react_on_rails_pro 16.5.1 → 16.6.0.rc.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 555e14ff0b3a9fe0dbdf0d03195d25512f535ce488f426f8258af5dde9e93fa3
-  data.tar.gz: 2aa2508ce583c9b6c3907f990d8a07ce151c122a610524f89ea8a4b5fc75218c
+  metadata.gz: f373b7e8f1b22b6a346f76eee9e85bf438104439a5d6250ccd8be773cbbdf86d
+  data.tar.gz: a846f06b5f699c0bf61404237593be4d72e105cec55a152a77ecc80de549efd0
 SHA512:
-  metadata.gz: 58c950e2ace03c47a86777a398e8260d1ab67a0d28a9838431be74e181c6345af08e8ecf99d8500a179a4c62c9e871af9aa1ceef5991f199452cc2c3cdea0b6a
-  data.tar.gz: 8df15aa0b502450842d744049f7f17aff8843b0afddccf0d97cdb926d0497fdf26cb6e834ca781ec4bd532e9ddf01bc237d14643a088eb8f854d1ea969bb840f
+  metadata.gz: b97234a2ae969d0625912780700bffebe01268b7c183b70b56d1707dd6f0ce012f2b7b8d3ab71315d5667bacbb71188c67bad93715a3171cf063b7a0dbc2d340
+  data.tar.gz: 9433436cd0acf2c2c8a523972946010aa3dc5905d7efc980ce7586bb70bf77b5535deab295f9a5b2fe917c26eca13ce4367dd109184c9df2154c0fab6258c28a

data/CONTRIBUTING.md

@@ -46,7 +46,7 @@ From [How to Write a Git Commit Message](http://chris.beams.io/posts/git-commit/
 
 ## Doc Changes
 
-When making doc changes, we want the change to work on both [the React on Rails docs site](https://reactonrails.com/docs/pro) and when browsing the GitHub repo.
+When making doc changes, we want the change to work on both [the React on Rails docs site](https://reactonrails.com/docs/pro/) and when browsing the GitHub repo.
 For links from docs pages to non-doc files, use full GitHub URLs so links resolve correctly in both contexts.
 
 ### Links to other docs:

data/Gemfile.lock

@@ -9,7 +9,7 @@ GIT
 PATH
   remote: ..
   specs:
-    react_on_rails (16.5.1)
+    react_on_rails (16.6.0.rc.0)
       addressable
       connection_pool
       execjs (~> 2.5)
@@ -20,7 +20,7 @@ PATH
 PATH
   remote: .
   specs:
-    react_on_rails_pro (16.5.1)
+    react_on_rails_pro (16.6.0.rc.0)
       addressable
       async (>= 2.29)
       connection_pool
@@ -29,7 +29,7 @@ PATH
       httpx (~> 1.5)
       jwt (~> 2.7)
       rainbow
-      react_on_rails (= 16.5.1)
+      react_on_rails (= 16.6.0.rc.0)
 
 GEM
   remote: https://rubygems.org/
@@ -217,7 +217,7 @@ GEM
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
     logger (1.7.0)
-    loofah (2.25.0)
+    loofah (2.25.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.9.0)
@@ -249,11 +249,11 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.5)
-    nokogiri (1.19.1-arm64-darwin)
+    nokogiri (1.19.2-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.1-x86_64-darwin)
+    nokogiri (1.19.2-x86_64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.1-x86_64-linux-gnu)
+    nokogiri (1.19.2-x86_64-linux-gnu)
       racc (~> 1.4)
     package_json (0.2.0)
     parallel (1.27.0)

data/lib/react_on_rails_pro/configuration.rb

@@ -229,10 +229,58 @@ module ReactOnRailsPro
     end
 
     def setup_renderer_password
+      # Explicit passwords, including values loaded from ENV in the initializer, skip URL extraction.
+      # Blank values fall through so URL extraction and production validation still catch misconfiguration.
       return if renderer_password.present?
 
       uri = URI(renderer_url)
       self.renderer_password = uri.password
+
+      validate_renderer_password_for_production
+    end
+
+    def validate_renderer_password_for_production
+      # Defense-in-depth: skip validation when a password is already configured (e.g. extracted
+      # from the renderer URL by setup_renderer_password, or set directly in the initializer).
+      return if renderer_password.present?
+      return unless node_renderer?
+
+      # Fail closed: only skip validation when RAILS_ENV is explicitly set to development or test.
+      # Rails.env defaults to "development" when RAILS_ENV is unset, which would silently skip
+      # validation in misconfigured environments. Checking ENV["RAILS_ENV"] directly matches the
+      # Node-side behavior where an unset environment is treated as production-like.
+      rails_env = ENV["RAILS_ENV"]&.downcase
+      return if rails_env.present? && %w[development test].include?(rails_env)
+
+      raise ReactOnRailsPro::Error, <<~MSG
+        RENDERER_PASSWORD must be set in production-like environments (staging, production, etc.)
+        when using the NodeRenderer.
+
+        In development and test environments, the renderer password is optional and no authentication
+        is required. In all other environments, you must explicitly configure a password to secure
+        communication between Rails and the Node Renderer.
+
+        To fix this, set the RENDERER_PASSWORD environment variable and configure it in your initializer:
+
+          # config/initializers/react_on_rails_pro.rb
+          ReactOnRailsPro.configure do |config|
+            config.renderer_password = ENV.fetch("RENDERER_PASSWORD")
+          end
+
+        Then set the same password for the Node Renderer via the RENDERER_PASSWORD environment variable.
+        Note: setting ENV["RENDERER_PASSWORD"] alone is not enough on the Ruby side unless
+        config.renderer_password is explicitly assigned from ENV.
+        An empty-string assignment still counts as missing and will raise in production-like environments.
+        If Rails and the Node Renderer disagree about startup behavior, verify both RAILS_ENV and NODE_ENV.
+
+        Environment matrix:
+          development    — password optional (no authentication)
+          test           — password optional (no authentication)
+          (RAILS_ENV unset) — treated as production-like; RENDERER_PASSWORD required
+          staging        — RENDERER_PASSWORD required
+          production     — RENDERER_PASSWORD required
+          (any other)    — RENDERER_PASSWORD required
+      MSG
     end
   end
 end

data/lib/react_on_rails_pro/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module ReactOnRailsPro
-  VERSION = "16.5.1"
+  VERSION = "16.6.0.rc.0"
   PROTOCOL_VERSION = "2.0.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: react_on_rails_pro
 version: !ruby/object:Gem::Version
-  version: 16.5.1
+  version: 16.6.0.rc.0
 platform: ruby
 authors:
 - Justin Gordon
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-03-28 00:00:00.000000000 Z
+date: 2026-04-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 16.5.1
+        version: 16.6.0.rc.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 16.5.1
+        version: 16.6.0.rc.0
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement