recourse 7.9.0 → 7.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '024485f23e83a52580fa55b3d73f858bf737ab1a2fd5e53819f283aaf29a57e3'
-  data.tar.gz: f1aaa536fd9085f5baa7b54cf9590d0387aa79bc65173a9ab97a853ffacbdbe9
+  metadata.gz: 610ac68c2716a148665b9f985093497b80e2f0ea6a81c36d67dd755f893e9578
+  data.tar.gz: 1873ac63684cc244015ebf85e2f546c153d8bb9f25dac4fc6af3edf111eae9e2
 SHA512:
-  metadata.gz: bbad80f3cda8598fb3773e8caad5b887aa02354a8dd2ba56f289669ae456a4ebca178830d20900cb0ec95a73c641cf95d9d47698c85654a48abd5a5eaa78214e
-  data.tar.gz: 07daefa230e19c573044eb613716eafa6d347cdeceb19e1d72af511696a458abb3e4771fb2d91f5784adb5e8053ef8f172e6f08dab09b3011acab7f6336b933c
+  metadata.gz: aa8bb20d6ff74bacae5c30b6c7c2e88b2c38650e95a8c00f0057709489f187c8a3d34d2b05400234cf016ab9616516cb53f8fb3d94b33d7b639b4467a7cd15d5
+  data.tar.gz: aa25b208196893588ed3289b70461cfa161e727b99dba194aae89cd8dc14c8815bf2d66da5d9b10edda6cf675b0a1638d707934af52a125258ef69542a77dbdd

data/CHANGELOG.md

@@ -7,6 +7,29 @@ For more information about changelogs, check [Keep a Changelog](http://keepachan
 
 ## [Unreleased]
 
+## 7.11.0 - 2026-09-26
+
+* [FEATURE] A host can say which pages are the same for everybody, and they are sent to be kept
+
+  `Recourse.public_pages = -> { !signed_in? }` runs in the controller for every request. A GET
+  it approves is sent `Cache-Control: public` with `max-age`, `s-maxage`, `stale-while-revalidate`
+  and `stale-if-error` (`Recourse.public_cache` sets the seconds), and `Vary: Turbo-Frame`. It is
+  drawn once for everybody, so none of what the reader's own browser tells the server is in
+  it: not their zone, not their page size, not their density (the layout widens the page in
+  the browser instead), no form token and no way out. `Recourse.public_version = -> { … }` gives
+  such a page an ETag, so a CDN or a browser asks whether it stands and is told `304`. A frame's
+  request is never public: the same address answers a page.
+
+## 7.10.0 - 2026-09-26
+
+* [FEATURE] The sidebar's foot says what each icon does
+
+  The moon, the sun, the way in and the way out each open a tooltip to the right, away
+  from the sidebar's edge, the way a column's icon opens one above it: `Dark theme`,
+  `Light theme`, `Sign in` and `Sign out`. A host that answers `exit_name` with whoever is
+  signed in earns `Sign out N-100L`. The words are `recourse.dark_theme`, `light_theme`,
+  `sign_out` and `sign_out_as` in the locale.
+
 ## 7.9.0 - 2026-09-26
 
 * [FEATURE] A pin or an area on a map leads to its row's page

data/app/controllers/concerns/recourse/paging.rb

@@ -8,7 +8,12 @@ module Recourse
     # a stranger can write, and an unchecked one is `?limit=100000` by another route.
     # Which is also why pagy's `max_limit` stays unset: the query string is still not
     # asked, and this is the one thing that is.
+    #
+    # A page drawn once for everybody has the first size, whatever this reader chose: the
+    # switch under the table redraws the table alone, which is not that page.
     def recourse_limit
+      return Recourse::LIMITS.first if public_page?
+
       limit = cookies[Recourse::LIMIT_STORAGE].to_i
 
       Recourse::LIMITS.include?(limit) ? limit : Recourse::LIMITS.first

data/app/controllers/concerns/recourse/public_caching.rb

@@ -0,0 +1,45 @@
+module Recourse
+  # A page the host says is the same for everybody is sent for everybody to keep: a CDN
+  # in front of the host serves it for a day, and asks the host only when it must.
+  module PublicCaching
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :cache_for_everybody
+      helper_method :public_page?
+    end
+
+  private
+
+    # Whether this page is drawn once for everybody. Only a read: a page that changes
+    # something is nobody else's, and a frame's request is answered with the frame alone,
+    # which the same address answers with a whole page. Asked once per request, since the
+    # host's answer may be a query and the layout, the zone and the paging all ask.
+    def public_page?
+      return @public_page if defined? @public_page
+
+      @public_page = Recourse.public_pages.present? && (request.get? || request.head?) &&
+                     !turbo_frame_request? && instance_exec(&Recourse.public_pages)
+    end
+
+    def cache_for_everybody
+      return unless public_page?
+
+      response.cache_control.merge! public_cache_control
+      response.headers['Vary'] = [response.headers['Vary'], 'Turbo-Frame'].compact_blank.join ', '
+      version = Recourse.public_version
+      fresh_when etag: instance_exec(&version) if version
+    end
+
+    # `s-maxage` is the CDN's alone: the reader's browser keeps the page for `max-age`.
+    def public_cache_control
+      keep = Recourse.public_cache
+
+      {
+        public: true, max_age: keep[:max_age], extras: ["s-maxage=#{keep[:shared_max_age]}"],
+        stale_while_revalidate: keep[:stale_while_revalidate],
+        stale_if_error: keep[:stale_if_error],
+      }
+    end
+  end
+end

data/app/controllers/concerns/recourse/zoning.rb

@@ -20,7 +20,11 @@ module Recourse
     # Nil where the browser has not said, or said something no zone answers to — and
     # `Time.zone = nil` falls back to the host's own setting, so an absent cookie and a
     # forged one both leave the page exactly as it is drawn today.
+    # And nil for a page drawn once for everybody, whose times are the host's own: this
+    # reader's zone is no business of the next reader's page.
     def recourse_zone
+      return if public_page?
+
       name = cookies[Recourse::ZONE_STORAGE]
 
       ActiveSupport::TimeZone[name] if name.present?

data/app/controllers/recourse/base_controller.rb

@@ -5,8 +5,8 @@ module Recourse
   class BaseController < ApplicationController
     include Pagy::Method, Positioned, AttachmentResolution, AttachmentWriting,
             Landing, Paging, ListResolution, ParameterResolution, ParentNaming,
-            ParentResolution, ReferenceResolution, ResourceResolution, Retrieving,
-            Weeks, Zoning
+            ParentResolution, PublicCaching, ReferenceResolution, ResourceResolution,
+            Retrieving, Weeks, Zoning
 
     helper Helpers
 

data/app/views/layouts/recourses.html.erb

@@ -11,7 +11,8 @@
         never has to be remembered here. -%>
     <meta name='turbo-refresh-method' content='morph'>
     <meta name='turbo-refresh-scroll' content='preserve'>
-    <%= csrf_meta_tags %>
+    <%# No token on a page everybody is shown: the next reader would submit this one's. -%>
+    <%= csrf_meta_tags unless public_page? %>
     <%= csp_meta_tag %>
 
     <%= yield :head %>
@@ -52,6 +53,9 @@
       own: every screen the gem draws is one to read against their clock. -%>
   <body class='<%= class_names 'recourse-shell', 'recourse-expanded': expanded? %>'
         data-controller='timezone' data-timezone-storage-value='<%= Recourse::ZONE_STORAGE %>'>
+    <%# What the reader's browser says, put back before anything is painted, on a page the
+        server drew for everybody: the words beside the sidebar's icons. -%>
+    <%= render 'recourses/density' if public_page? %>
     <%# First in the page, since a phone reads it first: the row of icons at the top,
         above the trail. From 768px the layout's grid seats it beside the content instead,
         under the navbar, whatever order it was written in. -%>

data/app/views/recourses/_density.html.erb

@@ -0,0 +1,10 @@
+<%# The density a reader chose last time, back before the page is painted, as the server was
+    not told: a page drawn once for everybody is compact, and this widens it. Classic and
+    inline for the reason the scheme is: a module runs after the first paint. -%>
+<script>
+  (function () {
+    if (/(?:^|; )<%= Recourse::DENSITY_STORAGE %>=expanded(?:;|$)/.test(document.cookie)) {
+      document.body.classList.add('recourse-expanded')
+    }
+  })()
+</script>

data/app/views/recourses/_sidebar.html.erb

@@ -11,7 +11,8 @@
 
   <%# The foot of the sidebar: a reader's own say in how the page looks and, where the
       host drew a route named `exit`, the way out beside it — a button, since ending a
-      session is never a GET. Each takes half the row and centers its icon in it, so the
+      session is never a GET. Each icon says what it does in a tooltip that opens to the right,
+      away from the sidebar's edge. Each takes half the row and centers its icon in it, so the
       toggle alone sits in the middle and the two together sit at a quarter and at three
       quarters. Which side of the fold the foot lands on is the layout's business, and so
       is which of the two mode icons shows — the mode may be the system's, which only CSS
@@ -40,11 +41,11 @@
       <%= tag.button type: 'button', class: 'nav-link border-0 bg-transparent',
                      data: scheme_data do %>
         <span class='recourse-scheme-light'>
-          <i class='bi bi-moon-fill'></i>
+          <%= tag.i class: 'bi bi-moon-fill', data: tooltip_data(t('recourse.dark_theme'), placement: 'right') %>
           <span class='recourse-foot-word'><%= t 'recourse.darken' %></span>
         </span>
         <span class='recourse-scheme-dark'>
-          <i class='bi bi-sun-fill'></i>
+          <%= tag.i class: 'bi bi-sun-fill', data: tooltip_data(t('recourse.light_theme'), placement: 'right') %>
           <span class='recourse-foot-word'><%= t 'recourse.lighten' %></span>
         </span>
       <% end %>
@@ -55,14 +56,16 @@
         leads to is a form rather than a change. -%>
     <% if enter? %>
       <%= link_to enter_path, class: 'nav-link border-0 bg-transparent' do %>
-        <i class='bi bi-box-arrow-in-right'></i>
+        <%= tag.i class: 'bi bi-box-arrow-in-right', data: tooltip_data(t('recourse.enter'), placement: 'right') %>
         <span class='recourse-foot-word'><%= t 'recourse.enter' %></span>
       <% end %>
     <% end %>
-    <% if exit? %>
+    <%# Nobody in particular is signed in on a page drawn once for everybody, and the button
+        carries a token that is theirs alone. -%>
+    <% if exit? && !public_page? %>
       <%= button_to exit_path, method: :delete, class: 'nav-link border-0 bg-transparent',
                     form: { data: { turbo: false } } do %>
-        <i class='bi bi-box-arrow-right'></i>
+        <%= tag.i class: 'bi bi-box-arrow-right', data: tooltip_data(exit_tooltip, placement: 'right') %>
         <span class='recourse-foot-word'><%= t 'recourse.exit' %></span>
       <% end %>
     <% end %>

data/config/locales/recourse.en.yml

@@ -47,12 +47,15 @@ en:
     create: Create
     created: "%{record} was created."
     created_error: "%{model} could not be created."
+    dark_theme: Dark theme
     darken: Dark
     delete: Delete %{model}
     deleted: "%{model} was deleted."
     deleted_error: "%{model} could not be deleted."
     destroy: Delete
     exit: Exit
+    sign_out: Sign out
+    sign_out_as: "Sign out %{name}"
     enter: Sign in
     displaying:
       one: Displaying 1 item
@@ -67,6 +70,7 @@ en:
     items:
       one: 1 item
       other: "%{count} items"
+    light_theme: Light theme
     lighten: Light
     missing_model: You declared `recourses :%{name}` in your routes file, but this app
       has no %{model} model.

data/lib/recourse/helpers/densities.rb

@@ -5,8 +5,9 @@ module Recourse
     private
 
       # Whether the reader asked for the words: the cookie the arrows write, read back so
-      # the page arrives expanded rather than compact and then widened by a script.
-      def expanded? = cookies[Recourse::DENSITY_STORAGE] == 'expanded'
+      # the page arrives expanded rather than compact and then widened by a script. Not on a
+      # page drawn once for everybody, which the layout's own script widens in the browser.
+      def expanded? = !public_page? && cookies[Recourse::DENSITY_STORAGE] == 'expanded'
 
       # What the arrows need to switch: the class they toggle and the cookie they write.
       def density_data

data/lib/recourse/helpers/sidebars.rb

@@ -17,6 +17,15 @@ module Recourse
       # in still sees it is the host's to say, by answering this for them.
       def enter? = respond_to? :enter_path
 
