react_on_rails 16.1.2 → 16.2.0

data/lib/react_on_rails/utils.rb

@@ -5,6 +5,7 @@ require "open3"
 require "rainbow"
 require "active_support"
 require "active_support/core_ext/string"
+require "shellwords"
 
 # rubocop:disable Metrics/ModuleLength
 module ReactOnRails
@@ -13,6 +14,46 @@ module ReactOnRails
       Rainbow('To see the full output, set FULL_TEXT_ERRORS=true.').red
     } ...\n".freeze
 
+    def self.immediate_hydration_pro_license_warning(name, type = "Component")
+      "[REACT ON RAILS] Warning: immediate_hydration: true requires a React on Rails Pro license.\n" \
+        "#{type} '#{name}' will fall back to standard hydration behavior.\n" \
+        "Visit https://www.shakacode.com/react-on-rails-pro/ for licensing information."
+    end
+
+    # Normalizes the immediate_hydration option value, enforcing Pro license requirements.
+    # Returns the normalized boolean value for immediate_hydration.
+    #
+    # @param value [Boolean, nil] The immediate_hydration option value
+    # @param name [String] The name of the component/store (for warning messages)
+    # @param type [String] The type ("Component" or "Store") for warning messages
+    # @return [Boolean] The normalized immediate_hydration value
+    # @raise [ArgumentError] If value is not a boolean or nil
+    #
+    # Logic:
+    # - Validates that value is true, false, or nil
+    # - If value is explicitly true (boolean) and no Pro license: warn and return false
+    # - If value is nil: return true for Pro users, false for non-Pro users
+    # - Otherwise: return the value as-is (allows explicit false to work)
+    def self.normalize_immediate_hydration(value, name, type = "Component")
+      # Type validation: only accept boolean or nil
+      unless [true, false, nil].include?(value)
+        raise ArgumentError,
+              "[REACT ON RAILS] immediate_hydration must be true, false, or nil. Got: #{value.inspect} (#{value.class})"
+      end
+
+      # Strict equality check: only trigger warning for explicit boolean true
+      if value == true && !react_on_rails_pro?
+        Rails.logger.warn immediate_hydration_pro_license_warning(name, type)
+        return false
+      end
+
+      # If nil, default based on Pro license status
+      return react_on_rails_pro? if value.nil?
+
+      # Return explicit value (including false)
+      value
+    end
+
     # https://forum.shakacode.com/t/yak-of-the-week-ruby-2-4-pathname-empty-changed-to-look-at-file-size/901
     # return object if truthy, else return nil
     def self.truthy_presence(obj)
@@ -57,9 +98,12 @@ module ReactOnRails
           exitstatus: #{status.exitstatus}#{stdout_msg}#{stderr_msg}
         MSG
 
-        puts wrap_message(msg)
-        puts ""
-        puts default_troubleshooting_section
+        # Use warn to ensure output is visible in CI logs (goes to stderr)
+        # and flush immediately before calling exit!
+        warn wrap_message(msg)
+        warn ""
+        warn default_troubleshooting_section
+        $stderr.flush
 
         # Rspec catches exit without! in the exit callbacks
         exit!(1)
@@ -111,9 +155,16 @@ module ReactOnRails
 
     private_class_method def self.server_bundle?(bundle_name)
       config = ReactOnRails.configuration
-      bundle_name == config.server_bundle_js_file ||
-      bundle_name == config.rsc_bundle_js_file ||
-      bundle_name == config.react_server_client_manifest_file
+      return true if bundle_name == config.server_bundle_js_file
+
+      # Check Pro configurations if Pro is available
+      if react_on_rails_pro?
+        pro_config = ReactOnRailsPro.configuration
+        return true if bundle_name == pro_config.rsc_bundle_js_file ||
+                       bundle_name == pro_config.react_server_client_manifest_file
+      end
+
+      false
     end
 
     private_class_method def self.handle_missing_manifest_entry(bundle_name, is_server_bundle)
@@ -146,34 +197,6 @@ module ReactOnRails
       @server_bundle_path = bundle_js_file_path(bundle_name)
     end
 
