spree_dashboard 5.6.0.rc1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 00ab70dc5556a8ef8e044c41b7b1b420b99cdfb1677e743832886c4aba4f07e7
+  data.tar.gz: f29e4be23eaa1f634cdb29cda7c971c5397aa22f13bbce6e4285a73b8f9fe60f
+SHA512:
+  metadata.gz: 2853926c77a77f4a9f58efb12fc9ccf189a7dd7000596cb712ccc56c1f7471fb6e205ce35e545f53b2b23d5e77d7e8b6e81b8697f858a7c101b55f4da0af02a8
+  data.tar.gz: ce2e2d80e83f35e8f6fd9815a409549818818601b807039065e1d4ddd3798421852eeab6c8fcf944933b3dbf53c4d064fff9294a356c2419aaf4ab8da2b860b2

data/README.md

@@ -0,0 +1,41 @@
+# spree_dashboard
+
+Hosts the [Spree React Dashboard](https://spreecommerce.org/docs/developer/dashboard/overview) from your Spree server — the **single-node topology**: the dashboard and the Admin API share one origin, so there are no CORS entries to maintain and auth cookies stay `SameSite=Lax`.
+
+> **Developer Preview.** In Spree 6 this gem becomes the default admin delivery. The path is permanent: the dashboard lives at `/dashboard`, and `/admin` stays reserved for the classic `spree_admin`.
+
+## What it does
+
+Serves a built dashboard (`vite build` output) at **`/dashboard`** with SPA semantics: every dashboard route falls back to `index.html` (no-cache), Vite's content-hashed `assets/` get immutable caching, and paths are traversal-guarded. The bundle is public client code, so there's no authentication on the route — the SPA authenticates its API calls itself.
+
+## Setup
+
+```ruby
+# Gemfile
+gem 'spree_dashboard'
+```
+
+Point it at a built dashboard, either via env (what the official Docker image and the Render Blueprint use):
+
+```bash
+SPREE_DASHBOARD_DIST_PATH=/rails/dashboard
+```
+
+or an initializer:
+
+```ruby
+# config/initializers/spree.rb
+Spree::Dashboard.dist_path = Rails.root.join('dashboard/dist').to_s
+```
+
+Unset, `/dashboard` responds 404.
+
+The bundle must be built for sub-path mounting with a relative API base: `VITE_BASE_PATH=/dashboard/ pnpm build` (and `VITE_SPREE_API_URL` unset) — see the [deployment docs](https://spreecommerce.org/docs/developer/dashboard/deployment) for the full picture, including baking it into a Docker image.
+
+## Testing
+
+```bash
+bundle install
+bundle exec rake test_app   # generates the dummy app (skip if present)
+bundle exec rspec
+```

data/Rakefile

@@ -0,0 +1,15 @@
+require 'rubygems'
+require 'rake'
+require 'rake/testtask'
+require 'rspec/core/rake_task'
+require 'spree/testing_support/common_rake'
+
+RSpec::Core::RakeTask.new
+
+task default: :spec
+
+desc "Generates a dummy app for testing"
+task :test_app do
+  ENV['LIB_NAME'] = 'spree/dashboard'
+  Rake::Task['common:test_app'].invoke
+end

