react_on_rails_pro 17.0.1 → 17.1.0.rc.0

data/lib/react_on_rails_pro/concerns/async_rendering.rb

@@ -13,6 +13,8 @@
 # For licensing terms:
 # https://github.com/shakacode/react_on_rails/blob/main/REACT-ON-RAILS-PRO-LICENSE.md
 
+require_relative "../open_telemetry"
+
 module ReactOnRailsPro
   # AsyncRendering enables concurrent rendering of multiple React components.
   # When enabled, async_react_component calls will execute their HTTP requests
@@ -54,14 +56,17 @@ module ReactOnRailsPro
     def wrap_in_async_react_context
       require "async"
       require "async/barrier"
+      parent_context = ReactOnRailsPro::OpenTelemetry.capture_context
 
       Sync do
-        @react_on_rails_async_barrier = Async::Barrier.new
-        yield
-        check_for_unresolved_async_components
-      ensure
-        @react_on_rails_async_barrier&.stop
-        @react_on_rails_async_barrier = nil
+        ReactOnRailsPro::OpenTelemetry.with_context(parent_context) do
+          @react_on_rails_async_barrier = Async::Barrier.new
+          yield
+          check_for_unresolved_async_components
+        ensure
+          @react_on_rails_async_barrier&.stop
+          @react_on_rails_async_barrier = nil
+        end
       end
     end
 

data/lib/react_on_rails_pro/concerns/rsc_payload_renderer.rb

@@ -24,6 +24,8 @@ module ReactOnRailsPro
 
     def rsc_payload
       @rsc_payload_component_name = rsc_payload_component_name
+      return head :forbidden unless rsc_payload_authorized?(@rsc_payload_component_name)
+
       @rsc_payload_component_props =
         begin
           rsc_payload_component_props
@@ -58,6 +60,11 @@ module ReactOnRailsPro
 
     private
 
+    def rsc_payload_authorized?(component_name)
+      authorizer = ReactOnRailsPro.configuration.rsc_payload_authorizer
+      authorizer.nil? || authorizer.call(self, component_name)
+    end
+
     def rsc_payload_component_props
       return {} if params[:props].blank?
 

data/lib/react_on_rails_pro/concerns/stream.rb

@@ -15,6 +15,7 @@
 
 require "English"
 require "erb/util"
+require_relative "../open_telemetry"
 
 module ReactOnRailsPro
   module StreamCacheWrites
@@ -66,8 +67,10 @@ module ReactOnRailsPro
     extend ActiveSupport::Concern
     RENDERER_SERVER_TIMING_COLLECTOR_KEY = :react_on_rails_pro_rsc_stream_renderer_server_timing_entries
     RENDERER_SERVER_TIMING_ATTEMPT_COLLECTOR_KEY = :react_on_rails_pro_rsc_stream_renderer_server_timing_attempt
+    MAX_BROWSER_PERFORMANCE_MARK_FALLBACK_ENTRIES = 200
     private_constant :RENDERER_SERVER_TIMING_COLLECTOR_KEY
     private_constant :RENDERER_SERVER_TIMING_ATTEMPT_COLLECTOR_KEY
+    private_constant :MAX_BROWSER_PERFORMANCE_MARK_FALLBACK_ENTRIES
 
     included do
       include ActionController::Live
@@ -221,16 +224,19 @@ module ReactOnRailsPro
       require_streaming_dependencies
       warn_on_non_html_formats_without_content_type(render_options[:formats], content_type)
       initialize_rsc_stream_observability_state(rsc_stream_observability)
+      parent_context = ReactOnRailsPro::OpenTelemetry.capture_context
 
       Sync do |parent_task|
-        ReactOnRailsPro::Stream.with_renderer_server_timing_collector(renderer_server_timing_collector_for_stream) do
-          stream_view_containing_react_components_in_sync(
-            parent_task,
-            template:,
-            close_stream_at_end:,
-            content_type:,
-            render_options:
-          )
+        ReactOnRailsPro::OpenTelemetry.with_context(parent_context) do
+          ReactOnRailsPro::Stream.with_renderer_server_timing_collector(renderer_server_timing_collector_for_stream) do
+            stream_view_containing_react_components_in_sync(
+              parent_task,
+              template:,
+              close_stream_at_end:,
+              content_type:,
+              render_options:
+            )
+          end
         end
       end
     ensure
@@ -429,7 +435,9 @@ module ReactOnRailsPro
         try{perf.mark(#{mark_name_json});entry.fallback="mark-detail-unavailable";}
         catch(fallbackError){entry.fallback="performance-mark-unavailable";}}
         else{entry.fallback="performance-mark-unavailable";}
-        (self.REACT_ON_RAILS_PERFORMANCE_MARKS=self.REACT_ON_RAILS_PERFORMANCE_MARKS||[]).push(entry);
+        var queue=self.REACT_ON_RAILS_PERFORMANCE_MARKS=self.REACT_ON_RAILS_PERFORMANCE_MARKS||[];
+        queue.push(entry);if(queue.length>#{MAX_BROWSER_PERFORMANCE_MARK_FALLBACK_ENTRIES}){
+        queue.splice(0,queue.length-#{MAX_BROWSER_PERFORMANCE_MARK_FALLBACK_ENTRIES});}
         })()</script>
       HTML
     end

data/lib/react_on_rails_pro/configuration.rb

@@ -31,7 +31,9 @@ module ReactOnRailsPro
       renderer_http_pool_timeout: Configuration::DEFAULT_RENDERER_HTTP_POOL_TIMEOUT,
       renderer_http_pool_warn_timeout: Configuration::DEFAULT_RENDERER_HTTP_POOL_WARN_TIMEOUT,
       renderer_http_keep_alive_timeout: Configuration::DEFAULT_RENDERER_HTTP_KEEP_ALIVE_TIMEOUT,
+      renderer_http_force_http2: Configuration::DEFAULT_RENDERER_HTTP_FORCE_HTTP2,
       renderer_password: nil,
+      license_token: nil,
       tracing: Configuration::DEFAULT_TRACING,
       dependency_globs: Configuration::DEFAULT_DEPENDENCY_GLOBS,
       excluded_dependency_globs: Configuration::DEFAULT_EXCLUDED_DEPENDENCY_GLOBS,
@@ -50,6 +52,7 @@ module ReactOnRailsPro
       raise_non_shell_server_rendering_errors: Configuration::DEFAULT_RAISE_NON_SHELL_SERVER_RENDERING_ERRORS,
       enable_rsc_support: Configuration::DEFAULT_ENABLE_RSC_SUPPORT,
       rsc_payload_generation_url_path: Configuration::DEFAULT_RSC_PAYLOAD_GENERATION_URL_PATH,
+      rsc_payload_authorizer: nil,
       rsc_bundle_js_file: Configuration::DEFAULT_RSC_BUNDLE_JS_FILE,
       react_client_manifest_file: Configuration::DEFAULT_REACT_CLIENT_MANIFEST_FILE,
       react_server_client_manifest_file: Configuration::DEFAULT_REACT_SERVER_CLIENT_MANIFEST_FILE,
@@ -63,14 +66,16 @@ module ReactOnRailsPro
     DEFAULT_RENDERER_URL = "http://localhost:3800"
     DEFAULT_RENDERER_METHOD = "ExecJS"
     DEFAULT_RENDERER_FALLBACK_EXEC_JS = true
-    # Maximum concurrent HTTP/2 streams per persistent client. When Fiber.scheduler is available,
-    # clients are reused across requests within the same scheduler, making this limit effective.
-    # Without a scheduler, clients are per-request and this limits streams on that single request.
+    # Maximum concurrent renderer connections per persistent client. With HTTP/1.1, each connection serves one
+    # request at a time, so this is also the request-concurrency cap for a client shared by a long-lived scheduler.
+    # Without a Fiber.scheduler, streaming renders use an ephemeral client and non-streaming renders use a persistent
+    # per-thread client; this bounds connections within each of those clients.
     DEFAULT_RENDERER_HTTP_POOL_SIZE = 10
     # TCP connect timeout. Request and response processing are still bounded by ssr_timeout.
     DEFAULT_RENDERER_HTTP_POOL_TIMEOUT = 5
     DEFAULT_RENDERER_HTTP_POOL_WARN_TIMEOUT = 0.25
     DEFAULT_RENDERER_HTTP_KEEP_ALIVE_TIMEOUT = 30
+    DEFAULT_RENDERER_HTTP_FORCE_HTTP2 = true
     DEFAULT_SSR_TIMEOUT = 5
     DEFAULT_PRERENDER_CACHING = false
     DEFAULT_TRACING = false
@@ -95,6 +100,7 @@ module ReactOnRailsPro
     DEFAULT_RSC_BUNDLE_JS_FILE = "rsc-bundle.js"
     DEFAULT_REACT_CLIENT_MANIFEST_FILE = "react-client-manifest.json"
     DEFAULT_REACT_SERVER_CLIENT_MANIFEST_FILE = "react-server-client-manifest.json"
+    RSC_PAYLOAD_AUTHORIZER_POSITIONAL_PARAMS = %i[req opt].freeze
     DEFAULT_CONCURRENT_COMPONENT_STREAMING_BUFFER_SIZE = 64
     # Ceiling TTL for a tag->cache-key index entry when the tagged cache entry
     # has no :expires_in of its own (see ReactOnRailsPro::Cache::TagIndex).
@@ -107,7 +113,7 @@ module ReactOnRailsPro
     ROLLING_DEPLOY_UPLOAD_ALL_KEYWORD_PARAMS = %i[keyrest].freeze
     ROLLING_DEPLOY_UPLOAD_REQUIRED_KEYWORDS = %i[bundle assets].freeze
 