-    def self.rsc_bundle_js_file_path
-      return @rsc_bundle_path if @rsc_bundle_path && !Rails.env.development?
-
-      bundle_name = ReactOnRails.configuration.rsc_bundle_js_file
-      @rsc_bundle_path = bundle_js_file_path(bundle_name)
-    end
-
-    def self.react_client_manifest_file_path
-      return @react_client_manifest_path if @react_client_manifest_path && !Rails.env.development?
-
-      file_name = ReactOnRails.configuration.react_client_manifest_file
-      @react_client_manifest_path = ReactOnRails::PackerUtils.asset_uri_from_packer(file_name)
-    end
-
-    # React Server Manifest is generated by the server bundle.
-    # So, it will never be served from the dev server.
-    def self.react_server_client_manifest_file_path
-      return @react_server_manifest_path if @react_server_manifest_path && !Rails.env.development?
-
-      asset_name = ReactOnRails.configuration.react_server_client_manifest_file
-      if asset_name.nil?
-        raise ReactOnRails::Error,
-              "react_server_client_manifest_file is nil, ensure it is set in your configuration"
-      end
-
-      @react_server_manifest_path = bundle_js_file_path(asset_name)
-    end
-
     def self.running_on_windows?
       (/cygwin|mswin|mingw|bccwin|wince|emx/ =~ RUBY_PLATFORM) != nil
     end
@@ -228,11 +251,19 @@ module ReactOnRails
       end
     end
 
-    # Todo -- remove this for v13, as we don't need both boolean and number
+    # Checks if React on Rails Pro is installed and licensed.
+    # This method validates the license and will raise an exception if invalid.
+    #
+    # @return [Boolean] true if Pro is available with valid license
+    # @raise [ReactOnRailsPro::Error] if license is invalid
     def self.react_on_rails_pro?
       return @react_on_rails_pro if defined?(@react_on_rails_pro)
 
-      @react_on_rails_pro = gem_available?("react_on_rails_pro")
+      @react_on_rails_pro = begin
+        return false unless gem_available?("react_on_rails_pro")
+
+        ReactOnRailsPro::Utils.validated_license_data!.present?
+      end
     end
 
     # Return an empty string if React on Rails Pro is not installed
@@ -246,28 +277,12 @@ module ReactOnRails
                                     end
     end
 
-    def self.react_on_rails_pro_licence_valid?
-      return @react_on_rails_pro_licence_valid if defined?(@react_on_rails_pro_licence_valid)
-
-      @react_on_rails_pro_licence_valid = begin
-        return false unless react_on_rails_pro?
-
-        # Maintain compatibility with legacy versions of React on Rails Pro:
-        # Earlier releases did not require license validation, as they were distributed as private gems.
-        # This check ensures that the method works correctly regardless of the installed version.
-        return true unless ReactOnRailsPro::Utils.respond_to?(:licence_valid?)
-
-        ReactOnRailsPro::Utils.licence_valid?
-      end
-    end
-
+    # RSC support detection has been moved to React on Rails Pro
+    # See react_on_rails_pro/lib/react_on_rails_pro/utils.rb
     def self.rsc_support_enabled?
       return false unless react_on_rails_pro?
 
