react_on_rails 16.7.0.rc.2 → 17.0.0.rc.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 60730ef27df1000e69cba89e5882f3a62d6c4fa0cdebb6ada0c10fa6af8f9385
-  data.tar.gz: 2214b6b5492d8ad2eb312bf79622b9cef74c469aaf0ef29e253211c97f0c92d8
+  metadata.gz: 02f0fa1befbed99b17f624249398f47b5a1395ed5407079a472ad39218d2cfc1
+  data.tar.gz: f8b4e5a3abf309b98f7b244d1a807acb29096ff7ae1ea115e780eefd35f2d609
 SHA512:
-  metadata.gz: 1b4cd9ee45593c49f2ae568b68f7c8b9353c6238ae710e8ceaf6f84c34becc061254acecd8850f00d10006642f9ec80f795ab6c9d74aaaf1d24fcd731119bb21
-  data.tar.gz: 3646913ccf2b0d66e4d0adea6310cfdeaf1ab5463e46a0991a35734cb1111ecde8c23701b0272b0a4040c216a3c5fb49546bbb6c78d4a444dec072943ada6938
+  metadata.gz: c594211d78c05817226dd5d4ff06e7bb4f377b57320cdb824de7a8902ec40d66473b28da64e0f6d2df5b445786a050d1c6b61779af3fea0c1c4793f3955efa63
+  data.tar.gz: e86d35866011de451f725c441539bc7f8400e83d9702a4a3b9058d385e483a926229b4e33e18685636d73700bc7a9a1106246d78174a726327b47b8b0f1645d9

data/Gemfile.development_dependencies

@@ -2,18 +2,22 @@
 
 eval_gemfile File.expand_path("../Gemfile.shared_dev_dependencies", __dir__)
 
-gem "shakapacker", "9.6.1"
+gem "shakapacker", "10.1.0"
 gem "bootsnap", require: false
 gem "rails", "~> 7.1.0"
 
-gem "sqlite3", "~> 1.6"
+gem "sqlite3", "~> 2.0"
 gem "sass-rails", "~> 6.0"
 gem "uglifier"
 gem "jquery-rails"
 gem "puma", "~> 6.0"
 
 # Turbolinks makes following links in your web application faster. Read more: https://github.com/rails/turbolinks
-gem "turbolinks" if ENV["DISABLE_TURBOLINKS"].nil? || ENV["DISABLE_TURBOLINKS"].strip.empty?
+# Declared unconditionally so the gemset always matches Gemfile.lock. DISABLE_TURBOLINKS
+# toggles Turbolinks at the application layer (the require_asset in
+# spec/dummy/app/assets/javascripts/application_non_webpack.js.erb), not gem inclusion.
+# A conditional declaration broke `bundle install --frozen` in CI (see AGENTS.md).
+gem "turbolinks"
 
 # Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder
 gem "jbuilder"

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    react_on_rails (16.7.0.rc.2)
+    react_on_rails (17.0.0.rc.0)
       addressable
       connection_pool
       execjs (~> 2.5)
@@ -201,6 +201,10 @@ GEM
     nokogiri (1.19.2)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
+    nokogiri (1.19.2-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.2-x86_64-linux-gnu)
+      racc (~> 1.4)
     ostruct (0.6.1)
     package_json (0.2.0)
     parallel (1.24.0)
@@ -233,7 +237,7 @@ GEM
       nio4r (~> 2.0)
     racc (1.8.1)
     rack (3.2.5)
-    rack-proxy (0.7.7)
+    rack-proxy (0.8.2)
       rack
     rack-session (2.1.1)
       base64 (>= 0.1.0)
@@ -356,7 +360,7 @@ GEM
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
     semantic_range (3.1.1)
-    shakapacker (9.6.1)
+    shakapacker (10.1.0)
       activesupport (>= 5.2)
       package_json
       rack-proxy (>= 0.6.1)
@@ -375,8 +379,10 @@ GEM
       actionpack (>= 5.2)
       activesupport (>= 5.2)
       sprockets (>= 3.0.0)
-    sqlite3 (1.7.3)
+    sqlite3 (2.9.4)
       mini_portile2 (~> 2.8.0)
+    sqlite3 (2.9.4-arm64-darwin)
+    sqlite3 (2.9.4-x86_64-linux-gnu)
     steep (1.9.4)
       activesupport (>= 5.1)
       concurrent-ruby (>= 1.1.10)
@@ -428,7 +434,9 @@ GEM
     zeitwerk (2.7.5)
 
