reactive_component 0.7.1 → 0.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6897d1bd7689445185a2a06d80b868778d1dca89fa15bf1cbbc81ac31ce2ccb2
-  data.tar.gz: a285c182b5fea6ab970d8d0f609237f81a98d7724d95c88a8f595dce121b361f
+  metadata.gz: 8ef3f09713ddda3cdec03ffd6dac861df951589a1b077504a7ea1323e6ac8d73
+  data.tar.gz: a08ef29771672722c29145c51f15a9b159d0b9487d801dec2a045d0a5ebf0127
 SHA512:
-  metadata.gz: d8c1a5eaddc568b0c8aa20e88a18e7631633d46d344892d447ed0bbe6b12513b7637c0b00794d19679ef2f3da13d1ba012a1559540f754f911c5b2f2179230f1
-  data.tar.gz: 1b6ec87280c44844c8b93350d21f255280bce22ed79cf192234c6319f1f30971f5e0947e34433c2ee19a72fde6535f31b3a7ccfe5dac3800a10fdc28e50f72fe
+  metadata.gz: e7142557dca9daff0f7f5b9a6034144228d47578c417e1a9e959694f8ec0e62371fe4757bffc16738ef7ed8879f40cffa53b347887a5a1a9cb153ce63f7756fc
+  data.tar.gz: 92e76f033d5883773851f94f551499c78072a33624fe016ce579834be04e1cfcad000c0e8ba6009500fa2477c05fa3ca401cc755c061c2d86b736a430d224d46

data/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.7.2] - 2026-09-07
+
+### Security
+- The actions endpoint enforces CSRF itself with `protect_from_forgery`
+  instead of relying on the host's `load_defaults`.
+- `live_action` tokens expire after `ReactiveComponent.action_token_ttl`
+  (default one day). Before, a token stayed valid forever.
+- `request_update` passes only declared `client_state` fields to the
+  component. Any other client key was set as an instance variable and
+  handed to the constructor.
+- `request_update` over the channel only answers for records whose
+  `broadcasts` stream is the one the subscriber verified. Before, any
+  subscriber could pull the rendered data of any record id of the model.
+- The channel resolves the component name with `safe_constantize` and
+  requires a class that includes `ReactiveComponent`.
+
+### Fixed
+- The renderer controller imports its utils by bare specifier again. The
+  0.7.1 relative import resolved to an undigested `/assets/` URL under
+  Propshaft and 404ed, which left Turbo stream sources never connecting and
+  every system test failing. The bare specifier works for both importmap
+  (`pin_all_from`) and npm (`exports`).
+
 ## [0.7.1] - 2026-09-06
 
 ### Added

data/app/channels/reactive_component/channel.rb

@@ -7,9 +7,9 @@ module ReactiveComponent
     class_attribute :filter_callback, default: nil
 
     def subscribed
-      stream_name = verified_stream_name
-      if stream_name
-        stream_from stream_name
+      @stream_name = verified_stream_name
+      if @stream_name
+        stream_from @stream_name
       else
         reject
       end
@@ -20,12 +20,8 @@ module ReactiveComponent
     end
 
     def request_update(data)
-      component_class = data['component'].constantize
       params = data['params'] || {}
-
-      model_class = component_class.live_model_class
-      record_id = data['record_id'] || params.delete('record_id')
-      record = model_class.find_by(id: record_id)
+      component_class, record = subscribed_component_and_record(data, params)
       return unless record
 
       if data['record_id'].present?
@@ -35,13 +31,32 @@ module ReactiveComponent
           transmit({ 'action' => 'remove', 'dom_id' => data['dom_id'] })
         end
       else
-        result = component_class.build_data(record, **params.symbolize_keys)
+        client_state = params.slice(*component_class._client_state_fields.keys.map(&:to_s))
+        result = component_class.build_data(record, **client_state.symbolize_keys)
         transmit({ 'action' => 'render', 'data' => result })
       end
     end
 
