react_on_rails_pro 16.7.0.rc.3 → 17.0.0.rc.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a4266ac7cb6a9cdbb62755a17d95282222b6909e64d41ff7b7a7bcf897c2f0a
-  data.tar.gz: 8372bde1ffd861b8f8026e6fa28f4a9f65130ec6c70a42cdfa09a33f6a449c5a
+  metadata.gz: 318109f164359903fe25daa4f3b63cbd4c6814e0f2cc34d4c91c21bb19ec9590
+  data.tar.gz: b45033f1471e37ee756825b4aa00238229416011efa4054151a58bf942ca9a03
 SHA512:
-  metadata.gz: 40ebe444b6abb44184984519f44a61df910f69e9e0fa73841ae552de49ba799ed872e8fc3bd8d8b0af8ca27c5c88946fa8abc28278fe42ac0603ac3d5de8cfde
-  data.tar.gz: fd3568d5daff73971afddf96575237d2e07a738c972c1f0067e6ac8dc32ed4923c3dbdcf41fbe8dc06cb9d446c48b8544fb30e7ede7e8a57f9606fa2ec25dcc7
+  metadata.gz: 900bc242f0c60afaa7201215e2d9306f1f41d5a5c2f22fa11c8bbcd0e49c3ed54bdfaa59568ddefea8736e3d2719e42a1bff591e9eb11084bb2b566e72013a15
+  data.tar.gz: e8055b9d34b0255730974669b6b1926924e34e14029d478bb62cc49830bdd0e9bfd261670b43f488bb7781a5c7c137a44208d0a20a81f1c7c97bbeef82662749

data/Gemfile.development_dependencies

@@ -8,7 +8,7 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" }
 
 gem "react_on_rails", path: "../"
 
-gem "shakapacker", "9.6.1"
+gem "shakapacker", "10.1.0"
 gem "bootsnap", require: false
 gem "rails", "~> 7.1"
 gem "puma", "~> 6"

data/Gemfile.lock

@@ -9,7 +9,7 @@ GIT
 PATH
   remote: ..
   specs:
-    react_on_rails (16.7.0.rc.3)
+    react_on_rails (17.0.0.rc.0)
       addressable
       connection_pool
       execjs (~> 2.5)
@@ -20,7 +20,7 @@ PATH
 PATH
   remote: .
   specs:
-    react_on_rails_pro (16.7.0.rc.3)
+    react_on_rails_pro (17.0.0.rc.0)
       addressable
       async (>= 2.29)
       async-http (~> 0.95)
@@ -28,7 +28,7 @@ PATH
       io-endpoint (~> 0.17.0)
       jwt (>= 2.5, < 4)
       rainbow
-      react_on_rails (= 16.7.0.rc.3)
+      react_on_rails (= 17.0.0.rc.0)
 
 GEM
   remote: https://rubygems.org/
@@ -296,7 +296,7 @@ GEM
       nio4r (~> 2.0)
     racc (1.8.1)
     rack (3.2.5)
-    rack-proxy (0.7.7)
+    rack-proxy (0.8.2)
       rack
     rack-session (2.1.1)
       base64 (>= 0.1.0)
@@ -425,7 +425,7 @@ GEM
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
     semantic_range (3.1.1)
-    shakapacker (9.6.1)
+    shakapacker (10.1.0)
       activesupport (>= 5.2)
       package_json
       rack-proxy (>= 0.6.1)
@@ -539,7 +539,7 @@ DEPENDENCIES
   sass-rails
   scss_lint
   selenium-webdriver (= 4.9.0)
-  shakapacker (= 9.6.1)
+  shakapacker (= 10.1.0)
   simplecov (~> 0.16.1)
   spring
   spring-watcher-listen