 PLATFORMS
+  arm64-darwin
   ruby
+  x86_64-linux
 
 DEPENDENCIES
   amazing_print
@@ -467,11 +475,11 @@ DEPENDENCIES
   sass-rails (~> 6.0)
   sdoc
   selenium-webdriver (= 4.9.0)
-  shakapacker (= 9.6.1)
+  shakapacker (= 10.1.0)
   simplecov (~> 0.16.1)
   spring (~> 4.0)
   sprockets (~> 4.0)
-  sqlite3 (~> 1.6)
+  sqlite3 (~> 2.0)
   steep
   turbo-rails
   turbolinks

data/lib/generators/react_on_rails/generator_helper.rb

@@ -84,12 +84,16 @@ module GeneratorHelper
     false
   end
 
-  # Check if React on Rails Pro gem is installed
+  # Check if React on Rails Pro gem is installed (real state — never "scheduled to be installed").
   #
   # Detection priority:
   # 1. Gem.loaded_specs - gem is loaded in current Ruby process (most reliable)
   # 2. Gemfile.lock - gem is resolved and installed
   #
+  # Use {#pro_gem_install_deferred?} for the broader "present, or will be installed by this
+  # generator run" meaning. Use {#invalidate_pro_gem_installed_cache!} after an operation
+  # that changes real state (e.g., bundle add) so the next call re-reads the lockfile.
+  #
   # @return [Boolean] true if react_on_rails_pro gem is installed
   def pro_gem_installed?
     return @pro_gem_installed if defined?(@pro_gem_installed)
@@ -97,11 +101,6 @@ module GeneratorHelper
     @pro_gem_installed = Gem.loaded_specs.key?("react_on_rails_pro") || gem_in_lockfile?("react_on_rails_pro")
   end
 
-  # TODO: CQS smell: mark_pro_gem_installed! makes pro_gem_installed? return true before install. See #3303.
-  def mark_pro_gem_installed!
-    @pro_gem_installed = true
-  end
-
   # Check if Pro features should be enabled.
   # Returns true if --pro or --rsc is set (RSC implies Pro).
   #
@@ -252,6 +251,24 @@ module GeneratorHelper
 
   private
 
+  # Clear the memoized {#pro_gem_installed?} result so the next call re-checks
+  # Gem.loaded_specs / Gemfile.lock. Call after any operation that may change real state.
+  def invalidate_pro_gem_installed_cache!
+    remove_instance_variable(:@pro_gem_installed) if defined?(@pro_gem_installed)
+  end
+
+  # True when a later step in this generator run will install the Pro gem
+  # (e.g., the Gemfile swap performed by ProGenerator). Distinct from
+  # {#pro_gem_installed?}, which only reports real present state.
+  def pro_gem_install_deferred?
+    @pro_gem_install_deferred == true
+  end
+
+  # Record that a later step in this generator run will install the Pro gem.
+  def defer_pro_gem_install!
+    @pro_gem_install_deferred = true
+  end
+
   # NOTE: only the `default:` section is inspected — same assumption as
   # rspack_configured_in_project?. Projects that set `javascript_transpiler`
   # only in per-environment sections (without a `default:` block) will not be