-    attr_accessor :renderer_url, :renderer_password, :tracing,
+    attr_accessor :renderer_url, :renderer_password, :license_token, :tracing,
                   :server_renderer, :renderer_use_fallback_exec_js, :prerender_caching,
                   :renderer_http_pool_timeout, :renderer_http_pool_warn_timeout,
                   :dependency_globs, :excluded_dependency_globs, :rendering_returns_promises,
@@ -120,7 +126,8 @@ module ReactOnRailsPro
                   :react_server_client_manifest_file
 
     attr_reader :concurrent_component_streaming_buffer_size, :renderer_http_keep_alive_timeout,
-                :renderer_http_pool_size, :cache_tag_index_expires_in, :cache_tag_index_max_keys
+                :renderer_http_pool_size, :renderer_http_force_http2, :cache_tag_index_expires_in,
+                :cache_tag_index_max_keys, :rsc_payload_authorizer
 
     # Sets how long tag->key index entries live (see Cache::TagIndex).
     #
@@ -164,11 +171,12 @@ module ReactOnRailsPro
       @concurrent_component_streaming_buffer_size = value
     end
 
-    # Sets the maximum concurrent HTTP/2 streams per persistent client.
+    # Sets the maximum concurrent renderer connections per persistent client.
     #
     # When Fiber.scheduler is available (e.g., inside Sync {} blocks), HTTP clients are
     # reused across requests within the same scheduler context, making this limit effective
-    # for connection pooling. Without a scheduler, clients are created per-request.
+    # for connection pooling. Without a Fiber.scheduler, streaming renders use an ephemeral
+    # client and non-streaming renders use a persistent per-thread client.
     #
     # @param value [Integer, nil] A positive integer or nil (uses default)
     # @raise [ReactOnRailsPro::Error] if value is not a positive integer or nil
@@ -194,10 +202,40 @@ module ReactOnRailsPro
       @renderer_http_keep_alive_timeout = value
     end
 