-      return @rsc_support_enabled if defined?(@rsc_support_enabled)
-
-      rorp_config = ReactOnRailsPro.configuration
-      @rsc_support_enabled = rorp_config.respond_to?(:enable_rsc_support) && rorp_config.enable_rsc_support
+      ReactOnRailsPro::Utils.rsc_support_enabled?
     end
 
     def self.full_text_errors_enabled?
@@ -312,6 +327,177 @@ module ReactOnRails
       puts "Prepended\n#{text_to_prepend}to #{file}."
     end
 
+    # Detects which package manager is being used.
+    # First checks the packageManager field in package.json (Node.js Corepack standard),
+    # then falls back to checking for lock files.
+    #
+    # @return [Symbol] The package manager symbol (:npm, :yarn, :pnpm, :bun)
+    def self.detect_package_manager
+      manager = detect_package_manager_from_package_json || detect_package_manager_from_lock_files
+      manager || :yarn # Default to yarn if no detection succeeds
+    end
+
+    # Validates package_name input to prevent command injection
+    #
+    # @param package_name [String] The package name to validate
+    # @raise [ReactOnRails::Error] if package_name contains potentially unsafe characters
+    private_class_method def self.validate_package_name!(package_name)
+      raise ReactOnRails::Error, "package_name cannot be nil" if package_name.nil?
+      raise ReactOnRails::Error, "package_name cannot be empty" if package_name.to_s.strip.empty?
+
+      # Allow valid npm package names: alphanumeric, hyphens, underscores, dots, slashes (for scoped packages)
+      # See: https://github.com/npm/validate-npm-package-name
+      return if package_name.match?(%r{\A[@a-z0-9][a-z0-9._/-]*\z}i)
+
+      raise ReactOnRails::Error, "Invalid package name: #{package_name.inspect}. " \
+                                 "Package names must contain only alphanumeric characters, " \
+                                 "hyphens, underscores, dots, and slashes (for scoped packages)."
+    end
+
+    # Validates package_name and version inputs to prevent command injection
+    #
+    # @param package_name [String] The package name to validate
+    # @param version [String] The version to validate
+    # @raise [ReactOnRails::Error] if inputs contain potentially unsafe characters
+    private_class_method def self.validate_package_command_inputs!(package_name, version)
+      validate_package_name!(package_name)
+
+      raise ReactOnRails::Error, "version cannot be nil" if version.nil?
+      raise ReactOnRails::Error, "version cannot be empty" if version.to_s.strip.empty?
+
+      # Allow valid semver versions and common npm version patterns
+      # This allows: 1.2.3, 1.2.3-beta.1, 1.2.3-alpha, etc.
+      return if version.match?(/\A[a-z0-9][a-z0-9._-]*\z/i)
+
+      raise ReactOnRails::Error, "Invalid version: #{version.inspect}. " \
+                                 "Versions must contain only alphanumeric characters, dots, hyphens, and underscores."
+    end
+
+    private_class_method def self.detect_package_manager_from_package_json
+      package_json_path = File.join(Rails.root, ReactOnRails.configuration.node_modules_location, "package.json")
+      return nil unless File.exist?(package_json_path)
+
+      package_json_data = JSON.parse(File.read(package_json_path))
+      return nil unless package_json_data["packageManager"]
+
+      manager_string = package_json_data["packageManager"]
+      # Extract manager name from strings like "yarn@3.6.0" or "pnpm@8.0.0"
+      manager_name = manager_string.split("@").first
+      manager_name.to_sym if %w[npm yarn pnpm bun].include?(manager_name)
+    rescue StandardError
+      nil
+    end
+
+    private_class_method def self.detect_package_manager_from_lock_files
+      root = Rails.root
+      return :yarn if File.exist?(File.join(root, "yarn.lock"))
+      return :pnpm if File.exist?(File.join(root, "pnpm-lock.yaml"))
+      return :bun if File.exist?(File.join(root, "bun.lockb"))
+      return :npm if File.exist?(File.join(root, "package-lock.json"))
+
+      nil
+    end
+
+    # Returns the appropriate install command for the detected package manager.
+    # Generates the correct command with exact version syntax.
+    #
+    # @param package_name [String] The name of the package to install
+    # @param version [String] The exact version to install
