smeditor 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 2fa2dffff9ec8a5d1b502cbcba1c44420d778f0e5377db886812922fb9fd543c
+  data.tar.gz: f2892ee2d34a3b726d7e726acb5bca9de6a1973f18c8b06257dd425945f193a3
+SHA512:
+  metadata.gz: 9a0923f3f4a6d7c51826a5e93e0853d3b9e452cbb46aa2a7027392a9fdfd9af6ed604a03e3224e6e4f86f10742f02b8dc0989441461890bd03842b388bcfa7a5
+  data.tar.gz: 8b4a6d29c7f033da64c91127d1a3a2a5b00f19607b60b10294972abff6137a7940a5464313231193cff23c83e516a971a3568a860e01c4555f0edfba915b6559

data/CHANGELOG.md

@@ -0,0 +1,41 @@
+# Changelog — smeditor
+
+All notable changes to the Rails adapter are recorded here. The format is
+based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the gem
+follows [RubyGems versioning](https://guides.rubygems.org/patterns/).
+
+Cross-cutting product changes live in the repository root
+[CHANGELOG.md](../../CHANGELOG.md).
+
+## [Unreleased]
+
+### Fixed
+
+- The boot script no longer imports `@smeditor/theme-default/index.css`, a
+  subpath the theme package did not export. It now imports the package root.
+- `EditorContent` receives the editor instance explicitly, so the editor
+  actually mounts. It reads the instance from its prop, not from context.
+- The default toolbar renders its buttons. `Toolbar` renders only the
+  children it is given, so the previous empty element produced an empty bar.
+- `EditorProvider` receives `version`, and the editor is wrapped in a
+  `.smeditor` element so the default theme applies.
+- Booting also runs when the bundle is evaluated after `DOMContentLoaded`
+  has already fired, and on `turbo:frame-load`.
+
+### Added
+
+- `smeditor:install` copies the boot script into `app/javascript/smeditor.js`
+  so the host app's bundler resolves the `@smeditor/*` imports.
+  Pass `--skip-javascript` to opt out.
+- `config.max_upload_size` (10 MB default) and `config.allowed_upload_types`
+  are enforced by the upload endpoint.
+- `LICENSE` and `CHANGELOG.md` ship in the gem; the internal `PLAN.md` no
+  longer does.
+- Gemspec metadata: homepage, contact, source, changelog and issue URLs.
+
+---
+
+## 0.1.0 — 2026-07-06
+
+First release of the Rails adapter: form helper, server-side renderer,
+sanitizer, and the optional ActiveStorage upload endpoint.

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SMEditor contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,143 @@
+# smeditor
+
+Rails integration for the [SMEditor](https://github.com/sCruze/smeditor)
+rich-text editor.
+
+This gem is a **thin adapter**. The editor is the upstream npm
+packages (`@smeditor/react`, `@smeditor/starter-kit`, …); the gem
+adds a form helper, a safe server-side renderer, and an optional
+upload endpoint. It holds no schema, no commands and no rendering
+pipeline of its own.
+
+## Requirements
+
+- Ruby >= 3.0, Rails >= 7.0
+- A JavaScript bundler in the host app — `jsbundling-rails` (esbuild,
+  rollup, webpack, bun) or Vite. The boot script imports the npm
+  packages by bare specifier, which Sprockets and importmap cannot
+  resolve on their own.
+
+## Install
+
+```ruby
+# Gemfile
+gem "smeditor"
+```
+
+```bash
+bundle install
+bin/rails generate smeditor:install
+```
+
+The generator writes `config/initializers/smeditor.rb` and copies the
+boot script to `app/javascript/smeditor.js`. Then install the editor
+itself and import the script:
+
+```bash
+npm install @smeditor/react @smeditor/starter-kit \
+            @smeditor/full-kit @smeditor/theme-default react react-dom
+```
+
+```js
+// app/javascript/application.js
+import "./smeditor";
+```
+
+Mount the engine if you want the upload endpoint:
+
+```ruby
+# config/routes.rb
+mount SMEditor::Rails::Engine => "/smeditor"
+```
+
+## Namespace
+
+Константа гема — `SMEditor` (не `Smeditor`). Каталоги называются `smeditor/`,
+поэтому движок сам регистрирует переопределение в обоих автозагрузчиках
+Zeitwerk (`smeditor` → `SMEditor`) до сканирования autoload-путей, а генератор
+объявляет namespace явно. Настроек в приложении не требуется, и глобальные
+inflections ActiveSupport не трогаются.
+
+## Configure
+
+```ruby
+# config/initializers/smeditor.rb
+SMEditor.configure do |c|
+  c.uploads             = :active_storage   # or :none (default)
+  c.sanitize_output     = true
+  c.default_kit         = "starter"         # or "full"
+  c.upload_path         = "/smeditor/uploads"
+  c.allowed_tags        = %w[p h1 h2 h3 strong em a img]
+  c.max_upload_size     = 10 * 1024 * 1024
+  c.allowed_upload_types = %w[image/png image/jpeg image/webp]
+end
+```
+
+## Use
+
+The form helper mounts an editor and persists its HTML through a
+hidden field — a normal form submit saves the content:
+
+```erb
+<%= form_with model: @article do |form| %>
+  <%= form.smeditor_editor :content %>
+  <%= form.submit %>
+<% end %>
+```
+
+Options: `:kit` (`"starter"` / `"full"`), `:placeholder`, `:class`,
+`:upload_url`.
+
+Display saved content on a public page — always sanitized:
+
+```erb
+<%= smeditor_render(@article.content) %>
+```
+
+## How it works
+
+`smeditor_editor` renders a hidden field (seeded with the stored
+HTML) and an empty mount point. The boot script finds each mount,
+attaches a real editor from the npm packages, and writes
+`editor.getHTML()` back into the hidden field on every change. The
+model attribute is a plain HTML string — SMEditor's transport format —
+so no special column type or serializer is needed.
+
+Booting runs on `DOMContentLoaded`, on `turbo:load` and on
+`turbo:frame-load`; each mount is booted at most once.
+
+## Rendering and trust
+
+Stored editor HTML is treated as untrusted input. `smeditor_render`
+passes it through `SMEditor::Rails::Sanitizer`, which applies the tag
+allow-list, strips unsafe URLs and `style` declarations, and adds
+`rel="noopener noreferrer"` to `target="_blank"` links.
+
+Setting `config.sanitize_output = false` marks stored content
+`html_safe` without sanitizing it. Only do that when the content is
+already trusted upstream.
+
+## Uploads
+
+With `config.uploads = :active_storage`, the engine exposes
+`POST /smeditor/uploads`. It stores image files via ActiveStorage and
+responds with `{ src, alt, title }` for the editor to embed.
+
+The endpoint is **unauthenticated by default** and only enforces the
+content-type allow-list and `max_upload_size`. Subclass
+`SMEditor::UploadsController` and add your own authorization before
+exposing it to the public internet.
+
+With `:none`, no endpoint is mounted — wire your own.
+
+## Development
+
+```bash
+cd gems/smeditor
+bundle install
+bundle exec rspec
+```
+
+## License
+
+MIT © SMEditor contributors

data/app/assets/javascripts/smeditor.js

@@ -0,0 +1,249 @@
+/**
+ * smeditor.js — the gem's boot script.
+ *
+ * The form helper renders, for each editor field:
+ *
+ *   <div class="smeditor-field">
+ *     <input type="hidden" data-smeditor-input value="<saved html>">
+ *     <div class="smeditor-mount" data-smeditor data-smeditor-kit="…">
+ *   </div>
+ *
+ * This script finds every mount, attaches a real editor seeded from
+ * the hidden field, and writes editor.getHTML() back into that field
+ * on every change — so a plain form submit persists the content.
+ *
+ * The editor itself is the upstream npm packages. The gem ships no
+ * editor core; it only wires Rails forms, assets and optional uploads.
+ *
+ * `bin/rails generate smeditor:install` copies this file into
+ * app/javascript/smeditor.js so the host app's bundler (esbuild, rollup,
+ * webpack, bun) resolves the @smeditor/* imports from package.json.
+ */
+
+import { createRoot } from "react-dom/client";
+import { createElement, Fragment, useMemo } from "react";
+import {
+  useEditor,
+  EditorProvider,
+  EditorContent,
+  Toolbar,
+  ToolbarDivider,
+  UndoButton,
+  RedoButton,
+  BlockTypeDropdown,
+  ListsDropdown,
+  BoldButton,
+  ItalicButton,
+  UnderlineButton,
+  StrikeButton,
+  ClearFormattingButton,
+  LinkButton,
+  AlignDropdown,
+  BlockquoteButton,
+  CodeBlockButton,
+  HorizontalRuleButton,
+  ImageButton,
+  ImageToolbar,
+  TableButton,
+  TableToolbar,
+  ImageResizer,
+  TableColumnResizer,
+  TableCellSelection,
+  HighlightButton,
+  TextColorButton,
+  BackgroundColorButton,
+  FontFamilyDropdown,
+  FontSizeDropdown,
+  LineHeightDropdown,
+} from "@smeditor/react";
+import { StarterKit, ImageExtension } from "@smeditor/starter-kit";
+import { FullKit } from "@smeditor/full-kit";
+import "@smeditor/theme-default";
+
+function csrfToken() {
+  const meta = document.querySelector('meta[name="csrf-token"]');
+  return meta ? meta.getAttribute("content") : null;
+}
+
+/**
+ * Posts the file to the Rails upload endpoint. The controller answers
+ * with { src, alt, title }, which is exactly the ImageAttrs shape the
+ * image extension accepts.
+ */
+function uploadHandler(uploadUrl) {
+  if (!uploadUrl) return undefined;
+
+  return async (file) => {
+    const body = new FormData();
+    body.append("file", file);
+
+    const headers = {};
+    const token = csrfToken();
+    if (token) headers["X-CSRF-Token"] = token;
+
+    const response = await fetch(uploadUrl, {
+      method: "POST",
+      headers,
+      body,
+      credentials: "same-origin",
+    });
+
+    if (!response.ok) {
+      throw new Error(`SMEditor upload failed with ${response.status}`);
+    }
+
+    return response.json();
+  };
+}
+
+function kitExtensions(kit, uploadUrl) {
+  const base = kit === "full" ? FullKit.extensions : StarterKit.extensions;
+  const upload = uploadHandler(uploadUrl);
+
+  if (!upload) return base;
+
+  return base.map((extension) =>
+    extension.name === "image"
+      ? ImageExtension.configure({ upload })
+      : extension,
+  );
+}
+
+/**
+ * Default toolbar. `Toolbar` renders whatever children it is given, so
+ * the buttons have to be listed explicitly — an empty `<Toolbar />`
+ * produces an empty bar.
+ */
+function DefaultToolbar({ kit }) {
+  const common = [
+    createElement(UndoButton, { key: "undo" }),
+    createElement(RedoButton, { key: "redo" }),
+    createElement(ToolbarDivider, { key: "d1" }),
+
+    createElement(BlockTypeDropdown, { key: "block" }),
+    createElement(ListsDropdown, { key: "lists" }),
+    createElement(ToolbarDivider, { key: "d2" }),
+
+    createElement(BoldButton, { key: "bold" }),
+    createElement(ItalicButton, { key: "italic" }),
+    createElement(UnderlineButton, { key: "underline" }),
+    createElement(StrikeButton, { key: "strike" }),
+    createElement(ClearFormattingButton, { key: "clear" }),
+    createElement(LinkButton, { key: "link" }),
+    createElement(ToolbarDivider, { key: "d3" }),
+
+    createElement(AlignDropdown, { key: "align" }),
+    createElement(ToolbarDivider, { key: "d4" }),
+
+    createElement(BlockquoteButton, { key: "quote" }),
+    createElement(CodeBlockButton, { key: "code" }),
+    createElement(HorizontalRuleButton, { key: "hr" }),
+    createElement(ImageButton, { key: "image" }),
+    createElement(TableButton, { key: "table" }),
+  ];
+
+  const full =
+    kit === "full"
+      ? [
+          createElement(ToolbarDivider, { key: "d5" }),
+          createElement(HighlightButton, { key: "highlight" }),
+          createElement(TextColorButton, { key: "color" }),
+          createElement(BackgroundColorButton, { key: "bg" }),
+          createElement(FontFamilyDropdown, { key: "family" }),
+          createElement(FontSizeDropdown, { key: "size" }),
+          createElement(LineHeightDropdown, { key: "line" }),
+        ]
+      : [];
+
+  return createElement(
+    Toolbar,
+    { ariaLabel: "SMEditor editor toolbar" },
+    ...common,
+    ...full,
+  );
+}
+
+/** One mounted editor field. */
+function SMEditorField({ mount, input }) {
+  const kit = mount.dataset.smeditorKit === "full" ? "full" : "starter";
+  const uploadUrl = mount.dataset.smeditorUploadUrl || "";
+  const placeholder = mount.dataset.smeditorPlaceholder || undefined;
+
+  const extensions = useMemo(
+    () => kitExtensions(kit, uploadUrl),
+    [kit, uploadUrl],
+  );
+
+  const { editor, version } = useEditor({
+    extensions,
+    content: input.value || "<p></p>",
+    placeholder,
+    onUpdate: ({ editor: instance }) => {
+      input.value = instance.getHTML();
+    },
+  });
+
+  // `editor` is null on the first render and `EditorContent` reads the
+  // instance from its prop, not from context — both have to be passed
+  // explicitly or the editor never mounts to the DOM node.
+  return createElement(
+    EditorProvider,
+    { editor, version },
+    createElement(
+      "div",
+      { className: "smeditor" },
+      createElement(DefaultToolbar, { kit }),
+      createElement(EditorContent, {
+        editor,
+        ariaLabel: mount.dataset.smeditorLabel || "Rich text editor",
+      }),
+      createElement(ImageToolbar, null),
+      createElement(TableToolbar, null),
+      createElement(ImageResizer, null),
+      createElement(TableColumnResizer, null),
+      createElement(TableCellSelection, null),
+    ),
+  );
+}
+
+/** Attach editors to every un-booted mount in the document. */
+export function boot(root = document) {
+  const mounts = root.querySelectorAll("[data-smeditor]");
+  mounts.forEach((mount) => {
+    if (mount.dataset.smeditorBooted) return;
+
+    const field = mount.closest(".smeditor-field");
+    const input = field && field.querySelector("[data-smeditor-input]");
+    if (!input) return;
+
+    mount.dataset.smeditorBooted = "1";
+
+    createRoot(mount).render(
+      createElement(
+        Fragment,
+        null,
+        createElement(SMEditorField, { mount, input }),
+      ),
+    );
+  });
+}
+
+// Auto-boot on load and after Turbo navigations. The readyState check
+// matters when the bundle is injected after the document has parsed —
+// DOMContentLoaded has already fired by then and would never call boot.
+if (typeof document !== "undefined") {
+  if (document.readyState === "loading") {
+    document.addEventListener("DOMContentLoaded", () => boot());
+  } else {
+    boot();
+  }
+  document.addEventListener("turbo:load", () => boot());
+  document.addEventListener("turbo:frame-load", (event) => {
+    boot(event.target || document);
+  });
+}
+
+// Re-exported so a host app can build a custom integration instead of auto-boot.
+export * from "@smeditor/react";
+export { StarterKit, ImageExtension } from "@smeditor/starter-kit";
+export { FullKit } from "@smeditor/full-kit";