-    def initialize(renderer_url: nil, renderer_password: nil, server_renderer: nil, # rubocop:disable Metrics/AbcSize
+    # Sets whether cleartext renderer connections force HTTP/2 prior knowledge (h2c).
+    #
+    # Set this to false only when the Node Renderer is also configured for HTTP/1.1. Direct HTTP/1.1 connections can
+    # stream in both directions, but async props are not supported through request-buffering or half-duplex proxies.
+    #
+    # @param value [Boolean] true to force h2c for http URLs, false to use HTTP/1.1
+    # @raise [ReactOnRailsPro::Error] if value is not true or false
+    def renderer_http_force_http2=(value)
+      unless [true, false].include?(value)
+        raise ReactOnRailsPro::Error, "config.renderer_http_force_http2 must be true or false"
+      end
+
+      @renderer_http_force_http2 = value
+    end
+
+    def rsc_payload_authorizer=(value)
+      unless value.nil? || value.respond_to?(:call)
+        raise ReactOnRailsPro::Error, "config.rsc_payload_authorizer must be nil or respond to #call"
+      end
+
+      if value && !rsc_payload_authorizer_signature_valid?(value)
+        raise ReactOnRailsPro::Error,
+              "config.rsc_payload_authorizer must accept call(controller, component_name) without required keywords"
+      end
+
+      @rsc_payload_authorizer = value
+    end
+
+    def initialize(renderer_url: nil, renderer_password: nil, license_token: nil, # rubocop:disable Metrics/AbcSize
+                   server_renderer: nil,
                    renderer_use_fallback_exec_js: nil, prerender_caching: nil,
                    renderer_http_pool_size: nil, renderer_http_pool_timeout: nil,
                    renderer_http_pool_warn_timeout: nil, renderer_http_keep_alive_timeout: nil,
+                   renderer_http_force_http2: DEFAULT_RENDERER_HTTP_FORCE_HTTP2,
                    tracing: nil,
                    dependency_globs: nil, excluded_dependency_globs: nil, rendering_returns_promises: nil,
                    remote_bundle_cache_adapter: nil, rolling_deploy_adapter: nil,
@@ -206,7 +244,7 @@ module ReactOnRailsPro
                    ssr_pre_hook_js: nil, assets_to_copy: nil,
                    renderer_request_retry_limit: nil, throw_js_errors: nil, ssr_timeout: nil,
                    profile_server_rendering_js_code: nil, raise_non_shell_server_rendering_errors: nil,
-                   enable_rsc_support: nil, rsc_payload_generation_url_path: nil,
+                   enable_rsc_support: nil, rsc_payload_generation_url_path: nil, rsc_payload_authorizer: nil,
                    rsc_bundle_js_file: nil, react_client_manifest_file: nil,
                    react_server_client_manifest_file: nil,
                    concurrent_component_streaming_buffer_size: DEFAULT_CONCURRENT_COMPONENT_STREAMING_BUFFER_SIZE,
@@ -214,6 +252,7 @@ module ReactOnRailsPro
                    cache_tag_index_max_keys: DEFAULT_CACHE_TAG_INDEX_MAX_KEYS)
       self.renderer_url = renderer_url
       self.renderer_password = renderer_password
+      self.license_token = license_token
       self.server_renderer = server_renderer
       self.renderer_use_fallback_exec_js = renderer_use_fallback_exec_js
       self.prerender_caching = prerender_caching
@@ -222,6 +261,7 @@ module ReactOnRailsPro
       self.renderer_http_pool_warn_timeout = renderer_http_pool_warn_timeout
       # Initial assignment applies the default constructor value; warn only when users set this deprecated config.
       assign_initial_renderer_http_keep_alive_timeout(renderer_http_keep_alive_timeout)
+      self.renderer_http_force_http2 = renderer_http_force_http2
       self.tracing = tracing
       self.rendering_returns_promises = server_renderer == "NodeRenderer" ? rendering_returns_promises : false
       self.dependency_globs = dependency_globs
@@ -242,6 +282,7 @@ module ReactOnRailsPro
       self.raise_non_shell_server_rendering_errors = raise_non_shell_server_rendering_errors
       self.enable_rsc_support = enable_rsc_support
       self.rsc_payload_generation_url_path = rsc_payload_generation_url_path
+      self.rsc_payload_authorizer = rsc_payload_authorizer
       self.rsc_bundle_js_file = rsc_bundle_js_file
       self.react_client_manifest_file = react_client_manifest_file
       self.react_server_client_manifest_file = react_server_client_manifest_file
@@ -318,6 +359,33 @@ module ReactOnRailsPro
 
     private
 
+    def rsc_payload_authorizer_signature_valid?(authorizer)
+      parameters = rsc_payload_authorizer_parameters(authorizer)
+      return false if parameters.any? { |type, _name| type == :keyreq }
+
+      # A non-lambda Proc intentionally ignores surplus positional arguments,
+      # unlike lambdas, Methods, and callable service objects.
+      return true if authorizer.is_a?(Proc) && !authorizer.lambda?
+
+      strict_rsc_payload_authorizer_signature_valid?(parameters)
+    end
+
+    def rsc_payload_authorizer_parameters(authorizer)
+      return authorizer.parameters if authorizer.is_a?(Proc) || authorizer.is_a?(Method)
+
+      authorizer.method(:call).parameters
+    end
+
+    def strict_rsc_payload_authorizer_signature_valid?(parameters)
+      required_positionals = parameters.count { |type, _name| type == :req }
+      accepted_positionals = parameters.count do |type, _name|
+        RSC_PAYLOAD_AUTHORIZER_POSITIONAL_PARAMS.include?(type)
+      end
+      accepts_rest = parameters.any? { |type, _name| type == :rest }
+
+      required_positionals <= 2 && (accepted_positionals >= 2 || accepts_rest)
+    end
+
     def assign_initial_renderer_http_pool_size(value)
       validate_renderer_http_pool_size(value)
       @renderer_http_pool_size = value
@@ -407,8 +475,8 @@ module ReactOnRailsPro
 
     # Only fires when the user has selected the built-in HTTP adapter. Custom
     # adapters that re-use the new config knobs for their own reasons are not
-    # forced through this validation. We do not validate previous_urls here:
-    # an unset list is a valid "discovery off; this is the upload-only side of
+    # forced through this validation. We do not validate previous_url here:
+    # an unset URL is a valid "discovery off; this is the upload-only side of
     # a one-way deploy" mode (the adapter returns [] for previous_bundle_hashes).
     def validate_rolling_deploy_http_adapter_config
       return unless rolling_deploy_http_adapter?

data/lib/react_on_rails_pro/engine.rb

@@ -79,9 +79,13 @@ module ReactOnRailsPro
         when :expired
           expiration = ReactOnRailsPro::LicenseValidator.license_expiration
           expired_on = expiration ? " (expired on #{expiration.strftime('%Y-%m-%d')})" : ""
-          log_license_issue("License has expired#{expired_on}", "Renew your license at #{LICENSE_URL}")
+          log_license_issue(
+            "License has expired#{expired_on}",
+            "Renew your license at #{LICENSE_URL}",
+            warn_outside_production: true
+          )
         when :invalid
-          log_license_issue("Invalid license", "Get a license at #{LICENSE_URL}")
+          log_license_issue("Invalid license", "Get a license at #{LICENSE_URL}", warn_outside_production: true)
         end
       end
 
@@ -109,7 +113,7 @@ module ReactOnRailsPro
 
         message += " Attribution required for this license type." if attribution_required
 
-        Rails.logger.info message
+        Rails.logger.debug message
       end
 
       def plan_display_name(plan)
@@ -126,15 +130,17 @@ module ReactOnRailsPro
         end
       end
 
-      def log_license_issue(issue, action)
+      def log_license_issue(issue, action, warn_outside_production: false)
         prefix = "[React on Rails Pro] #{issue}."
 
         if Rails.env.production?
           warning = "Production Use of React on Rails Pro requires a valid license. " \
                     "If this deployment is Production Use, #{action}"
           Rails.logger.warn "#{prefix} #{warning}"
+        elsif warn_outside_production
+          Rails.logger.warn "#{prefix} #{action}"
         else
-          Rails.logger.info "#{prefix} No license required for development/test environments."
+          Rails.logger.debug "#{prefix} No license required for development/test environments."
         end
       end
     end

data/lib/react_on_rails_pro/error.rb

@@ -24,4 +24,9 @@ module ReactOnRailsPro
             "This is unexpected behavior."
     end
   end
+
+  # Distinguishes a missing renderer bundle from other artifact-construction
+  # failures so cache-key callers can preserve the established missing-RSC
+  # fallback without swallowing unrelated configuration or companion errors.
+  class MissingRendererBundleError < Error; end
 end

data/lib/react_on_rails_pro/license_task_formatter.rb

@@ -54,7 +54,7 @@ module ReactOnRailsPro
       return unless status == :missing
 
       puts ""
-      puts "No license found. Set REACT_ON_RAILS_PRO_LICENSE"
+      puts "No license found. Set config.license_token or REACT_ON_RAILS_PRO_LICENSE"
     end
 
     def print_details(result, info)

data/lib/react_on_rails_pro/license_validator.rb

@@ -41,55 +41,35 @@ module ReactOnRailsPro
     # See: https://bugs.ruby-lang.org/issues/20875
     LICENSE_MUTEX = Mutex.new
 
