+      view.viewer_id.to_s == Viewer.user.id.to_s
     end
 
     def fallback = application_environment_overview_path(application, environment)

data/app/models/railwatch/comment.rb

@@ -11,7 +11,7 @@ module Railwatch
     end
 
     def user=(u)
-      self.viewer_id = u&.id
+      self.viewer_id = u&.id&.to_s
     end
 
     validates :body, presence: true

data/app/models/railwatch/issue.rb

@@ -22,7 +22,7 @@ module Railwatch
     end
 
     def assignee=(user)
-      self.assignee_id = user&.id
+      self.assignee_id = user&.id&.to_s
     end
     belongs_to :merged_into, class_name: "Issue", optional: true
     has_many :merged_issues, class_name: "Issue", foreign_key: :merged_into_id, inverse_of: :merged_into, dependent: :nullify

data/app/models/railwatch/issue_activity.rb

@@ -15,7 +15,7 @@ module Railwatch
     end
 
     def user=(u)
-      self.viewer_id = u&.id
+      self.viewer_id = u&.id&.to_s
     end
 
     validates :kind, inclusion: { in: KINDS }

data/app/models/railwatch/saved_view.rb

@@ -33,14 +33,14 @@ module Railwatch
     end
 
     def user=(u)
-      self.viewer_id = u&.id
+      self.viewer_id = u&.id&.to_s
     end
 
     validates :name, presence: true, length: { maximum: 80 }
     validates :page, inclusion: { in: PAGES }
 
     scope :pinned, -> { where(pinned: true) }
-    scope :visible_to, ->(user) { where(shared: true).or(where(viewer_id: user.id)) }
+    scope :visible_to, ->(user) { where(shared: true).or(where(viewer_id: user.id.to_s)) }
 
     # The props every environment page shares, ready for the sidebar and the
     # Views menu: one entry per view this user is allowed to see.

data/db/railwatch_migrate/20260918120000_widen_host_user_ids.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+# The ids on comments, issue activity, saved views and issue assignment are
+# whatever the host's `dashboard_user` resolver returned. They were integer
+# columns, which quietly assumed every application numbers its users. An app
+# with UUID primary keys could not store a comment at all, and one with ids
+# past the signed range could not either.
+#
+# Nothing joins on these columns and nothing indexes them; they are an opaque
+# handle the host gave us and hands back. A string says that, and costs
+# nothing in a database that is a few thousand rows of authored content.
+#
+# Existing values convert cleanly: SQLite rewrites 7 as "7", and the models
+# compare with to_s on both sides, so a row written before this migration
+# still matches the same viewer after it.
+class WidenHostUserIds < ActiveRecord::Migration[8.1]
+  COLUMNS = {
+    railwatch_issues: :assignee_id,
+    railwatch_comments: :viewer_id,
+    railwatch_issue_activities: :viewer_id,
+    railwatch_saved_views: :viewer_id
+  }.freeze
+
+  # SQLite rebuilds a table to change a column type, and a rebuild inside a
+  # transaction ignores `PRAGMA foreign_keys = OFF`. This database declares no
+  # foreign keys, so there is nothing to cascade, but the rebuild is kept out
+  # of the migrator's transaction anyway: it is the cheap half of a habit
+  # whose expensive half is deleted rows.
+  disable_ddl_transaction!
+
+  def up
+    COLUMNS.each do |table, column|
+      null = column == :viewer_id && table == :railwatch_saved_views ? false : true
+      change_column table, column, :string, limit: 255, null: null
+    end
+  end
+
+  # Reversible only while every stored id still looks like a number. Once a
+  # host with UUIDs (or emails, or anything else) has written one, there is
+  # no integer to go back to: the column would either refuse the value or
+  # quietly coerce it to something that is no longer that person. Say so and
+  # stop, rather than losing the identity on the way down. These tables are
+  # authored content, a few thousand rows at most, so reading them is cheap.
+  INTEGERISH = /\A-?\d+\z/
+  MAX_REPORTED = 3
+
+  def down
+    blocking = COLUMNS.filter_map do |table, column|
+      next unless connection.table_exists?(table)
+
+      values = connection.select_values(
+        "SELECT DISTINCT #{connection.quote_column_name(column)} FROM #{connection.quote_table_name(table)} " \
+        "WHERE #{connection.quote_column_name(column)} IS NOT NULL"
+      )
+      offenders = values.reject { |value| INTEGERISH.match?(value.to_s) }
+      "#{table}.#{column} (#{offenders.first(MAX_REPORTED).join(', ')}#{"..." if offenders.size > MAX_REPORTED})" if offenders.any?
+    end
+
+    if blocking.any?
+      raise ActiveRecord::IrreversibleMigration,
+            "cannot narrow host user ids back to integers: #{blocking.join('; ')}. " \
+            "Those ids came from this application's own dashboard_user resolver and have no integer form; " \
+            "rolling back would discard them."
+    end
+
+    COLUMNS.each do |table, column|
+      null = column == :viewer_id && table == :railwatch_saved_views ? false : true
+      change_column table, column, :integer, null: null
+    end
+  end
+end

data/docs/embedded.md

@@ -184,7 +184,7 @@ on the WebSocket handshake, a `dashboard_user` resolver is consulted,
 an undeclared gate is refused. The channel carries an ingest ping (a
 timestamp and per-type counts) and never telemetry records.
 
-### Naming the operator
+### Naming the operator, and what an id may be
 
 Comments, saved views and issue activity record who did them. Give the
 initializer a resolver and the dashboard shows that person instead of a
@@ -197,6 +197,16 @@ c.dashboard_user = ->(request) do
 end
 ```
 
+The `id` may be anything your application already uses: an integer, a
+UUID, a ULID, an email. It is stored as an opaque string and handed back
+to you; nothing joins on it and nothing parses it, because the engine has
+no user table to check it against. Comments, saved views, issue activity
+and assignment all key off whatever you return, so a person keeps their
+own views and their name on their own comments however you identify them.
+
+Returning `nil` refuses the request, which is what makes this an
+authorisation rule as well as a label.
+
 ## The writer process
 
 Puma forks one Railwatch writer from its master when `config/puma.rb`

data/lib/railwatch/embedded.rb

@@ -34,7 +34,10 @@ module Railwatch
       def plan = "embedded"
       def retention_days = Railwatch.config.retention_days
       def auto_resolve_after_days = 14
-      def users = [ User.default ]
+      # Whoever the host's resolver named for this request, not the anonymous
+      # placeholder: an embedded install has no member list, so the account's
+      # one "member" is the person looking at it.
+      def users = [ User.current || User.default ]
       def members = users
       def memberships = NONE
       def integrations = NONE

data/lib/railwatch/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Railwatch
-  VERSION = "0.2.0.pre1"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: railwatch
 version: !ruby/object:Gem::Version
-  version: 0.2.0.pre1
+  version: 0.2.0
 platform: ruby
 authors:
 - Cole Robertson
@@ -204,6 +204,7 @@ files:
 - db/railwatch_migrate/20260916000000_create_railwatch_tables.rb
 - db/railwatch_migrate/20260917000000_create_railwatch_maintenance_tasks.rb
 - db/railwatch_migrate/20260917120000_create_railwatch_followup_receipts.rb
+- db/railwatch_migrate/20260918120000_widen_host_user_ids.rb
 - db/railwatch_telemetry_migrate/20260903000001_create_telemetry.rb
 - db/railwatch_telemetry_migrate/20260903000002_rename_tenant_to_app_tenant.rb
 - db/railwatch_telemetry_migrate/20260903000003_add_statement_count_to_transactions.rb