data/app/controllers/smeditor/uploads_controller.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module SMEditor
+  # Default upload controller. A host app can use this as-is (the
+  # engine routes POST /smeditor/uploads to it) or subclass it to add
+  # authentication.
+  class UploadsController < ::ActionController::Base
+    include SMEditor::Rails::Uploads
+
+    protect_from_forgery with: :null_session
+  end
+end

data/config/routes.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# Mounted by SMEditor::Rails::Engine. Provides the single upload
+# endpoint; only reachable when config.uploads == :active_storage.
+SMEditor::Rails::Engine.routes.draw do
+  post "/uploads", to: "uploads#create", as: :uploads
+end

data/lib/generators/smeditor/install_generator.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+
+module SMEditor
+  module Generators
+    class InstallGenerator < ::Rails::Generators::Base
+      # Thor вывел бы из имени класса namespace "sm_editor:install".
+      # Задаём явно, чтобы генератор звался `rails g smeditor:install`.
+      namespace "smeditor:install"
+
+      desc "Install SMEditor Rails configuration and the editor boot script"
+
+      class_option :skip_javascript,
+                   type: :boolean,
+                   default: false,
+                   desc: "Do not copy smeditor.js into app/javascript"
+
+      # Two source roots: the generator templates, and the packaged boot
+      # script. Copying the shipped asset rather than a duplicate template
+      # keeps a single source of truth for the JavaScript.
+      def self.source_paths
+        [
+          File.expand_path("templates", __dir__),
+          File.expand_path("../../../app/assets/javascripts", __dir__),
+        ]
+      end
+
+      def copy_initializer
+        template "initializer.rb", "config/initializers/smeditor.rb"
+      end
+
+      # The boot script imports @smeditor/* by bare specifier, so it has to
+      # be compiled by the host app's JavaScript bundler. Sprockets and
+      # importmap cannot resolve those imports; jsbundling-rails (esbuild,
+      # rollup, webpack) or Vite can.
+      def copy_boot_script
+        copy_file "smeditor.js", "app/javascript/smeditor.js" unless options[:skip_javascript]
+      end
+
+      def show_next_steps
+        say ""
+        say "SMEditor installed. Next:"
+        say "  1. npm install @smeditor/react @smeditor/starter-kit \\"
+        say "                 @smeditor/full-kit @smeditor/theme-default react react-dom"
+        say "  2. Add `import \"./smeditor\"` to app/javascript/application.js"
+        say "  3. For uploads: set config.uploads = :active_storage and mount"
+        say "     `mount SMEditor::Rails::Engine => \"/smeditor\"` in config/routes.rb"
+        say ""
+      end
+    end
+  end
+end

data/lib/generators/smeditor/templates/initializer.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+SMEditor.configure do |config|
+  # Use :active_storage after mounting the engine and installing ActiveStorage.
+  config.uploads = :none
+
+  # Used by the JavaScript adapter when uploads are enabled.
+  config.upload_path = "/smeditor/uploads"
+
+  # "starter" gives the MVP toolbar; "full" enables the larger extension set.
+  config.default_kit = "starter"
+
+  # Stored editor HTML is sanitized before public rendering.
+  config.sanitize_output = true
+
+  # Upload limits. The endpoint is unauthenticated unless you subclass
+  # SMEditor::UploadsController, so keep these tight.
+  config.max_upload_size = 10 * 1024 * 1024
+  config.allowed_upload_types = %w[
+    image/png image/jpeg image/gif image/webp image/avif image/bmp
+  ]
+end

data/lib/smeditor/rails/config.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module SMEditor
+  # Gem-wide configuration, set in an initializer:
+  #
+  #   SMEditor.configure do |c|
+  #     c.uploads = :active_storage
+  #     c.allowed_tags = %w[p h1 h2 strong em a]
+  #   end
+  #
+  class Config
+    # :none (default) or :active_storage — whether the gem mounts an
+    # upload endpoint.
+    attr_accessor :uploads
+    # When true, smeditor_render sanitizes content before display.
+    attr_accessor :sanitize_output
+    # Tag allow-list for the server-side renderer.
+    attr_accessor :allowed_tags
+    # Which bundle the form helper boots: "starter" or "full".
+    attr_accessor :default_kit
+    # Upload endpoint used by the JavaScript adapter when uploads are enabled.
+    attr_accessor :upload_path
+    # Hard ceiling on an uploaded file, in bytes. The endpoint is reachable
+    # by anyone who can reach the host app unless the controller is
+    # subclassed with authentication, so it refuses anything larger.
+    attr_accessor :max_upload_size
+    # Content types the upload endpoint accepts. SVG is excluded on
+    # purpose — it can carry script and is served from the app's origin.
+    attr_accessor :allowed_upload_types
+
+    def initialize
+      @uploads = :none
+      @sanitize_output = true
+      @allowed_tags = %w[
+        p br h1 h2 h3 h4 h5 h6 strong em u s code pre blockquote
+        ul ol li a img figure figcaption hr span
+        table thead tbody tr td th
+      ]
+      @default_kit = "starter"
+      @upload_path = "/smeditor/uploads"
+      @max_upload_size = 10 * 1024 * 1024
+      @allowed_upload_types = %w[
+        image/png image/jpeg image/gif image/webp image/avif image/bmp
+      ]
+    end
+  end
+
+  class << self
+    # Yields the config for editing and exposes the same object to callers.
+    def configure
+      yield(config) if block_given?
+      config
+    end
+
+    def config
+      @config ||= Config.new
+    end
+  end
+end