+    # @return [String] The command to run (e.g., "yarn add react-on-rails@16.0.0 --exact")
+    def self.package_manager_install_exact_command(package_name, version)
+      validate_package_command_inputs!(package_name, version)
+
+      manager = detect_package_manager
+      # Escape shell arguments to prevent command injection
+      safe_package = Shellwords.escape("#{package_name}@#{version}")
+
+      case manager
+      when :pnpm
+        "pnpm add #{safe_package} --save-exact"
+      when :bun
+        "bun add #{safe_package} --exact"
+      when :npm
+        "npm install #{safe_package} --save-exact"
+      else # :yarn or unknown, default to yarn
+        "yarn add #{safe_package} --exact"
+      end
+    end
+
+    # Returns the appropriate remove command for the detected package manager.
+    #
+    # @param package_name [String] The name of the package to remove
+    # @return [String] The command to run (e.g., "yarn remove react-on-rails")
+    def self.package_manager_remove_command(package_name)
+      validate_package_name!(package_name)
+
+      manager = detect_package_manager
+      # Escape shell arguments to prevent command injection
+      safe_package = Shellwords.escape(package_name)
+
+      case manager
+      when :pnpm
+        "pnpm remove #{safe_package}"
+      when :bun
+        "bun remove #{safe_package}"
+      when :npm
+        "npm uninstall #{safe_package}"
+      else # :yarn or unknown, default to yarn
+        "yarn remove #{safe_package}"
+      end
+    end
+
+    # Converts an absolute path (String or Pathname) to a path relative to Rails.root.
+    # If the path is already relative or doesn't contain Rails.root, returns it as-is.
+    #
+    # This method is used to normalize paths from Shakapacker's privateOutputPath (which is
+    # absolute) to relative paths suitable for React on Rails configuration.
+    #
+    # Note: Absolute paths that don't start with Rails.root are intentionally passed through
+    # unchanged. While there's no known use case for server bundles outside Rails.root,
+    # this behavior preserves the original path for debugging and error messages.
+    #
+    # @param path [String, Pathname] The path to normalize
+    # @return [String, nil] The relative path as a string, or nil if path is nil
+    #
+    # @example Converting absolute paths within Rails.root
+    #   # Assuming Rails.root is "/app"
+    #   normalize_to_relative_path("/app/ssr-generated") # => "ssr-generated"
+    #   normalize_to_relative_path("/app/foo/bar")       # => "foo/bar"
+    #
+    # @example Already relative paths pass through
+    #   normalize_to_relative_path("ssr-generated")      # => "ssr-generated"
+    #   normalize_to_relative_path("./ssr-generated")    # => "./ssr-generated"
+    #
+    # @example Absolute paths outside Rails.root (edge case)
+    #   normalize_to_relative_path("/other/path/bundles") # => "/other/path/bundles"
+    def self.normalize_to_relative_path(path)
+      return nil if path.nil?
+
+      path_str = path.to_s
+      rails_root_str = Rails.root.to_s.chomp("/")
+
+      # Treat as "inside Rails.root" only for exact match or a subdirectory
+      inside_rails_root = rails_root_str.present? &&
+                          (path_str == rails_root_str || path_str.start_with?("#{rails_root_str}/"))
+
+      # If path is within Rails.root, remove that prefix
+      if inside_rails_root
+        # Remove Rails.root and any leading slash
+        path_str.sub(%r{^#{Regexp.escape(rails_root_str)}/?}, "")
+      else
+        # Path is already relative or outside Rails.root
+        # Warn if it's an absolute path outside Rails.root (edge case)
+        if path_str.start_with?("/") && !inside_rails_root
+          Rails.logger&.warn(
+            "ReactOnRails: Detected absolute path outside Rails.root: '#{path_str}'. " \
+            "Server bundles are typically stored within Rails.root. " \
+            "Verify this is intentional."
+          )
+        end
+        path_str
+      end
+    end
+
     def self.default_troubleshooting_section
       <<~DEFAULT
         📞 Get Help & Support:

data/lib/react_on_rails/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReactOnRails
-  VERSION = "16.1.2"
+  VERSION = "16.2.0"
 end