data/lib/generators/react_on_rails/install_generator.rb

@@ -138,11 +138,13 @@ module ReactOnRails
       # version because `pnpm/action-setup` requires one unless package.json declares
       # `packageManager`. Match the repo's own packageManager version so generated
       # CI defaults to the pnpm major this codebase tests with. Track the exact release
-      # used for this fallback at https://github.com/pnpm/pnpm/releases/tag/v9.14.2;
+      # used for this fallback at https://github.com/pnpm/pnpm/releases/tag/v10.33.4;
       # update this URL with the constant when bumping. Users who need exact
       # reproducibility should commit `packageManager` to their package.json instead.
-      # renovate: datasource=github-releases depName=pnpm/pnpm extractVersion=^v(?<version>.+)$
-      CI_PNPM_FALLBACK_VERSION = "9.14.2"
+      # Bump checklist: heading text below is spec-asserted.
+      # CONTRIBUTING.md > "Updating the pnpm Fallback Version for Scaffolded CI".
+      # renovate: datasource=github-releases depName=pnpm/pnpm extractVersion=^v(?<version>.+)$ allowedVersions=<11
+      CI_PNPM_FALLBACK_VERSION = "10.33.4"
       private_constant :CI_PNPM_FALLBACK_VERSION
 
       # Main generator entry point

data/lib/generators/react_on_rails/js_dependency_manager.rb

@@ -578,12 +578,19 @@ module ReactOnRails
         end
 
         File.write("package.json", "#{JSON.pretty_generate(content)}\n")
+        GeneratorMessages.add_warning(package_json_pin_fallback_warning(versioned_packages))
         true
       rescue StandardError => e
         GeneratorMessages.add_warning("⚠️  Could not write dependency pins to package.json: #{e.message}")
         false
       end
 
+      def package_json_pin_fallback_warning(versioned_packages)
+        pinned_list = versioned_packages.map { |name, version| "#{name}@#{version}" }.join(", ")
+        "⚠️  Package manager install failed. Wrote the following version pins to package.json " \
+          "so you can rerun your package manager manually: #{pinned_list}"
+      end
+
       def fallback_package_manager
         package_manager = GeneratorMessages.detect_package_manager(app_root: destination_root)
         return package_manager if GeneratorMessages.supported_package_manager?(package_manager)

data/lib/generators/react_on_rails/pro_setup.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
+require "securerandom"
 require_relative "generator_messages"
+require "react_on_rails/node_renderer_procfile"
 require "react_on_rails/pro_migration"
 
 module ReactOnRails
@@ -19,7 +21,9 @@ module ReactOnRails
     #
     # Including classes must also include GeneratorHelper which provides:
     # - use_pro?, use_rsc?: Feature flag helpers
-    # - pro_gem_installed?: Pro gem detection
+    # - pro_gem_installed?: Pro gem detection (real lockfile / loaded-specs state)
+    # - pro_gem_install_deferred?, defer_pro_gem_install!: deferred-install tracking
+    # - invalidate_pro_gem_installed_cache!: invalidate memoized pro_gem_installed?
     #
     # rubocop:disable Metrics/ModuleLength
     module ProSetup
@@ -43,16 +47,58 @@ module ReactOnRails
         say set_color("🚀 REACT ON RAILS PRO SETUP", :cyan, :bold)
         say set_color("=" * 80, :cyan)
 
-        create_pro_initializer
+        # The Rails initializer and Node renderer bootstrap must share the same
+        # password literal. Only mint a fresh random password when BOTH files will
+        # be created — otherwise nil so each template falls back to the env-only
+        # branch, avoiding a literal mismatch with any existing file.
+        # Always reassign so a stale value from a prior invocation on the same
+        # instance can't leak into a later partial-install run.
+        @generated_renderer_password = nil
+        if pro_initializer_will_be_created? && node_renderer_will_be_created?
+          @generated_renderer_password = SecureRandom.hex(32)
+        end
+
+        initializer_created = create_pro_initializer
         legacy_renderer_detected = create_node_renderer
-        add_pro_to_procfile unless legacy_renderer_detected
+        add_pro_to_procfiles unless legacy_renderer_detected
         update_webpack_config_for_pro
 
+        say_renderer_password_setup_summary(initializer_created)
+
         say set_color("=" * 80, :cyan)
         say "✅ React on Rails Pro setup complete!", :green
         say set_color("=" * 80, :cyan)
       end
 