data/lib/smeditor/rails/engine.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+# `rails/engine` не подтягивает core-расширения ActiveSupport сам. Вне
+# приложения (например, в rspec) гем грузится первым, и Rails::Initializable
+# падает на delegate_missing_to. `require "rails"` ставит их на место.
+require "rails"
+require "rails/engine"
+
+module SMEditor
+  module Rails
+    # Rails::Engine subclass — the gem's plumbing.
+    #
+    # It does three things and nothing more (per PLAN.md the gem stays
+    # a thin adapter):
+    #   1. Isolates the SMEditor namespace so routes / controllers
+    #      don't collide with the host app.
+    #   2. Mixes the view helpers into ActionView.
+    #   3. Adds smeditor_editor to the form builder.
+    #
+    # The upload route lives in config/routes.rb and is mounted by the
+    # host with `mount SMEditor::Rails::Engine => "/smeditor"`.
+    class Engine < ::Rails::Engine
+      isolate_namespace SMEditor
+
+      # `isolate_namespace` выводит "sm_editor" из имени константы. Закрепляем
+      # "smeditor", чтобы прокси маршрутов у смонтированного движка назывался
+      # `smeditor.uploads_path`.
+      engine_name "smeditor"
+      railtie_name "smeditor"
+
+      # Zeitwerk по имени каталога `smeditor/` вывел бы константу `Smeditor`.
+      # Оба автозагрузчика узнают про `SMEditor` до сканирования autoload-путей —
+      # иначе `SMEditor::UploadsController` не найдётся.
+      initializer "smeditor.inflections", before: :set_autoload_paths do
+        ::Rails.autoloaders.each do |autoloader|
+          autoloader.inflector.inflect("smeditor" => "SMEditor")
+        end
+      end
+
+      initializer "smeditor.view_helpers" do
+        ActiveSupport.on_load(:action_view) do
+          include SMEditor::Rails::FormHelper
+          include SMEditor::Rails::RenderHelper
+        end
+      end
+
+      initializer "smeditor.form_builder" do
+        ActiveSupport.on_load(:action_view) do
+          ActionView::Helpers::FormBuilder.include(
+            SMEditor::Rails::FormBuilderExtension
+          )
+        end
+      end
+    end
+  end
+end

data/lib/smeditor/rails/form_helper.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module SMEditor
+  module Rails
+    # View helper that mounts a SMEditor editor inside a Rails form.
+    #
+    #   <%= form.smeditor_editor :content %>      # via FormBuilder
+    #   <%= smeditor_editor(form, :content) %>    # standalone
+    #
+    # Emits a hidden field carrying the document HTML plus an empty
+    # mount point. The boot script (smeditor.js) finds the mount,
+    # attaches a real editor seeded from the hidden field, and writes
+    # editor.getHTML() back into that field on every change — so a
+    # normal form submit persists the content with no extra wiring.
+    module FormHelper
+      # form    - a Rails FormBuilder
+      # method  - the model attribute (stored as an HTML string)
+      # options - :kit ("starter" | "full"), :class, :placeholder, :upload_url
+      def smeditor_editor(form, method, options = {})
+        object = form.object
+        current = object.respond_to?(method) ? object.public_send(method) : nil
+        kit = (options[:kit] || SMEditor.config.default_kit).to_s
+        upload_url = options.fetch(:upload_url, smeditor_upload_url)
+
+        hidden = form.hidden_field(
+          method,
+          value: current.to_s,
+          data: { smeditor_input: true },
+        )
+
+        mount = content_tag(
+          :div,
+          "",
+          class: "smeditor-mount",
+          data: {
+            smeditor: true,
+            smeditor_kit: kit,
+            smeditor_placeholder: options[:placeholder],
+            smeditor_upload_url: upload_url,
+          },
+        )
+
+        wrapper_class = ["smeditor-field", options[:class]].compact.join(" ")
+        content_tag(:div, safe_join([hidden, mount]), class: wrapper_class)
+      end
+
+      private
+
+      def smeditor_upload_url
+        if SMEditor.config.uploads == :active_storage
+          SMEditor.config.upload_path
+        end
+      end
+    end
+
+    # Mixed into ActionView::Helpers::FormBuilder so `form.smeditor_editor`
+    # works alongside the standalone helper.
+    module FormBuilderExtension
+      def smeditor_editor(method, options = {})
+        @template.smeditor_editor(self, method, options)
+      end
+    end
+  end
+end