data/app/controllers/react_on_rails_pro/rolling_deploy/bundles_controller.rb

@@ -13,9 +13,11 @@ module ReactOnRailsPro
     # ReactOnRailsPro::RollingDeployAdapters::Http adapter on the next
     # deploy's build CI consumes both endpoints.
     #
-    # Auto-mounted by the engine when `config.rolling_deploy_adapter` is the
-    # Http adapter (or a subclass). Users who need a custom mount path or want
-    # to layer their own auth middleware can mount manually:
+    # Mount this in your application's routes with `draw_routes` so the Http
+    # adapter on the next deploy can reach it. (Engine auto-mount keyed on
+    # `config.rolling_deploy_adapter` is planned for a follow-up but is not
+    # wired yet, so an explicit mount is currently required.) You can also use
+    # a custom mount path or layer your own auth middleware:
     #
     #   # config/routes.rb
     #   ReactOnRailsPro::RollingDeploy::BundlesController.draw_routes(
@@ -23,10 +25,10 @@ module ReactOnRailsPro
     #     path: "/internal/rolling-deploy"
     #   )
     #
-    # Callers that need to mount the controller more than once (for example,
-    # the engine auto-mount plus a user-controlled secondary path) must pass
-    # a distinct `as_prefix:` per call so Rails' named-route registry
-    # doesn't raise `ArgumentError: Invalid route name, already in use`.
+    # Callers that mount the controller more than once (for example, a future
+    # engine auto-mount plus a user-controlled secondary path) must pass a
+    # distinct `as_prefix:` per call so Rails' named-route registry doesn't
+    # raise `ArgumentError: Invalid route name, already in use`.
     #
     # Security:
     #   * Bearer-token auth via `Authorization: Bearer <token>`, constant-time
@@ -56,9 +58,8 @@ module ReactOnRailsPro
       DEFAULT_ROUTE_PREFIX = "react_on_rails_pro_rolling_deploy"
 
       class << self
-        # Helper for users who want to mount manually under a custom path. The
-        # auto-mount path uses these same route definitions via the engine
-        # initializer (see ReactOnRailsPro::Engine).
+        # Helper for mounting the controller in your application's routes. A
+        # planned engine auto-mount will reuse these same route definitions.
         #
         # `as_prefix:` controls the generated named-route helpers
         # (`<prefix>_manifest`, `<prefix>_bundle`). Callers that mount the

data/lib/react_on_rails_pro/configuration.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "set"
+
 module ReactOnRailsPro
   def self.configure
     yield(configuration)
@@ -298,10 +300,13 @@ module ReactOnRailsPro
 
     def validate_url
       URI(renderer_url)
-    rescue URI::InvalidURIError => e
-      message = "Unparseable ReactOnRailsPro.config.renderer_url #{renderer_url} provided.\n" \
-                "#{e.message}"
-      raise ReactOnRailsPro::Error, message
+    rescue URI::InvalidURIError
+      # Deliberately do NOT echo renderer_url or the URI error message: a
+      # malformed renderer_url may embed credentials (https://:password@host),
+      # and reproducing it here would leak the password into logs/error reporters.
+      raise ReactOnRailsPro::Error,
+            "ReactOnRailsPro.config.renderer_url is not a parseable URI. Verify the value " \
+            "(it is not echoed here because it may contain credentials)."
     end
 
     def validate_remote_bundle_cache_adapter
@@ -362,7 +367,7 @@ module ReactOnRailsPro
               "config.rolling_deploy_token is required when using the built-in " \
               "ReactOnRailsPro::RollingDeployAdapters::Http adapter. Generate one " \
               "with SecureRandom.hex(32) and set it on both Rails and your build CI. " \
-              "See docs/pro/rolling-deploy-http-adapter.md."
+              "See docs/pro/rolling-deploy-adapters.md."
       end
       # Compare on `bytesize` (not `length`) so the validator matches the
       # byte-level constant-time check in `BundlesController#authenticate_rolling_deploy_request`.
@@ -376,7 +381,7 @@ module ReactOnRailsPro
             "config.rolling_deploy_token must be at least " \
             "#{ROLLING_DEPLOY_TOKEN_MIN_LENGTH} bytes (got #{token.bytesize}). " \
             "Generate a stronger token with SecureRandom.hex(32). " \
-            "See docs/pro/rolling-deploy-http-adapter.md."
+            "See docs/pro/rolling-deploy-adapters.md."
     end
 
     def validate_rolling_deploy_upload_signature
@@ -450,67 +455,108 @@ module ReactOnRailsPro
     end
 
     def setup_renderer_password
+      resolve_renderer_password
+      # The password is sent to the Node Renderer in the request body, never via
+      # the URL (the HTTP client connects to scheme://host:port and the renderer
+      # authenticates on the body field). A password embedded in renderer_url is
+      # purely a Rails-side config convenience — once resolved above, strip it
+      # from the stored URL so the credential can never leak through any log line
+      # or error message that interpolates renderer_url downstream.
+      strip_renderer_url_userinfo
+    end
+
+    def resolve_renderer_password
       # Explicit passwords, including values loaded from ENV in the initializer, skip URL extraction.
       # Blank values (nil or "") fall through so URL extraction and ENV fallback still apply.
       return if renderer_password.present?
 