+      def say_renderer_password_setup_summary(initializer_created)
+        if @generated_renderer_password
+          say ""
+          say set_color("🔐 A random renderer password was written into your config files.", :yellow, :bold)
+          say "   For production, set RENDERER_PASSWORD as an env var instead and"
+          say "   remove the literal value from version control."
+          say "   See: https://www.shakacode.com/react-on-rails/docs/pro/node-renderer/"
+          say ""
+        elsif initializer_created
+          # Initializer was newly created but the Node renderer file already exists;
+          # the new initializer falls back to ENV["RENDERER_PASSWORD"] only so it doesn't
+          # disagree with whatever literal the existing renderer file contains.
+          say ""
+          say set_color("⚠️  Existing Node renderer detected — Rails initializer uses " \
+                        "ENV[\"RENDERER_PASSWORD\"] only.", :yellow, :bold)
+          say "   Set RENDERER_PASSWORD in your environment to match the password in your existing renderer."
+          say ""
+        end
+      end
+
+      def pro_initializer_will_be_created?
+        !File.exist?(File.join(destination_root, "config/initializers/react_on_rails_pro.rb"))
+      end
+
+      def node_renderer_will_be_created?
+        !File.exist?(File.join(destination_root, "renderer/node-renderer.js")) &&
+          !File.exist?(File.join(destination_root, "client/node-renderer.js"))
+      end
+
       # Check if the Pro gem is missing. When the base react_on_rails gem is in
       # the Gemfile, installation is deferred to the later Gemfile swap (which
       # preserves the user's version pin); otherwise auto-install via `bundle
@@ -63,7 +109,7 @@ module ReactOnRails
       #   is deferred to the Gemfile swap.
       def missing_pro_gem?(force: false)
         return false unless force || use_pro?
-        return false if pro_gem_installed?
+        return false if pro_gem_installed? || pro_gem_install_deferred?
         return false if defer_pro_gem_install_to_gemfile_swap
         return false if attempt_pro_gem_auto_install
 
@@ -126,7 +172,8 @@ module ReactOnRails
 
         # The gem is now in Gemfile/lockfile but not loaded in the current Ruby process.
         # Generator code that follows must not reference ReactOnRailsPro constants directly.
-        mark_pro_gem_installed!
+        # The lockfile changed, so the memoized pro_gem_installed? must be refreshed.
+        invalidate_pro_gem_installed_cache!
         true
       rescue StandardError => e
         say "⚠️  Failed to run bundle add: #{e.message}", :red
@@ -201,27 +248,57 @@ module ReactOnRails
 
         if File.exist?(File.join(destination_root, initializer_path))
           say "ℹ️  #{initializer_path} already exists, skipping", :yellow
-          return
+          return false
         end
 
         say "📝 Creating React on Rails Pro initializer...", :yellow
 
+        # @generated_renderer_password is set by setup_pro only when both this
+        # file and the Node renderer bootstrap will be created together; nil here
+        # means the template emits the env-only fallback (no literal password).
         template("templates/pro/base/config/initializers/react_on_rails_pro.rb.tt", initializer_path)
 