data/lib/smeditor/rails/renderer.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module SMEditor
+  module Rails
+    # View helper for displaying saved content on a public page.
+    #
+    #   <%= smeditor_render(@article.content) %>
+    #
+    # The stored value is editor HTML. It is sanitized (unless
+    # config.sanitize_output is false) and wrapped in a container that
+    # the default theme styles.
+    module RenderHelper
+      # content      - stored editor HTML
+      # allowed_tags - override the configured tag allow-list
+      # html_class   - extra CSS class on the wrapper
+      def smeditor_render(content, allowed_tags: nil, html_class: nil)
+        html = content.to_s
+        if SMEditor.config.sanitize_output
+          html = SMEditor::Rails::Sanitizer.sanitize(
+            html, allowed_tags: allowed_tags
+          )
+        end
+        wrapper = ["smeditor-content", html_class].compact.join(" ")
+        content_tag(:div, html.html_safe, class: wrapper)
+      end
+    end
+  end
+end

data/lib/smeditor/rails/sanitizer.rb

@@ -0,0 +1,204 @@
+# frozen_string_literal: true
+
+require "cgi"
+
+module SMEditor
+  module Rails
+    # Wraps Rails' HTML sanitizer with a SMEditor-shaped allow-list.
+    #
+    # Stored editor HTML is treated as untrusted user input, even when
+    # the JavaScript serializer produced it. Public display should pass
+    # through this adapter first.
+    module Sanitizer
+      module_function
+
+      # Attributes kept on surviving tags. `style` is included because
+      # SMEditor serializes color, background, highlight, text stroke,
+      # font size, font family and alignment as constrained inline CSS.
+      ALLOWED_ATTRS = %w[
+        href src alt title class style target rel
+        width height data-align data-mention-id data-mention-label
+        colspan rowspan
+      ].freeze
+
+      COLOR_PATTERN = /\A(?:#[0-9a-fA-F]{3,8}|rgba?\([^;<>"']+\)|hsla?\([^;<>"']+\)|[a-zA-Z]+)\z/
+      FONT_FAMILY_PATTERN = /\A[a-zA-Z0-9 ,"'-]{1,200}\z/
+      LENGTH_PATTERN = /\A(\d+(?:\.\d+)?)(px|pt|em|rem|%)?\z/
+      LINE_HEIGHT_PATTERN = /\A(\d+(?:\.\d+)?)(px|em|rem|%)?\z/
+      TEXT_STROKE_WIDTH_PATTERN = /\A(\d+(?:\.\d+)?)px\z/i
+      SAFE_TARGETS = %w[_blank _self _parent _top].freeze
+      RASTER_DATA_URL_PATTERN = /\Adata:image\/(?:png|jpe?g|gif|webp|avif|bmp);base64,[a-z0-9+\/=\s]+\z/i
+
+      # Produces a sanitized HTML String (not html_safe — the caller
+      # decides where it is safe to mark it so).
+      def sanitize(html, allowed_tags: nil)
+        tags = allowed_tags || SMEditor.config.allowed_tags
+        sanitized = sanitizer_class.new.sanitize(
+          html.to_s,
+          tags: tags,
+          attributes: ALLOWED_ATTRS,
+        ).to_s
+        harden_blank_targets(
+          sanitize_url_attributes(
+            sanitize_inline_styles(sanitized),
+          ),
+        )
+      end
+
+      # Rails 7.1+ exposes Rails::HTML5::SafeListSanitizer; older
+      # versions use Rails::HTML::SafeListSanitizer.
+      def sanitizer_class
+        if defined?(::Rails::HTML5::SafeListSanitizer)
+          ::Rails::HTML5::SafeListSanitizer
+        else
+          ::Rails::HTML::SafeListSanitizer
+        end
+      end
+
+      def sanitize_inline_styles(html)
+        html.gsub(/\sstyle=(['"])(.*?)\1/mi) do
+          quote = Regexp.last_match(1)
+          style = CGI.unescapeHTML(Regexp.last_match(2).to_s)
+          declarations = style.split(";").filter_map do |declaration|
+            sanitize_style_declaration(declaration)
+          end
+          if declarations.empty?
+            ""
+          else
+            %( style=#{quote}#{CGI.escapeHTML(declarations.join("; "))}#{quote})
+          end
+        end
+      end
+
+      def sanitize_url_attributes(html)
+        html.gsub(/\s(href|src)=(['"])(.*?)\2/mi) do
+          name = Regexp.last_match(1).downcase
+          quote = Regexp.last_match(2)
+          value = CGI.unescapeHTML(Regexp.last_match(3).to_s)
+          safe_url?(name, value) ? %( #{name}=#{quote}#{CGI.escapeHTML(value.strip)}#{quote}) : ""
+        end.gsub(/\starget=(['"])(.*?)\1/mi) do
+          quote = Regexp.last_match(1)
+          value = CGI.unescapeHTML(Regexp.last_match(2).to_s).strip
+          SAFE_TARGETS.include?(value) ? %( target=#{quote}#{value}#{quote}) : ""
+        end
+      end
+
+      def harden_blank_targets(html)
+        html.gsub(/<a\b([^>]*)>/mi) do
+          attrs = Regexp.last_match(1).to_s
+          if attrs.match?(/\starget=(['"])_blank\1/i)
+            if attrs.match?(/\srel=/i)
+              %(<a#{attrs}>)
+            else
+              %(<a#{attrs} rel="noopener noreferrer">)
+            end
+          else
+            %(<a#{attrs}>)
+          end
+        end
+      end
+
+      def sanitize_style_declaration(declaration)
+        match = declaration.match(/\A\s*([a-z-]+)\s*:\s*(.+?)\s*\z/i)
+        if match
+          name = match[1].downcase
+          value = sanitize_style_value(name, match[2])
+          value ? "#{name}: #{value}" : nil
+        end
+      end
+
+      def sanitize_style_value(name, value)
+        case name
+        when "text-align"
+          sanitize_text_align(value)
+        when "color", "background-color", "background"
+          sanitize_color(value)
+        when "font-family"
+          sanitize_font_family(value)
+        when "font-size"
+          sanitize_font_size(value)
+        when "line-height"
+          sanitize_line_height(value)
+        when "-webkit-text-stroke", "text-stroke"
+          sanitize_text_stroke(value)
+        when "-webkit-text-stroke-color", "text-stroke-color"
+          sanitize_color(value)
+        when "-webkit-text-stroke-width", "text-stroke-width"
+          sanitize_text_stroke_width(value)