-      uri = URI(renderer_url)
-      self.renderer_password = uri.password
+      self.renderer_password = URI(renderer_url).password
 
       # Mirror Node-side defaults: if Rails config and URL are both missing a password,
       # use RENDERER_PASSWORD from env.
       self.renderer_password = ENV.fetch("RENDERER_PASSWORD", nil) if renderer_password.blank?
     end
 
+    def strip_renderer_url_userinfo
+      return if renderer_url.blank?
+
+      uri = URI(renderer_url)
+      return if uri.userinfo.nil?
+
+      # Order matters: URI rejects a password without a user, so clear password first.
+      uri.password = nil
+      uri.user = nil
+      self.renderer_url = uri.to_s
+    end
+
+    KNOWN_WEAK_RENDERER_PASSWORDS = %w[
+      devPassword myPassword1 password changeme admin secret test renderer
+    ].to_set(&:downcase).freeze
+
+    MIN_RENDERER_PASSWORD_LENGTH = 16
+
     def validate_renderer_password_for_production
-      # Defense-in-depth: skip validation when a password is already configured (e.g. extracted
-      # from the renderer URL by setup_renderer_password, or set directly in the initializer).
-      return if renderer_password.present?
       return unless node_renderer?
 
-      # Fail closed: only skip validation when every present runtime env is explicitly
-      # development or test. This mirrors the Node-side runtimeEnvsAllowDevelopmentDefaults()
-      # which checks both NODE_ENV and RAILS_ENV. Checking NODE_ENV here surfaces
-      # misconfigurations (e.g. NODE_ENV=production + RAILS_ENV=development) at Rails boot
-      # time rather than waiting for the Node renderer to reject the request.
       runtime_envs = [ENV.fetch("RAILS_ENV", nil), ENV.fetch("NODE_ENV", nil)].compact_blank.map(&:downcase)
       allowed_envs = %w[development test].freeze
-      return if runtime_envs.any? && runtime_envs.all? { |e| allowed_envs.include?(e) }
+      is_production_like = !(runtime_envs.any? && runtime_envs.all? { |e| allowed_envs.include?(e) })
 
-      raise ReactOnRailsPro::Error, <<~MSG
-        RENDERER_PASSWORD must be set in production-like environments (staging, production, etc.)
-        when using the NodeRenderer.
+      if renderer_password.blank?
+        return unless is_production_like
 
-        In development and test environments, the renderer password is optional and no authentication
-        is required. In all other environments, you must explicitly configure a password to secure
-        communication between Rails and the Node Renderer.
+        raise ReactOnRailsPro::Error, <<~MSG
+          RENDERER_PASSWORD must be set in production-like environments (staging, production, etc.)
+          when using the NodeRenderer.
 
-        To fix this, set the RENDERER_PASSWORD environment variable:
+          In development and test environments, the renderer password is optional and no authentication
+          is required. In all other environments, you must explicitly configure a password to secure
+          communication between Rails and the Node Renderer.
 
-          export RENDERER_PASSWORD="your-secure-password"
+          To fix this, set the RENDERER_PASSWORD environment variable:
 
-        Rails reads it automatically. If you prefer to make it explicit in your initializer:
+            export RENDERER_PASSWORD="your-secure-password"
 
-          # config/initializers/react_on_rails_pro.rb
-          ReactOnRailsPro.configure do |config|
-            config.renderer_password = ENV.fetch("RENDERER_PASSWORD")
-          end
+          Rails reads it automatically. If you prefer to make it explicit in your initializer:
 
-        Set the same password for the Node Renderer via the RENDERER_PASSWORD environment variable.
-        Rails resolves the password in this order:
-          1) config.renderer_password (blank values fall through to the next step)
-          2) Password embedded in config.renderer_url (for example, https://:password@host:3800)
-          3) ENV["RENDERER_PASSWORD"]
+            # config/initializers/react_on_rails_pro.rb
+            ReactOnRailsPro.configure do |config|
+              config.renderer_password = ENV.fetch("RENDERER_PASSWORD")
+            end
 