         say "✅ Created #{initializer_path}", :green
+        true
       end
 
-      # Matches active (uncommented) Procfile.dev node-renderer lines, tolerating
-      # an optional `./` prefix that a user may have added by hand
-      # (e.g. `node ./renderer/node-renderer.js`).
-      NEW_RENDERER_COMMAND_REGEX = %r{^[ \t]*node-renderer:[^\n]*\bnode\s+\.?/?renderer/node-renderer\.js\b}
-      LEGACY_RENDERER_COMMAND_REGEX = %r{^[ \t]*node-renderer:[^\n]*\bnode\s+\.?/?client/node-renderer\.js\b}
-
+      # Matches active (uncommented) Procfile.dev node-renderer lines that
+      # both set RENDERER_PORT and launch renderer/node-renderer.js (optionally
+      # prefixed with `./`). Entries missing RENDERER_PORT are intentionally
+      # not matched here so they fall through to NODE_RENDERER_PROCESS_REGEX
+      # and surface the "Update it manually" warning, keeping the generator's
+      # accept/skip decision aligned with the doctor's RENDERER_PORT check in
+      # NodeRendererProcfile::PROCESS_WITH_RENDERER_PORT_REGEX.
+      NEW_RENDERER_COMMAND_REGEX = %r{
+        ^[ \t]*(?:node-)?renderer:
+        (?=[^\n]*\bRENDERER_PORT\b)
+        [^\n]*\bnode\s+\.?/?renderer/node-renderer\.js\b
+      }x
+      LEGACY_RENDERER_COMMAND_REGEX = %r{^[ \t]*(?:node-)?renderer:[^\n]*\bnode\s+\.?/?client/node-renderer\.js\b}
+      # Detects an existing Node Renderer process entry. The dedicated
+      # `node-renderer:` label is reserved for the Pro Node Renderer, so any
+      # entry with that label is treated as the user's renderer regardless of
+      # the command (avoiding duplicate-label appends). A bare `renderer:`
+      # label could be anything (e.g. `renderer: vite ...`), so it only counts
+      # when the command actually launches a node-renderer — otherwise the
+      # generator would emit a misleading "update it manually" warning for an
+      # unrelated process.
+      NODE_RENDERER_PROCESS_REGEX = %r{
+        ^[ \t]*(?:
+          node-renderer:
+          |
+          renderer:[^\n]*(?:
+            \bnode\s+\.?/?(?:renderer|client)/node-renderer\.js\b
+            |
+            \b(?:pnpm|npm|yarn)\s+(?:run\s+)?node-renderer\b
+          )
+        )
+      }x
       # Creates renderer/node-renderer.js unless either the new path or the legacy
       # client/node-renderer.js already exists.
       #
       # @return [Boolean] true when a legacy client/node-renderer.js was detected
-      #   (caller should skip add_pro_to_procfile to avoid pointing Procfile.dev
+      #   (caller should skip add_pro_to_procfiles to avoid pointing Procfile.dev
       #   at a file that wasn't created); false otherwise.
       def create_node_renderer
         node_renderer_path = "renderer/node-renderer.js"
@@ -236,8 +313,12 @@ module ReactOnRails
           say "ℹ️  #{legacy_node_renderer_path} detected, keeping existing renderer; " \
               "to migrate, move it to #{node_renderer_path} and update any references " \
               "(e.g. Procfile.dev, Procfile.prod, Docker CMD / command):", :yellow
-          say "      node-renderer: RENDERER_LOG_LEVEL=debug RENDERER_PORT=${RENDERER_PORT:-3800} " \
-              "node #{node_renderer_path}", :yellow
+          say "      #{node_renderer_procfile_command('Procfile.dev')}", :yellow
+          say set_color(
+            "⚠️  Ensure the password in #{legacy_node_renderer_path} matches " \
+            "config/initializers/react_on_rails_pro.rb. Both must use the same RENDERER_PASSWORD.",
+            :yellow
+          )
           warn_on_stale_legacy_procfile_entry
           return true
         end
@@ -246,41 +327,55 @@ module ReactOnRails
 
         empty_directory("renderer")
 
-        template_path = "templates/pro/base/renderer/node-renderer.js"
-        copy_file(template_path, node_renderer_path)
+        template_path = "templates/pro/base/renderer/node-renderer.js.tt"
+        template(template_path, node_renderer_path)
 
         say "✅ Created #{node_renderer_path}", :green
         false
       end
 
-      # When a legacy client/node-renderer.js is detected, add_pro_to_procfile is
-      # skipped, so surface a pointed warning if Procfile.dev still launches the
-      # legacy entry. This nudges the user to update the exact line they need to
-      # touch rather than leaving them to diff the generic migration hint against
-      # their Procfile themselves.
+      # When a legacy client/node-renderer.js is detected, add_pro_to_procfiles is
+      # skipped, so surface a pointed warning for each Procfile that still
+      # launches the legacy entry. This nudges the user to update the exact
+      # line(s) they need to touch rather than leaving them to diff the generic
+      # migration hint against their Procfiles themselves.
       def warn_on_stale_legacy_procfile_entry
-        procfile_path = File.join(destination_root, "Procfile.dev")
-        return unless File.exist?(procfile_path)
+        ReactOnRails::NodeRendererProcfile::DEFAULT_COMMANDS.each_key do |procfile|
+          procfile_path = File.join(destination_root, procfile)
+          next unless File.exist?(procfile_path)
 
-        procfile_content = File.read(procfile_path)
-        return unless procfile_content.match?(LEGACY_RENDERER_COMMAND_REGEX)
+          procfile_content = File.read(procfile_path)
+          next unless procfile_content.match?(LEGACY_RENDERER_COMMAND_REGEX)
 