+        end
+      end
+
+      def sanitize_text_align(value)
+        align = value.to_s.strip.downcase
+        %w[left center right justify].include?(align) ? align : nil
+      end
+
+      def sanitize_color(value)
+        color = value.to_s.strip
+        color.match?(COLOR_PATTERN) && !color.match?(/[;:"'<>\\]/) ? color : nil
+      end
+
+      def sanitize_font_family(value)
+        family = value.to_s.strip
+        family.match?(FONT_FAMILY_PATTERN) ? family : nil
+      end
+
+      def sanitize_font_size(value)
+        size = value.to_s.strip
+        match = size.match(LENGTH_PATTERN)
+        if match && match[1].to_f.positive? && match[1].to_f <= 400
+          "#{match[1]}#{match[2] || 'px'}"
+        end
+      end
+
+      def sanitize_line_height(value)
+        height = value.to_s.strip
+        match = height.match(LINE_HEIGHT_PATTERN)
+        if match && match[1].to_f.positive? && match[1].to_f <= 10
+          "#{match[1]}#{match[2]}"
+        end
+      end
+
+      def sanitize_text_stroke(value)
+        match = value.to_s.strip.match(/\A([^\s]+)\s+(.+)\z/)
+        if match
+          width = sanitize_text_stroke_width(match[1])
+          color = sanitize_color(match[2])
+          width && color ? "#{width} #{color}" : nil
+        end
+      end
+
+      def sanitize_text_stroke_width(value)
+        width = value.to_s.strip
+        match = width.match(TEXT_STROKE_WIDTH_PATTERN)
+        if match && match[1].to_f >= 0 && match[1].to_f <= 8
+          "#{match[1]}px"
+        end
+      end
+
+      def safe_url?(attribute, value)
+        url = value.to_s.strip
+        if url.empty? || url.match?(/[\u0000-\u001f\u007f\s<>"']/)
+          false
+        elsif attribute == "src" && url.match?(/\Adata:/i)
+          url.match?(RASTER_DATA_URL_PATTERN)
+        elsif url.start_with?("#")
+          attribute == "href"
+        elsif url.start_with?("//")
+          false
+        elsif url.start_with?("/", "?")
+          true
+        elsif !url.include?(":")
+          url.match?(/\A[.\w~-][.\w~!$&'()*+,;=:@\/-]*(?:\?[^#]*)?(?:#.*)?\z/)
+        else
+          protocol = url.split(":", 2).first.downcase
+          if attribute == "href"
+            %w[http https mailto tel].include?(protocol)
+          else
+            %w[http https].include?(protocol)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/smeditor/rails/uploads.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+module SMEditor
+  module Rails
+    # Controller concern backing the image uploader.
+    #
+    #   class SMEditor::UploadsController < ApplicationController
+    #     include SMEditor::Rails::Uploads
+    #   end
+    #
+    # The JS side posts a `file` param; the controller stores it via
+    # ActiveStorage and responds with image attributes for the editor.
+    #
+    # Active only when config.uploads == :active_storage — otherwise
+    # the endpoint responds with 404 and the host wires its own upload.
+    #
+    # The endpoint is unauthenticated by default. It enforces a content
+    # type allow-list and a size ceiling, but an app with real users
+    # should subclass SMEditor::UploadsController and add authorization.
+    module Uploads
+      def create
+        error = upload_error
+        if error
+          render json: { error: error[:message] }, status: error[:status]
+        else
+          blob = ActiveStorage::Blob.create_and_upload!(
+            io: upload_file.to_io,
+            filename: upload_file.original_filename,
+            content_type: upload_file.content_type,
+          )
+
+          render json: image_payload(blob, upload_file)
+        end
+      end
+
+      private
+
+      # Walks every precondition once and yields the first failure, so
+      # `create` stays a single branch instead of a chain of guards.
+      def upload_error
+        if SMEditor.config.uploads != :active_storage
+          { message: "uploads disabled", status: :not_found }
+        elsif !active_storage_available?
+          { message: "active storage unavailable", status: :unprocessable_entity }
+        elsif upload_file.nil? || !upload_file.respond_to?(:content_type)
+          { message: "no file", status: :unprocessable_entity }
+        elsif !allowed_upload_type?(upload_file)
+          { message: "unsupported file type", status: :unsupported_media_type }
+        elsif oversized_upload?(upload_file)
+          { message: "file too large", status: :payload_too_large }
+        end
+      end
+
+      def upload_file
+        params[:file]
+      end
+
+      def active_storage_available?
+        defined?(::ActiveStorage::Blob)
+      end
+
+      def allowed_upload_type?(file)
+        type = file.content_type.to_s.split(";").first.to_s.strip.downcase
+        SMEditor.config.allowed_upload_types.include?(type)
+      end
+
+      def oversized_upload?(file)
+        limit = SMEditor.config.max_upload_size.to_i
+        limit.positive? && upload_size(file) > limit
+      end
+
+      # Tempfile-backed uploads know their size; anything else is measured
+      # from the IO so a streamed body cannot slip past the ceiling.
+      def upload_size(file)
+        if file.respond_to?(:size) && file.size
+          file.size
+        else
+          file.to_io.size
+        end
+      end
+
+      def image_payload(blob, file)
+        {
+          src: blob_path(blob),
+          alt: File.basename(file.original_filename.to_s, ".*"),
+          title: file.original_filename.to_s,
+        }
+      end
+
+      # only_path keeps it host-agnostic — the editor embeds a relative URL.
+      def blob_path(blob)
+        ::Rails.application.routes.url_helpers.rails_blob_path(
+          blob, only_path: true
+        )
+      end
+    end
+  end
+end