-        If Rails and the Node Renderer disagree about startup behavior, verify both RAILS_ENV and NODE_ENV.
+          Set the same password for the Node Renderer via the RENDERER_PASSWORD environment variable.
+          Rails resolves the password in this order:
+            1) config.renderer_password (blank values fall through to the next step)
+            2) Password embedded in config.renderer_url (for example, https://:password@host:3800)
+            3) ENV["RENDERER_PASSWORD"]
 
-        Environment matrix (both RAILS_ENV and NODE_ENV are checked):
-          development/test — password optional when every set env is development or test
-          (both unset)     — treated as production-like; RENDERER_PASSWORD required
-          staging          — RENDERER_PASSWORD required
-          production       — RENDERER_PASSWORD required
-          (mixed envs)     — RENDERER_PASSWORD required (e.g. NODE_ENV=production + RAILS_ENV=development)
-      MSG
+          If Rails and the Node Renderer disagree about startup behavior, verify both RAILS_ENV and NODE_ENV.
+
+          Environment matrix (both RAILS_ENV and NODE_ENV are checked):
+            development/test — password optional when every set env is development or test
+            (both unset)     — treated as production-like; RENDERER_PASSWORD required
+            staging          — RENDERER_PASSWORD required
+            production       — RENDERER_PASSWORD required
+            (mixed envs)     — RENDERER_PASSWORD required (e.g. NODE_ENV=production + RAILS_ENV=development)
+        MSG
+      end
+
+      warn_if_renderer_password_weak
+    end
+
+    def warn_if_renderer_password_weak
+      if KNOWN_WEAK_RENDERER_PASSWORDS.include?(renderer_password.downcase)
+        # Don't log the literal value — even a known-default value is the
+        # user's *current* live credential until they rotate it.
+        Rails.logger.warn "[react_on_rails_pro] renderer_password matches a known-default value. " \
+                          "Set RENDERER_PASSWORD to a random value of at least " \
+                          "#{MIN_RENDERER_PASSWORD_LENGTH} characters."
+      elsif renderer_password.length < MIN_RENDERER_PASSWORD_LENGTH
+        Rails.logger.warn "[react_on_rails_pro] renderer_password is shorter than " \
+                          "#{MIN_RENDERER_PASSWORD_LENGTH} characters " \
+                          "(current length: #{renderer_password.length}). " \
+                          "Consider using a stronger password."
+      end
     end
   end
 end

data/lib/react_on_rails_pro/rolling_deploy_adapters/http.rb

@@ -21,7 +21,7 @@ module ReactOnRailsPro
     # The currently-deployed Rails server already has the bundles + companion
     # assets sitting on disk; this adapter pulls them via authenticated HTTP.
     #
-    # Configuration (see docs/pro/rolling-deploy-http-adapter.md):
+    # Configuration (see docs/pro/rolling-deploy-adapters.md):
     #
     #   ReactOnRailsPro.configure do |config|
     #     config.rolling_deploy_adapter      = ReactOnRailsPro::RollingDeployAdapters::Http
@@ -113,7 +113,7 @@ module ReactOnRailsPro
         # Intentional no-op. The running Rails server IS the artifact store —
         # bundle + companion assets are already on local disk where the
         # mountable BundlesController will serve them on the next deploy's
-        # build CI. Documented in docs/pro/rolling-deploy-http-adapter.md.
+        # build CI. Documented in docs/pro/rolling-deploy-adapters.md.
         def upload(_bundle_hash, bundle:, assets:)
           # See class doc above.
         end

data/lib/react_on_rails_pro/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module ReactOnRailsPro
-  VERSION = "16.7.0.rc.3"
+  VERSION = "17.0.0.rc.0"
   PROTOCOL_VERSION = "2.0.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: react_on_rails_pro
 version: !ruby/object:Gem::Version
-  version: 16.7.0.rc.3
+  version: 17.0.0.rc.0
 platform: ruby
 authors:
 - Justin Gordon
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-05-27 00:00:00.000000000 Z
+date: 2026-05-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -120,14 +120,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 16.7.0.rc.3
+        version: 17.0.0.rc.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 16.7.0.rc.3
+        version: 17.0.0.rc.0
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement