rollout-ui 0.9.1 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e63cbca0b53def021d093e24434d1c3857515164a82f92878f0b832c09b7319a
-  data.tar.gz: 05a822fb2f9ed0e8032681e255fc981dfa70d23f2e061bec5bf59bad6c54f722
+  metadata.gz: 4af968fe0271d80faec7b339779f81a5b8eb9bd06d23b984c7fb5436384b0593
+  data.tar.gz: 4d4ef32df14c4282b72ea2c5f6a3fee00266dd137ea612b211bcab1e9bc0786f
 SHA512:
-  metadata.gz: 3472089c2fe218f5c1bc35911a15239ed79e3c243d91903d2c04f53d09e816893dc2f841ad7d287d7debece8b53d77d39a3b725db27f0f92039cea8959a01db7
-  data.tar.gz: 3844e1d841186b55edb5757f92e3cb48c517ba94beb26c06dcc97ea4ebbe1af44665aed0e882dc61584113dd52ca44aeeef28118a9e49e7c943adbc5a8e5f89a
+  metadata.gz: 6af36b891a09fcf1f5f22abe858c10c266db3c9c48444d58e3a72f38daa1dfa3e444b7e443857d77261d041540c0533501e9548f1ad6e7582902773b0c399f85
+  data.tar.gz: cbeb563460654cb4405a3f2eaaf515426d92311f0ae3eb32dd8eaeea1455262b86e80acb2379c41556459ab579f8cb779cb8923522bdb0dc42c4ff19d67fb369

data/README.md

@@ -62,6 +62,13 @@ Rails.application.routes.draw do
 end
 ```
 
+## Host Header Validation
+
+This gem performs no Host header validation of its own. When mounted inside a Rails app (as shown above), requests already pass through Rails' own `config.hosts` checks before reaching this mount point.
+
+If you run this as a standalone app (e.g. via `rackup`), you're responsible for host header validation in the same way you're responsible for authentication, for example with
+[`Rack::Protection::HostAuthorization`](https://github.com/sinatra/sinatra/tree/main/rack-protection#host-authorization-api) in front of it, or a reverse proxy that only forwards trusted hosts.
+
 ## API Endpoints
 
 The index and show routes can also respond with JSON data instead of HTML when the request's `Accept` header is
@@ -100,6 +107,11 @@ Rollout::UI.configure do
 end
 ```
 
+When using a Rollout version and adapter that support event-aware deletion,
+deletions appear in the overview history with the configured actor. This
+requires global logging (`global: true`); adapters without event-aware deletion
+retain the previous behavior and do not add a deletion event.
+
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/fetlife/rollout-ui.

data/lib/rollout/ui/config.rb

@@ -1,4 +1,3 @@
-require "sinatra"
 require "rollout"
 
 require "rollout/ui/version"

data/lib/rollout/ui/helpers.rb

@@ -1,4 +1,4 @@
-require "sinatra"
+require "rack"
 require "rollout"
 
 require "rollout/ui/version"
@@ -70,6 +70,16 @@ module Rollout::UI
       end
     end
 
+    def formatted_timestamp(time)
+      time.strftime(config.get(:timestamp_format))
+    end
+
+    def relative_timestamp_tag(time)
+      return "" unless time
+
+      %(<span data-timestamp="#{h(time.iso8601)}" title="#{h(formatted_timestamp(time))}">#{h(time_ago(time))}</span>)
+    end
+
     def format_change_key(key)
       key.to_s.gsub('data.', '')
     end
@@ -85,6 +95,25 @@ module Rollout::UI
       end
     end
 
+    def event_actor(event)
+      actor = event.context && event.context[:actor]
+      return "unidentified user" unless actor
+      return h(actor) unless config.defined?(:actor_url)
+
+      %(<a class="underline" href="#{h(config.get(:actor_url, actor))}" target="_blank">#{h(actor)}</a>)
+    end
+
+    def event_summary(event)
+      return "deleted this feature" if event.name.to_s == "delete"
+
+      changes = event.data.fetch(:before).keys.reject { |key| key.to_s == 'data.updated_at' }.map do |key|
+        before = format_change_value(event.data.fetch(:before).fetch(key))
+        after = format_change_value(event.data.fetch(:after).fetch(key))
+        "#{format_change_key(key)} from #{before} to #{after}"
+      end
+      "changed #{changes.empty? ? 'nothing!' : changes.join(', ')}"
+    end
+
     def json_request?
       request.env['HTTP_ACCEPT'] == 'application/json'
     end

data/lib/rollout/ui/version.rb

@@ -1,5 +1,5 @@
 class Rollout
   module UI
-    VERSION = "0.9.1"
+    VERSION = "0.9.3"
   end
 end

data/lib/rollout/ui/views/features/index.erb

@@ -49,7 +49,7 @@
               <% if updated_at.nil? %>
                 <span class="text-gray-400">Never</span>
               <% else %>
-                <span title="<%= h(updated_at.strftime(Rollout::UI.config.timestamp_format)) %>"><%= h(time_ago(updated_at)) %></span>
+                <%= relative_timestamp_tag(updated_at) %>
               <% end %>
             </td>
           <% end %>

data/lib/rollout/ui/views/features/partials/event_log.erb

@@ -31,31 +31,15 @@
               </td>
             <% end %>
             <td class="py-2 pr-3 break-words w-full">
-              <% if event.name == "update" %>
-                <% if event.context && event.context[:actor] %>
-                  <% if config.defined?(:actor_url) %>
-                    <a class="underline" href="<%= h(config.get(:actor_url, event.context[:actor])) %>" target="_blank"><%= h(event.context[:actor]) %></a>
-                  <% else %>
-                    <%= h(event.context[:actor]) %>
-                  <% end %>
-                <% else %>
-                  unidentified user
-                <% end %>
-                <%
-                  changes = event.data.fetch(:before).keys.reject { |key| key.to_s == 'data.updated_at' }.map do |key|
-                    before = format_change_value(event.data.fetch(:before).fetch(key))
-                    after = format_change_value(event.data.fetch(:after).fetch(key))
-                    "#{format_change_key(key)} from #{before} to #{after}"
-                  end
-                %>
-                changed <%= h(changes.empty? ? 'nothing!' : changes.join(', ')) %>
+              <% if ["update", "delete"].include?(event.name.to_s) %>
+                <%= event_actor(event) %> <%= h(event_summary(event)) %>
               <% else %>
                 <%= h(event.data) %>
               <% end %>
             </td>
 
             <td class="py-2 text-right whitespace-nowrap pl-3" style="min-width: 160px;">
-              <span title="<%= h(event.created_at.strftime(Rollout::UI.config.timestamp_format)) %>"><%= h(time_ago(event.created_at)) %></span>
+              <%= relative_timestamp_tag(event.created_at) %>
             </td>
           </tr>
         <% end %>

data/lib/rollout/ui/views/layout.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html>
+<html data-timestamp-format="<%= h(config.get(:timestamp_format)) %>">
   <head>
     <title>Rollout UI</title>
     <meta name="viewport" content="width=device-width initial-scale=1">
@@ -42,19 +42,85 @@
           }
         }
         applyTheme(theme);
+        const themeLabels = { system: 'Theme: System', light: 'Theme: Light', dark: 'Theme: Dark' };
+        const themeTitles = {
+          system: "Follows your device's light or dark appearance setting.",
+          light: 'Always use light appearance.',
+          dark: 'Always use dark appearance.'
+        };
         window.addEventListener('DOMContentLoaded', function() {
           const btn = document.getElementById('theme-toggle');
-          btn.textContent = theme;
+          function applyThemeLabel(t) {
+            btn.textContent = themeLabels[t];
+            btn.title = themeTitles[t];
+          }
+          applyThemeLabel(theme);
           btn.addEventListener('click', function() {
             const current = localStorage.getItem('theme') || 'system';
             const next = current === 'light' ? 'dark' : current === 'dark' ? 'system' : 'light';
             localStorage.setItem('theme', next);
             applyTheme(next);
-            btn.textContent = next;
+            applyThemeLabel(next);
           });
           window.matchMedia('(prefers-color-scheme: dark)').addEventListener('change', function() {
             if (localStorage.getItem('theme') === 'system') applyTheme('system');
           });
+
+          const timezoneKey = 'timezone';
+          const timezoneBtn = document.getElementById('timezone-toggle');
+          function timezoneMode() {
+            return localStorage.getItem(timezoneKey) === 'utc' ? 'utc' : 'local';
+          }
+          function formatTimestamp(iso, mode) {
+            const date = new Date(iso);
+            if (Number.isNaN(date.getTime())) return null;
+            const format = document.documentElement.getAttribute('data-timestamp-format') || '%Y-%m-%d %H:%M %Z';
+            const parts = {};
+            new Intl.DateTimeFormat('en-US', {
+              year: 'numeric',
+              month: '2-digit',
+              day: '2-digit',
+              hour: '2-digit',
+              minute: '2-digit',
+              second: '2-digit',
+              hourCycle: 'h23',
+              timeZone: mode === 'utc' ? 'UTC' : undefined,
+              timeZoneName: 'short'
+            }).formatToParts(date).forEach(function(part) {
+              if (part.type !== 'literal') parts[part.type] = part.value;
+            });
+            const tokens = {
+              '%Y': parts.year,
+              '%y': parts.year.slice(-2),
+              '%m': parts.month,
+              '%d': parts.day,
+              '%H': parts.hour,
+              '%M': parts.minute,
+              '%S': parts.second,
+              '%Z': parts.timeZoneName,
+              '%%': '%'
+            };
+            return format.replace(/%[%YymdHMSZ]/g, function(token) {
+              return Object.prototype.hasOwnProperty.call(tokens, token) ? tokens[token] : token;
+            });
+          }
+          function applyTimezone(mode) {
+            const localZone = Intl.DateTimeFormat().resolvedOptions().timeZone || 'Local';
+            timezoneBtn.textContent = mode === 'utc' ? 'Time: UTC' : 'Time: Local';
+            timezoneBtn.title = mode === 'utc'
+              ? 'Uses Coordinated Universal Time.'
+              : "Uses your browser's timezone: " + localZone;
+            document.querySelectorAll('[data-timestamp]').forEach(function(el) {
+              const formatted = formatTimestamp(el.getAttribute('data-timestamp'), mode);
+              if (formatted) el.setAttribute('title', formatted);
+            });
+          }
+          applyTimezone(timezoneMode());
+          timezoneBtn.addEventListener('click', function() {
+            const next = timezoneMode() === 'local' ? 'utc' : 'local';
+            localStorage.setItem(timezoneKey, next);
+            applyTimezone(next);
+          });
         });
       })();
     </script>
@@ -63,7 +129,8 @@
         <h1 class="font-light text-4xl text-gray-600 flex-auto">
           <a href="<%= h(index_path) %>" class="hover:text-blue-700">Rollout </a>
         </h1>
-        <button id="theme-toggle" class="text-sm text-gray-600 p-2 bg-gray-100 rounded-sm transition-colors duration-150 hover:bg-gray-200">system</button>
+        <button type="button" id="timezone-toggle" class="text-sm text-gray-600 p-2 bg-gray-100 rounded-sm transition-colors duration-150 hover:bg-gray-200 mr-2" title="Uses your browser's timezone">Time: Local</button>
+        <button type="button" id="theme-toggle" class="text-sm text-gray-600 p-2 bg-gray-100 rounded-sm transition-colors duration-150 hover:bg-gray-200" title="Follows your device's light or dark appearance setting.">Theme: System</button>
       </div>
       <%= yield %>
     </div>

data/lib/rollout/ui/web.rb

@@ -1,5 +1,6 @@
-require "sinatra"
-require "sinatra/json"
+require "erb"
+require "json"
+require "rack"
 require "rollout"
 
 require "rollout/ui/version"
@@ -7,86 +8,228 @@ require "rollout/ui/config"
 require "rollout/ui/helpers"
 
 module Rollout::UI
-  class Web < Sinatra::Base
-    set :static, true
-    set :public_folder, File.dirname(__FILE__) + '/public'
-
-    helpers Helpers
-
-    get '/' do
-      @rollout = config.get(:instance)
-      @features = @rollout.features.sort_by(&:downcase)
-      if json_request?
-        json(
-          filtered_features(@rollout, @features).map do |feature|
-            feature_to_hash(@rollout.get(feature))
-          end
-        )
-      else
-        erb :'features/index'
-      end
-    end
+  class Web
+    PUBLIC_PATH = File.expand_path('public', __dir__)
+
+    NOT_FOUND = ->(env) { [404, { 'content-type' => 'text/plain', 'x-cascade' => 'pass' }, ['Not Found']] }
 
-    get '/features/new' do
-      erb :'features/new'
+    def initialize
+      @static = Rack::Static.new(NOT_FOUND, urls: ['/css'], root: PUBLIC_PATH)
     end
 
-    post '/features/new' do
-      redirect feature_path(params[:name])
+    def call(env)
+      status, headers, body = @static.call(env)
+      return [status, headers, body] unless status == 404
+
+      Dispatcher.new.call(env)
     end
 
-    get '/features/:feature_name' do
-      @rollout = config.get(:instance)
-      @feature = @rollout.get(params[:feature_name])
+    # Handles a single request. A fresh instance is created per request (see
+    # Web#call above) so the instance variables set by actions and read by
+    # views (@rollout, @feature, etc) can't leak across concurrent requests.
+    class Dispatcher
+      include Helpers
+
+      VIEWS_PATH = File.expand_path('views', __dir__)
+      TEMPLATE_CACHE = {}
+
+      ROUTES = [
+        [:GET, %r{\A/\z}, :index],
+        [:GET, %r{\A/features/new\z}, :new_feature],
+        [:POST, %r{\A/features/new\z}, :create_feature],
+        [:POST, %r{\A/features/(?<feature_name>[^/]+)/activate-percentage\z}, :activate_percentage],
+        [:POST, %r{\A/features/(?<feature_name>[^/]+)/delete\z}, :delete_feature],
+        [:GET, %r{\A/features/(?<feature_name>[^/]+)\z}, :show],
+        [:POST, %r{\A/features/(?<feature_name>[^/]+)\z}, :update],
+      ].freeze
+
+      attr_reader :request, :response, :params
 
-      if json_request?
-        json(feature_to_hash(@feature))
-      else
-        erb :'features/show'
+      def call(env)
+        @request = Rack::Request.new(env)
+        @response = Rack::Response.new
+        response['x-content-type-options'] = 'nosniff'
+        response['x-frame-options'] = 'SAMEORIGIN'
+        response['x-xss-protection'] = '1; mode=block'
+
+        # Rack::URLMap strips the mount prefix from PATH_INFO, leaving "" (not
+        # "/") when a mounted app is requested at its exact mount point.
+        path_info = request.path_info
+        path_info = '/' if path_info.empty?
+
+        method = request.request_method.to_sym
+        lookup_method = method == :HEAD ? :GET : method
+        route = ROUTES.find { |verb, pattern, _| verb == lookup_method && pattern.match?(path_info) }
+        return not_found unless route
+
+        _, pattern, action = route
+        begin
+          @params = build_params(pattern.match(path_info).named_captures)
+        rescue Rack::BadRequest => e
+          return bad_request(e)
+        end
+
+        send(action)
+        response.body = [] if method == :HEAD
+        response.finish
+      end
+
+      private
+
+      def index
+        @rollout = config.get(:instance)
+        @features = @rollout.features.sort_by(&:downcase)
+        if json_request?
+          json(
+            filtered_features(@rollout, @features).map do |feature|
+              feature_to_hash(@rollout.get(feature))
+            end
+          )
+        else
+          render_view(:'features/index')
+        end
+      end
+
+      def new_feature
+        render_view(:'features/new')
+      end
+
+      def create_feature
+        redirect_to feature_path(params[:name])
+      end
+
+      def show
+        @rollout = config.get(:instance)
+        @feature = @rollout.get(params[:feature_name])
+
+        if json_request?
+          json(feature_to_hash(@feature))
+        else
+          render_view(:'features/show')
+        end
+      end
+
+      def update
+        rollout = config.get(:instance)
+        actor = config.get(:actor, scope: self)
+        feature_data = rollout.get(params[:feature_name]).data
+        if feature_data['updated_at'] && params[:last_updated_at].to_s != feature_data['updated_at'].to_s
+          return redirect_to("#{feature_path(params[:feature_name])}?error=Rollout version outdated. Review changes below and try again.")
+        end
+
+        with_rollout_context(rollout, actor: actor) do
+          rollout.with_feature(params[:feature_name]) do |feature|
+            feature.percentage = params[:percentage].to_f.clamp(0.0, 100.0)
+            feature.groups = (params[:groups] || []).reject(&:empty?).map(&:to_sym)
+            if params[:users]
+              feature.users = params[:users].split(',').map(&:strip).uniq.sort
+            end
+            feature.data["description"] = params[:description]
+            feature.data["updated_at"] = Time.now.to_i
+          end
+        end
+
+        redirect_to feature_path(params[:feature_name])
       end
-    end
 
-    post '/features/:feature_name' do
-      rollout = config.get(:instance)
-      actor = config.get(:actor, scope: self)
-      feature_data = rollout.get(params[:feature_name]).data
-      if feature_data['updated_at'] && params[:last_updated_at].to_s != feature_data['updated_at'].to_s
-        redirect "#{feature_path(params[:feature_name])}?error=Rollout version outdated. Review changes below and try again."
-      end
-      with_rollout_context(rollout, actor: actor) do
-        rollout.with_feature(params[:feature_name]) do |feature|
-          feature.percentage = params[:percentage].to_f.clamp(0.0, 100.0)
-          feature.groups = (params[:groups] || []).reject(&:empty?).map(&:to_sym)
-          if params[:users]
-            feature.users = params[:users].split(',').map(&:strip).uniq.sort
+      def activate_percentage
+        rollout = config.get(:instance)
+        actor = config.get(:actor, scope: self)
+
+        with_rollout_context(rollout, actor: actor) do
+          rollout.with_feature(params[:feature_name]) do |feature|
+            feature.percentage = params[:percentage].to_f.clamp(0.0, 100.0)
+            feature.data["updated_at"] = Time.now.to_i
           end
-          feature.data["description"] = params[:description]
-          feature.data["updated_at"] = Time.now.to_i
         end
+
+        redirect_to index_path
       end
 
-      redirect feature_path(params[:feature_name])
-    end
+      def delete_feature
+        rollout = config.get(:instance)
+        actor = config.get(:actor, scope: self)
+
+        with_rollout_context(rollout, actor: actor) do
+          rollout.delete(params[:feature_name])
+        end
+
+        redirect_to index_path
+      end
+
+      def not_found
+        response.status = 404
+        response['content-type'] = 'text/plain'
+        response['x-cascade'] = 'pass'
+        response.write('Not Found')
+        response.finish
+      end
+
+      def bad_request(error)
+        response.status = 400
+        response['content-type'] = 'text/plain'
+        response.write("Bad Request: #{error.message}")
+        response.finish
+      end
 
-    post '/features/:feature_name/activate-percentage' do
-      rollout = config.get(:instance)
-      actor = config.get(:actor, scope: self)
+      def build_params(route_params)
+        route_params = route_params.transform_values { |value| Rack::Utils.unescape_path(value) }
 
-      with_rollout_context(rollout, actor: actor) do
-        rollout.with_feature(params[:feature_name]) do |feature|
-          feature.percentage = params[:percentage].to_f.clamp(0.0, 100.0)
-          feature.data["updated_at"] = Time.now.to_i
+        request.params.merge(route_params).each_with_object({}) do |(key, value), hash|
+          hash[key.to_s] = value
+          hash[key.to_sym] = value
         end
       end
 
-      redirect index_path
-    end
+      # Mirrors Sinatra's own `redirect`: browsers replaying a 302 after a
+      # non-GET request may re-issue the original method, so redirects away
+      # from a POST use 303 See Other instead.
+      def redirect_to(location)
+        http_version = request.env['SERVER_PROTOCOL'] || request.env['HTTP_VERSION']
+        status = (http_version == 'HTTP/1.1' && request.request_method != 'GET') ? 303 : 302
+        response.redirect(location, status)
+      end
+
+      def json(data)
+        response.headers.delete('x-frame-options')
+        response.headers.delete('x-xss-protection')
+        response['content-type'] = 'application/json'
+        response.write(data.to_json)
+      end
+
+      # Exposed so `Rollout::UI.configure { actor { env[...] } }` /
+      # `actor { session[...] }` blocks keep working when instance_eval'd
+      # against this dispatcher, matching Sinatra's own request-scoped
+      # `env`/`session` helpers.
+      def env
+        request.env
+      end
+
+      def session
+        request.session
+      end
+
+      def render_view(name)
+        response['content-type'] = 'text/html;charset=utf-8'
+        response.write(erb(name))
+      end
 
-    post '/features/:feature_name/delete' do
-      @rollout = config.get(:instance)
-      @rollout.delete(params[:feature_name])
+      # Called from within views to render a partial, e.g.
+      # `<%= erb :"features/partials/event_log", layout: false, locals: { events: events } %>`
+      def erb(name, layout: true, locals: {})
+        return render_template(name, locals) unless layout
 
-      redirect index_path
+        render_template(:layout, locals) { render_template(name, locals) }
+      end
+
+      def render_template(name, locals = {}, &block)
+        path = File.join(VIEWS_PATH, "#{name}.erb")
+        template_source = (TEMPLATE_CACHE[name] ||= ERB.new(File.read(path), trim_mode: '-').src)
+
+        template_binding = binding
+        locals.each { |key, value| template_binding.local_variable_set(key, value) }
+        template_binding.eval(template_source, path)
+      end
     end
   end
 end

data/lib/rollout/ui.rb

@@ -1,4 +1,3 @@
-require "sinatra"
 require "rollout"
 
 require "rollout/ui/version"

data/rollout-ui.gemspec

@@ -23,8 +23,8 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   spec.add_dependency 'rollout', '>= 3.1', '< 4'
-  spec.add_dependency 'sinatra', ['>= 2.0', '< 5.0']
-  spec.add_dependency 'sinatra-contrib', ['>= 2.0', '< 5.0']
+  spec.add_dependency 'rack', ['>= 3.1', '< 4.0']
+  spec.add_dependency 'erb'
 
   spec.add_development_dependency 'rollout-redis-adapter', '~> 0.1'
   spec.add_development_dependency 'redis-namespace'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rollout-ui
 version: !ruby/object:Gem::Version
-  version: 0.9.1
+  version: 0.9.3
 platform: ruby
 authors:
 - FetLife
@@ -30,45 +30,39 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '4'
 - !ruby/object:Gem::Dependency
-  name: sinatra
+  name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.1'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.1'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '4.0'
 - !ruby/object:Gem::Dependency
-  name: sinatra-contrib
+  name: erb
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rollout-redis-adapter
   requirement: !ruby/object:Gem::Requirement