+      # Who is signed in, as the way out names them: `Sign out N-100L`. Nil, as it is where
+      # the host does not say, leaves the tooltip at `Sign out`.
+      def exit_name = nil
+
+      # What the way out's tooltip says.
+      def exit_tooltip
+        exit_name.present? ? t('recourse.sign_out_as', name: exit_name) : t('recourse.sign_out')
+      end
+
       # Sidebar entries as [name, title, path, key], in the order routes.rb declares
       # them, `key` being where in the title the letter that reaches it sits.
       def sidebar_resources

data/lib/recourse/public_caches.rb

@@ -0,0 +1,36 @@
+# Reopened for what a host says about the pages a shared cache may keep for everybody.
+module Recourse
+  # How long each keeper may hold a page a host called cacheable: the reader's browser
+  # (`max_age`), a CDN in front of the host (`shared_max_age`), and for how long past
+  # that either may show an old page while a new one is fetched (`stale_while_revalidate`)
+  # or when the host does not answer (`stale_if_error`). In seconds.
+  PUBLIC_CACHE = {
+    max_age: 300, shared_max_age: 86_400, stale_while_revalidate: 86_400, stale_if_error: 604_800,
+  }.freeze
+
+  class << self
+    # A Proc answering, for one request, whether its page is the same for everybody: run
+    # in the controller, so `request` and whatever the host knows of who is reading are
+    # there to ask. Nil, as it is until a host says, keeps every page private to the
+    # reader, as before. A page it approves is sent with `public` cache headers, and is
+    # drawn with none of what a reader's own browser tells the server — their zone, their
+    # page size, their density, a form's token — since that page will be shown to others.
+    attr_accessor :public_pages
+
+    # A Proc answering what a public page's ETag is made of, in the controller: whatever
+    # changes when the page would, and nothing that changes when it would not. A browser or
+    # a CDN then asks whether it still stands and is told `304`, which costs a
+    # `SELECT` and no render. Nil sends no ETag of the gem's own.
+    attr_accessor :public_version
+
+    # The numbers PUBLIC_CACHE holds, or a host's own where it has said.
+    attr_writer :public_cache
+
+    # @return [Hash{Symbol => Integer}] the seconds each keeper keeps a public page for.
+    def public_cache = PUBLIC_CACHE.merge(@public_cache || {})
+  end
+
+  @public_pages = nil
+  @public_version = nil
+  @public_cache = nil
+end

data/lib/recourse/version.rb

@@ -1,4 +1,4 @@
 module Recourse
   # Version of the gem, read by the gemspec and by hosts checking compatibility.
-  VERSION = '7.9.0'
+  VERSION = '7.11.0'
 end

data/lib/recourse.rb

@@ -25,6 +25,7 @@ require_relative 'recourse/maps'
 require_relative 'recourse/orders'
 require_relative 'recourse/positions'
 require_relative 'recourse/positioning'
+require_relative 'recourse/public_caches'
 require_relative 'recourse/writes'
 require_relative 'recourse/zones'
 require_relative 'recourse/positionable'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: recourse
 version: !ruby/object:Gem::Version
-  version: 7.9.0
+  version: 7.11.0
 platform: ruby
 authors:
 - claudiob
@@ -144,6 +144,7 @@ files:
 - app/controllers/concerns/recourse/parent_naming.rb
 - app/controllers/concerns/recourse/parent_resolution.rb
 - app/controllers/concerns/recourse/positioned.rb
+- app/controllers/concerns/recourse/public_caching.rb
 - app/controllers/concerns/recourse/reference_resolution.rb
 - app/controllers/concerns/recourse/resource_resolution.rb
 - app/controllers/concerns/recourse/retrieving.rb
@@ -159,6 +160,7 @@ files:
 - app/views/recourses/_card.html.erb
 - app/views/recourses/_color.html.erb
 - app/views/recourses/_combobox.html.erb
+- app/views/recourses/_density.html.erb
 - app/views/recourses/_fields.html.erb
 - app/views/recourses/_footer.html.erb
 - app/views/recourses/_form.html.erb
@@ -254,6 +256,7 @@ files:
 - lib/recourse/positionable.rb
 - lib/recourse/positioning.rb
 - lib/recourse/positions.rb
+- lib/recourse/public_caches.rb
 - lib/recourse/recoursive.rb
 - lib/recourse/registry.rb
 - lib/recourse/routes.rb