-        GeneratorMessages.add_warning(<<~MSG.strip)
-          ⚠️  Procfile.dev still launches the legacy client/node-renderer.js.
-          After migrating the renderer file, update that line to:
-            node-renderer: RENDERER_LOG_LEVEL=debug RENDERER_PORT=${RENDERER_PORT:-3800} node renderer/node-renderer.js
-        MSG
+          GeneratorMessages.add_warning(<<~MSG.strip)
+            ⚠️  #{procfile} still launches the legacy client/node-renderer.js.
+            After migrating the renderer file, update that line to:
+              #{node_renderer_procfile_command(procfile)}
+          MSG
+        end
       end
 
-      def add_pro_to_procfile
-        procfile_path = File.join(destination_root, "Procfile.dev")
+      def node_renderer_procfile_command(procfile)
+        ReactOnRails::NodeRendererProcfile.command_for(procfile)
+      end
+
+      def add_pro_to_procfiles
+        ReactOnRails::NodeRendererProcfile::DEFAULT_COMMANDS.each do |procfile, command|
+          add_node_renderer_to_procfile(procfile, command, warn_if_missing: procfile == "Procfile.dev")
+        end
+      end
+
+      def add_node_renderer_to_procfile(procfile, command, warn_if_missing:)
+        procfile_path = File.join(destination_root, procfile)
 
         unless File.exist?(procfile_path)
+          return unless warn_if_missing
+
           GeneratorMessages.add_warning(<<~MSG.strip)
-            ⚠️  Procfile.dev not found. Skipping Node Renderer process addition.
+            ⚠️  #{procfile} not found. Skipping Node Renderer process addition.
 
             You'll need to add the Node Renderer to your process manager manually:
-              node-renderer: RENDERER_LOG_LEVEL=debug RENDERER_PORT=${RENDERER_PORT:-3800} node renderer/node-renderer.js
+              #{command}
           MSG
           return
         end
@@ -288,29 +383,28 @@ module ReactOnRails
         procfile_content = File.read(procfile_path)
 
         if procfile_content.match?(NEW_RENDERER_COMMAND_REGEX)
-          say "ℹ️  Node Renderer already in Procfile.dev, skipping", :yellow
+          say "ℹ️  Node Renderer already in #{procfile}, skipping", :yellow
           return
         end
 
-        if procfile_content.match?(/^[ \t]*node-renderer:/)
-          say "⚠️  Procfile.dev has a node-renderer: entry that doesn't reference " \
+        if procfile_content.match?(NODE_RENDERER_PROCESS_REGEX)
+          say "⚠️  #{procfile} has a renderer entry that doesn't reference " \
               "renderer/node-renderer.js. Update it manually to:", :yellow
-          say "      node-renderer: RENDERER_LOG_LEVEL=debug RENDERER_PORT=${RENDERER_PORT:-3800} " \
-              "node renderer/node-renderer.js", :yellow
+          say "      #{command}", :yellow
           return
         end
 
-        say "📝 Adding Node Renderer to Procfile.dev...", :yellow
+        say "📝 Adding Node Renderer to #{procfile}...", :yellow
 
         node_renderer_line = <<~PROCFILE
 
           # React on Rails Pro - Node Renderer for SSR
-          node-renderer: RENDERER_LOG_LEVEL=debug RENDERER_PORT=${RENDERER_PORT:-3800} node renderer/node-renderer.js
+          #{command}
         PROCFILE
 
-        append_to_file("Procfile.dev", node_renderer_line)
+        append_to_file(procfile, node_renderer_line)
 
-        say "✅ Added Node Renderer to Procfile.dev", :green
+        say "✅ Added Node Renderer to #{procfile}", :green
       end
 
       # Update webpack configs to enable Pro settings.
@@ -542,7 +636,7 @@ module ReactOnRails
       def defer_pro_gem_install_to_gemfile_swap
         return false unless base_react_on_rails_gem_in_gemfile?
 
-        mark_pro_gem_installed!
+        defer_pro_gem_install!
         true
       end