     private
 
+    # The component must be a reactive component and the record must broadcast
+    # to the stream this subscriber verified: the same stream the wrapper
+    # signed into the page. Anything else is a guess at a record id the client
+    # was never shown.
+    def subscribed_component_and_record(data, params)
+      component_class = data['component'].to_s.safe_constantize
+      return unless component_class.is_a?(Class) && component_class.include?(ReactiveComponent)
+
+      record = component_class.live_model_class.find_by(id: data['record_id'] || params.delete('record_id'))
+      return unless record
+
+      stream = ReactiveComponent::Wrapper.find_stream_for(component_class, record)
+      signed = Turbo::StreamsChannel.signed_stream_name(stream)
+      return unless Turbo::StreamsChannel.verified_stream_name(signed) == @stream_name
+
+      [component_class, record]
+    end
+
     def record_matches?(record, params)
       return true unless self.class.filter_callback
 

data/app/controllers/reactive_component/actions_controller.rb

@@ -2,6 +2,8 @@
 
 module ReactiveComponent
   class ActionsController < ActionController::Base
+    protect_from_forgery with: :exception
+
     def create
       payload = verify_token!.symbolize_keys
       component_class = payload[:c].constantize

data/app/javascript/reactive_component/controllers/reactive_renderer_controller.js

@@ -1,6 +1,6 @@
 import { Controller } from "@hotwired/stimulus"
 import { createConsumer } from "@rails/actioncable"
-import { compileTemplate, decompress, morphElement, buildActionBody, routeMessage, duplicateIds, strictData } from "../lib/reactive_renderer_utils.js"
+import { compileTemplate, decompress, morphElement, buildActionBody, routeMessage, duplicateIds, strictData } from "reactive_component/lib/reactive_renderer_utils"
 
 const consumer = createConsumer()
 const log = (...args) => {
@@ -21,6 +21,18 @@ function subscribe(streamValue, controller) {
     sub = consumer.subscriptions.create(
       { channel: "ReactiveComponent::Channel", signed_stream_name: streamValue },
       {
+        connected() {
+          sub._connected = true
+          for (const handler of sub.handlers || []) {
+            handler.subscriptionConnected()
+          }
+        },
+        disconnected() {
+          sub._connected = false
+          for (const handler of sub.handlers || []) {
+            handler.subscriptionDisconnected()
+          }
+        },
         received: async (message) => {
           const decoded = message.z ? await decompress(message.z) : message
           for (const handler of sub.handlers) {
@@ -32,6 +44,7 @@ function subscribe(streamValue, controller) {
     sub.handlers = new Set()
   }
   sub.handlers.add(controller)
+  if (sub._connected) controller.subscriptionConnected()
 }
 
 function unsubscribe(streamValue, controller) {
@@ -90,6 +103,14 @@ export default class extends Controller {
     }
   }
 
+  subscriptionConnected() {
+    this.element.setAttribute("data-reactive-renderer-connected", "")
+  }
+
+  subscriptionDisconnected() {
+    this.element.removeAttribute("data-reactive-renderer-connected")
+  }
+
   resolveTemplate() {
     if (this.hasTemplateValue) return this.templateValue
 

data/lib/reactive_component/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReactiveComponent
-  VERSION = '0.7.1'
+  VERSION = '0.7.2'
 end

data/lib/reactive_component.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'active_support/core_ext/integer/time'
 require 'active_support/concern'
 
 require_relative 'reactive_component/version'
@@ -14,6 +15,8 @@ module ReactiveComponent
 
   mattr_accessor :debug, default: false
   mattr_accessor :renderer, default: nil
+  # How long a live_action token minted into a page stays valid.
+  mattr_accessor :action_token_ttl, default: 1.day
 
   class Error < StandardError; end
 
@@ -204,7 +207,7 @@ module ReactiveComponent
     def live_action_token(record)
       live_action_verifier.generate(
         { c: name, m: record.class.name, r: record.id },
-        purpose: :reactive_component_action
+        purpose: :reactive_component_action, expires_in: ReactiveComponent.action_token_ttl
       )
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: reactive_component
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.7.2
 platform: ruby
 authors:
 - Przemyslaw Lusar