shadwire 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1cdc0f4830063d6e21c79acbe20a20d3b81862ff346a3af2fff6888af18ba8c2
-  data.tar.gz: a455411bae400e6e0a99f4ad693988add8b95945abf15081321631f5922e3124
+  metadata.gz: c857670a096593c58b47a25ad03b9c1613dd4386f54a7cc4f4ae84100960c7ff
+  data.tar.gz: 06b367750966cbcbaf8a26eabb229fdb80211a7379980b12ae71b7251d8cb7f2
 SHA512:
-  metadata.gz: 4ae1610e1fc2382eba1787a94ba27be6efaed66ed8535bbd72a64a09b82aa79df01271ad9186330e9fbefebe3487f84f447f662472bab4292de552d43e950b76
-  data.tar.gz: a10682b3ba15a5e955b0952967b5af2695d040b5f71d08f4dad3d9f9c70bb8f43b146a783081fe1e843646011a66ef8edf35821eab39ccb3a28ca270fb2fa01d
+  metadata.gz: 617cdd3e2b46c0cf2dd757e77eafe0a797144be2f18b7b85a96c40a94641d4dbfc575b4c905e058487f2ffd2d0dbb0c9f46a0a5f2737a1ee764db488305850b9
+  data.tar.gz: 62919522fee319ecc4706dc2e6b9ea4ab5b70b56d3bd5a7a41c005e2ae34a4004c3fd7cc44a0cee95b3f76f4108e5694e444e8157d34fa02ca99d4343fca9828

data/README.md

@@ -78,7 +78,7 @@ files install (aliases), the Tailwind entrypoint, and what is installed:
 
 ```json
 {
-  "registry": "https://edumoraes.github.io/shadwire/r",
+  "registry": "https://shadwire.edumoraes.dev.br/r",
   "tailwind": { "css": "app/assets/tailwind/application.css" },
   "aliases": {
     "components":  "app/components",
@@ -104,7 +104,7 @@ For any command, the registry base URL is resolved in this order:
 
 1. the `--registry` flag, if given;
 2. the `registry` field in the app's `shadwire.json`;
-3. the built-in default, `https://edumoraes.github.io/shadwire/r`.
+3. the built-in default, `https://shadwire.edumoraes.dev.br/r`.
 
 Both `https://` and local `file://` bases are supported. Point `--registry` at a
 `file://` path to install from a registry built locally with `bin/build_registry`

data/lib/shadwire/commands/info.rb

@@ -82,7 +82,12 @@ module Shadwire
         return if snippets.empty?
 
         @ui.say("Usage:")
-        snippets.each { |snippet| @ui.say(snippet.lines.map { |line| "  #{line}" }.join.chomp) }
+        # Blank line between snippets: items that document several recipes
+        # (date-picker) would otherwise print as one wall of ERB.
+        snippets.each_with_index do |snippet, index|
+          @ui.say("") unless index.zero?
+          @ui.say(snippet.lines.map { |line| "  #{line}" }.join.chomp)
+        end
       end
 
       def section(label, values)

data/lib/shadwire/config.rb

@@ -9,7 +9,7 @@ module Shadwire
   # On-disk JSON shape (mirrors shadcn's components.json conventions):
   #
   #   {
-  #     "registry": "https://edumoraes.github.io/shadwire/r",
+  #     "registry": "https://shadwire.edumoraes.dev.br/r",
   #     "tailwind": { "css": "app/assets/tailwind/application.css" },
   #     "aliases": {
   #       "components":  "app/components",
@@ -26,7 +26,7 @@ module Shadwire
     CONFIG_FILE = "shadwire.json"
 
     DEFAULTS = {
-      "registry" => "https://edumoraes.github.io/shadwire/r",
+      "registry" => "https://shadwire.edumoraes.dev.br/r",
       "tailwind" => { "css" => "app/assets/tailwind/application.css" },
       "aliases" => {
         "components"  => "app/components",

data/lib/shadwire/registry_client.rb

@@ -1,11 +1,42 @@
 # frozen_string_literal: true
 
 require "json"
+require "uri"
 
 module Shadwire
   # Fetches the published registry over file:// or http(s)://.
   # Both #index and #item are memoized within the instance.
   class RegistryClient
+    # Registries move: GitHub Pages answers 301 for every path once a custom
+    # domain is configured. Follow a few hops, then assume a misconfiguration
+    # rather than chasing a chain forever.
+    MAX_REDIRECTS = 5
+
+    # Resolves a redirect's Location against the URL it came from, rejecting
+    # redirects we must not follow. A registry serves source code that gets
+    # written into the user's app, so a redirect may upgrade to HTTPS but never
+    # drop it (GitHub Pages answers `Location: http://…` for a custom domain
+    # until "Enforce HTTPS" is on).
+    def self.redirect_target(from_uri, location)
+      if location.to_s.strip.empty?
+        raise RegistryError, "Registry redirect from #{from_uri} has no Location header"
+      end
+
+      begin
+        target = from_uri + location.strip
+      rescue URI::Error => e
+        raise RegistryError,
+              "Registry redirect from #{from_uri} has an unusable Location (#{location}): #{e.message}"
+      end
+
+      if from_uri.scheme == "https" && target.scheme != "https"
+        raise RegistryError,
+              "Registry redirect from #{from_uri} drops HTTPS (to #{target}); refusing to follow it"
+      end
+
+      target
+    end
+
     def initialize(base_url)
       # Normalise: drop any trailing slash so URL building is consistent.
       @base_url = base_url.chomp("/")
@@ -46,16 +77,33 @@ module Shadwire
 
     def fetch_http(url, name: nil)
       require "net/http"
-      require "uri"
 
       uri = URI.parse(url)
-      response = Net::HTTP.get_response(uri)
+      seen = []
+      response = nil
+
+      (MAX_REDIRECTS + 1).times do
+        if seen.include?(uri.to_s)
+          raise RegistryError, "Registry redirect from #{url} loops back to #{uri}"
+        end
+        seen << uri.to_s
+
+        response = Net::HTTP.get_response(uri)
+        break unless response.is_a?(Net::HTTPRedirection)
+
+        uri = self.class.redirect_target(uri, response["location"])
+      end
+
+      if response.is_a?(Net::HTTPRedirection)
+        raise RegistryError,
+              "Registry at #{url} redirected more than #{MAX_REDIRECTS} times (last: #{uri})"
+      end
 
       unless response.is_a?(Net::HTTPSuccess)
-        raise RegistryError, missing_message(name, url, code: response.code)
+        raise RegistryError, missing_message(name, uri, code: response.code)
       end
 
-      parse(response.body, url)
+      parse(response.body, uri)
     rescue SocketError, SystemCallError, Net::OpenTimeout, Net::ReadTimeout, OpenSSL::SSL::SSLError => e
       # An offline machine, a DNS failure or a TLS problem is an ordinary
       # condition here, not something to surface as a Ruby backtrace.

data/lib/shadwire/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Shadwire
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shadwire
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Eduardo de Moraes