data/lib/smeditor/rails/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module SMEditor
+  module Rails
+    VERSION = "0.1.0"
+  end
+end

data/lib/smeditor.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+# smeditor — thin Rails adapter for the SMEditor editor.
+#
+# Loading order: version and config have no Rails dependency and load
+# first; the rest require Rails and are pulled in by the engine.
+
+require "smeditor/rails/version"
+require "smeditor/rails/config"
+
+require "smeditor/rails/sanitizer"
+require "smeditor/rails/form_helper"
+require "smeditor/rails/renderer"
+require "smeditor/rails/uploads"
+
+# The engine require is last — it pulls in Rails. In a non-Rails
+# context (e.g. unit-testing the sanitizer) the rescue keeps the gem
+# loadable without the framework present.
+begin
+  require "smeditor/rails/engine"
+rescue LoadError
+  # Rails not available — engine features are simply unavailable.
+end
+
+module SMEditor
+  module Rails
+    class Error < StandardError; end
+  end
+end

metadata

@@ -0,0 +1,111 @@
+--- !ruby/object:Gem::Specification
+name: smeditor
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- SMEditor contributors
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.13'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.13'
+- !ruby/object:Gem::Dependency
+  name: rails-html-sanitizer
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.6'
+description: |
+  Thin Rails adapter for SMEditor. Provides a form helper, a safe
+  server-side renderer, and an optional ActiveStorage-backed upload
+  endpoint. The editor itself is the upstream npm packages — this gem
+  never replaces or duplicates them.
+email:
+- sCruze@users.noreply.github.com
+executables: []
+extensions: []
+extra_rdoc_files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- app/assets/javascripts/smeditor.js
+- app/controllers/smeditor/uploads_controller.rb
+- config/routes.rb
+- lib/generators/smeditor/install_generator.rb
+- lib/generators/smeditor/templates/initializer.rb
+- lib/smeditor.rb
+- lib/smeditor/rails/config.rb
+- lib/smeditor/rails/engine.rb
+- lib/smeditor/rails/form_helper.rb
+- lib/smeditor/rails/renderer.rb
+- lib/smeditor/rails/sanitizer.rb
+- lib/smeditor/rails/uploads.rb
+- lib/smeditor/rails/version.rb
+homepage: https://github.com/sCruze/smeditor
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/sCruze/smeditor
+  source_code_uri: https://github.com/sCruze/smeditor/tree/main/gems/smeditor
+  changelog_uri: https://github.com/sCruze/smeditor/blob/main/gems/smeditor/CHANGELOG.md
+  bug_tracker_uri: https://github.com/sCruze/smeditor/issues
+  documentation_uri: https://rubydoc.info/gems/smeditor/0.1.0
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.3'
+requirements: []
+rubygems_version: 4.0.6
+specification_version: 4
+summary: Rails integration for the SMEditor rich text editor.
+test_files: []