+    # Explicit tokens receive distinct cache keys so later application configuration
+    # cannot reuse ENV/default metadata. The ENV/default path intentionally retains
+    # one process-lifetime key and the existing reset-required semantics.
+    ENV_LICENSE_CACHE_KEY = Object.new.freeze
+
     class << self
       # Returns the current license status (never raises, never logs)
       # Thread-safe: uses Mutex to prevent race conditions during initialization
       # @return [Symbol] One of :valid, :expired, :invalid, :missing
       def license_status
-        return @license_status if defined?(@license_status)
-
-        LICENSE_MUTEX.synchronize do
-          # Double-check pattern: another thread may have set it while we waited
-          return @license_status if defined?(@license_status)
-
-          @license_status = determine_license_status
-        end
+        fetch_cached_license_value(:@license_status) { determine_license_status }
       end
 
       # Returns the license expiration time if available
       # @return [Time, nil] The expiration time or nil if not available
       def license_expiration
-        return @license_expiration if defined?(@license_expiration)
-
-        LICENSE_MUTEX.synchronize do
-          return @license_expiration if defined?(@license_expiration)
-
-          @license_expiration = determine_license_expiration
-        end
+        fetch_cached_license_value(:@license_expiration) { determine_license_expiration }
       end
 
       # Returns the organization name from the license if available
       # @return [String, nil] The organization name or nil if not available
       def license_organization
-        return @license_organization if defined?(@license_organization)
-
-        LICENSE_MUTEX.synchronize do
-          return @license_organization if defined?(@license_organization)
-
-          @license_organization = determine_license_organization
-        end
+        fetch_cached_license_value(:@license_organization) { determine_license_organization }
       end
 
       # Returns the license plan type if available
       # @return [String, nil] The plan type (e.g., "paid", "startup") or nil if not available
       def license_plan
-        return @license_plan if defined?(@license_plan)
-
-        LICENSE_MUTEX.synchronize do
-          return @license_plan if defined?(@license_plan)
-
-          @license_plan = determine_license_plan
-        end
+        fetch_cached_license_value(:@license_plan) { determine_license_plan }
       end
 
       # Returns whether the product-level attribution is required.
@@ -97,13 +77,7 @@ module ReactOnRailsPro
       # A license JWT cannot waive the requirement.
       # @return [Boolean] True if attribution is required
       def attribution_required?
-        return @attribution_required if defined?(@attribution_required)
-
-        LICENSE_MUTEX.synchronize do
-          return @attribution_required if defined?(@attribution_required)
-
-          @attribution_required = determine_attribution_required
-        end
+        fetch_cached_license_value(:@attribution_required) { determine_attribution_required }
       end
 
       # Returns license information for use in helpers and components
@@ -131,6 +105,30 @@ module ReactOnRailsPro
 
       private
 
+      def fetch_cached_license_value(cache_variable)
+        key = license_cache_key
+        if instance_variable_defined?(cache_variable)
+          cached = instance_variable_get(cache_variable)
+          return cached[:value] if cached[:key] == key
+        end
+
+        LICENSE_MUTEX.synchronize do
+          key = license_cache_key
+          if instance_variable_defined?(cache_variable)
+            cached = instance_variable_get(cache_variable)
+            return cached[:value] if cached[:key] == key
+          end
+
+          value = yield
+          instance_variable_set(cache_variable, { key:, value: }.freeze)
+          value
+        end
+      end
+
+      def license_cache_key
+        ReactOnRailsPro.configuration.license_token&.strip.presence || ENV_LICENSE_CACHE_KEY
+      end
+
       # Determines the license status by loading, decoding, and validating
       # @return [Symbol] The license status
       def determine_license_status
@@ -219,10 +217,12 @@ module ReactOnRailsPro
         true
       end
 
-      # Loads license string from environment variable
+      # Loads the license string from explicit configuration, then the environment.
+      # Blank configured values fall through to preserve the environment-variable default.
       # @return [String, nil] License string or nil if not found
       def load_license_string
-        ENV.fetch("REACT_ON_RAILS_PRO_LICENSE", nil)&.strip.presence
+        configured_token = ReactOnRailsPro.configuration.license_token&.strip.presence
+        configured_token || ENV.fetch("REACT_ON_RAILS_PRO_LICENSE", nil)&.strip.presence
       end
 
       # Decodes and verifies the JWT license