solana-studio 0.12.4 → 0.13.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 1f185a71eb6ae6c07cd11e28ce02fe5d8ffe29d4f47cab0d77034a016440074b
|
|
4
|
+
data.tar.gz: 839d205b8f7334d6226c9373ee3cb265b9a9932d29245d7a164ca481c1636ec8
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: ba9c5ba1f63d0a51cdf543bd7068b185af5988617f4c42573325b02817327984b919d5dde2f37bca4d0ef842d3af946a2eaffbfa02064b0c2bc5eb95248a6ceb
|
|
7
|
+
data.tar.gz: bc8725d019f925591503a34ff30609efe1fb0d7d7fc4ab55d802d6669fbbca239cbe884a5e0a9c899ec44742bd980d0174a7b15466b7146e6ef68dd545725f8f
|
data/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,16 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
|
|
|
4
4
|
|
|
5
5
|
## Unreleased
|
|
6
6
|
|
|
7
|
+
## v0.13.0 (2026-10-12)
|
|
8
|
+
|
|
9
|
+
### Changed
|
|
10
|
+
- **`solana_studio/phantom_deeplink` and `solana_studio/deeplink_assets` render the request's CSP nonce on their inline script** (`nonce=` from `content_security_policy_nonce`; no attribute for a host with no nonce generator). They now run on a host whose script-src drops `'unsafe-inline'` for a nonce, as turf-monster's signing pages do.
|
|
11
|
+
|
|
12
|
+
### Tests
|
|
13
|
+
- **`test/views/script_nonce_test.rb` (2, new)**: each partial's inline script carries the nonce the view hands it, and none when the view has no nonce or no `content_security_policy_nonce`.
|
|
14
|
+
- **`e2e/phantom_deeplink.spec.js` (+1)**: under an enforced nonce-only `script-src` (the lab's `?strict=1`, the policy turf-monster's signing pages send) the deep link still defines `startPhantomDeepLink` with no inline-script violation. Control: the un-nonced partial reads `undefined`.
|
|
15
|
+
- **The browser lab loads studio-engine's `studio/modal_host` module.** The engine's modal host partial stopped rendering its store inline, so every lab modal spec failed at `Alpine.store('modals').open`; `e2e/boot.rb` now serves the installed gem's `modal_host.js` and the lab layout imports it ahead of Alpine.
|
|
16
|
+
|
|
7
17
|
## v0.12.4 (2026-10-07)
|
|
8
18
|
|
|
9
19
|
## v0.12.3 (2026-10-07)
|
|
@@ -14,7 +14,10 @@
|
|
|
14
14
|
|
|
15
15
|
Render before solana_studio/phantom_deeplink and in the callback view.
|
|
16
16
|
%>
|
|
17
|
-
|
|
17
|
+
<%# The request's CSP nonce, or nil (no attribute) when the host sets no
|
|
18
|
+
nonce generator or renders this outside a controller. %>
|
|
19
|
+
<% script_nonce = (content_security_policy_nonce if respond_to?(:content_security_policy_nonce)) %>
|
|
20
|
+
<script<% if script_nonce %> nonce="<%= script_nonce %>"<% end %>>
|
|
18
21
|
// NOT document.write. Under turbo-rails a Drive visit re-executes body scripts
|
|
19
22
|
// at readyState === 'complete', where document.write implicitly calls
|
|
20
23
|
// document.open() and BLANKS THE PAGE — on exactly the consumer this guard
|
|
@@ -54,7 +54,10 @@
|
|
|
54
54
|
Requires tweetnacl (window.nacl); render "solana_studio/deeplink_assets"
|
|
55
55
|
first, or supply it yourself.
|
|
56
56
|
%>
|
|
57
|
-
|
|
57
|
+
<%# The request's CSP nonce, or nil (no attribute) when the host sets no
|
|
58
|
+
nonce generator or renders this outside a controller. %>
|
|
59
|
+
<% script_nonce = (content_security_policy_nonce if respond_to?(:content_security_policy_nonce)) %>
|
|
60
|
+
<script<% if script_nonce %> nonce="<%= script_nonce %>"<% end %>>
|
|
58
61
|
(function () {
|
|
59
62
|
var STATEMENT = <%= Studio.wallet_sign_in_statement.to_json.html_safe %>;
|
|
60
63
|
|
|
@@ -16,5 +16,5 @@ module SolanaStudio
|
|
|
16
16
|
# through the normal cycle. Splitting the version out is the same shape
|
|
17
17
|
# studio-engine already uses (lib/studio/version.rb) and hands each file back
|
|
18
18
|
# to its real owner: this one to the release, the gemspec to the PR.
|
|
19
|
-
VERSION = "0.
|
|
19
|
+
VERSION = "0.13.0"
|
|
20
20
|
end
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: solana-studio
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.13.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Alex McRitchie
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2026-10-
|
|
11
|
+
date: 2026-10-12 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: ed25519
|