data/app/controllers/spree/dashboard/app_controller.rb

@@ -0,0 +1,78 @@
+module Spree
+  module Dashboard
+    # Serves a built React Dashboard (`vite build` output) at /dashboard — the
+    # single-node topology: the SPA and the Admin API share one origin, so no
+    # CORS entries and Lax cookies. The dist directory comes from
+    # `Spree::Dashboard.dist_path` (the official Docker image sets it via
+    # SPREE_DASHBOARD_DIST_PATH); when unset, /dashboard 404s.
+    #
+    # SPA semantics: real files are served with long-lived caching (Vite's
+    # `assets/` are content-hashed, so they're immutable); every other path
+    # falls back to index.html with no-cache so deploys take effect on the
+    # next navigation. No authentication — the bundle is public client code;
+    # the SPA authenticates its API calls itself.
+    class AppController < ActionController::Base
+      # GET-only file serving mutates nothing, but enable forgery protection
+      # anyway so the controller stays safe if an action is ever added.
+      protect_from_forgery with: :exception
+      # `verify_same_origin_request` blocks JavaScript responses to plain GET
+      # requests — protection against JSONP-style data leaks from dynamically
+      # generated JS. The Vite bundle is static public code that the SPA's own
+      # <script> tags must load, which is exactly that request shape.
+      skip_after_action :verify_same_origin_request
+
+      def show
+        root = dist_root
+        return head :not_found unless root
+
+        if (file = resolve_file(root, params[:path].to_s))
+          response.headers['Cache-Control'] = cache_control_for(params[:path].to_s)
+          send_file file, disposition: 'inline'
+        elsif (index = root.join('index.html')).file?
+          response.headers['Cache-Control'] = 'no-cache'
+          send_file index, type: 'text/html', disposition: 'inline'
+        else
+          head :not_found
+        end
+      end
+
+      private
+
+      def dist_root
+        path = Spree::Dashboard.dist_path
+        return if path.blank?
+
+        root = Pathname.new(path).expand_path
+        root if root.directory?
+      end
+
+      # Resolve a request path to a real file inside the dist directory.
+      # Defense in depth against traversal: reject null bytes, absolute
+      # paths, and any `.`/`..` segment before touching the filesystem, then
+      # verify the expanded path still lives under the dist root (which also
+      # covers symlinks pointing outside it).
+      def resolve_file(root, relative_path)
+        return if relative_path.blank? || relative_path.include?("\0")
+
+        relative = Pathname.new(relative_path)
+        return if relative.absolute?
+
+        segments = relative.each_filename.to_a
+        return if segments.empty? || segments.any? { |segment| segment == '.' || segment == '..' }
+
+        candidate = root.join(*segments).expand_path
+        return unless candidate.to_s.start_with?("#{root}#{File::SEPARATOR}")
+
+        candidate if candidate.file?
+      end
+
+      def cache_control_for(relative_path)
+        if relative_path.start_with?('assets/')
+          'public, max-age=31536000, immutable'
+        else
+          'public, max-age=3600'
+        end
+      end
+    end
+  end
+end

data/config/routes.rb

@@ -0,0 +1,8 @@
+Spree::Core::Engine.add_routes do
+  # Hosted React Dashboard (single-node topology). Serves the built SPA from
+  # `Spree::Dashboard.dist_path`; 404s when unconfigured. `format: false`
+  # keeps asset extensions (.js, .css, .svg) inside the splat instead of
+  # being parsed as a response format.
+  get '/dashboard', to: 'dashboard/app#show', as: :dashboard_app
+  get '/dashboard/*path', to: 'dashboard/app#show', format: false
+end

data/lib/spree/dashboard/engine.rb

@@ -0,0 +1,10 @@
+require 'rails/engine'
+
+module Spree
+  module Dashboard
+    class Engine < Rails::Engine
+      isolate_namespace Spree
+      engine_name 'spree_dashboard'
+    end
+  end
+end

data/lib/spree/dashboard.rb

@@ -0,0 +1,19 @@
+require 'spree'
+
+module Spree
+  module Dashboard
+    class << self
+      # Directory holding a built React Dashboard (`vite build` output),
+      # served at /dashboard. Set from an initializer, or via the
+      # SPREE_DASHBOARD_DIST_PATH env var (which the official Docker image
+      # and the Render Blueprint use). Unset, /dashboard responds 404.
+      attr_writer :dist_path
+
+      def dist_path
+        @dist_path.presence || ENV.fetch('SPREE_DASHBOARD_DIST_PATH', nil)
+      end
+    end
+  end
+end
+
+require 'spree/dashboard/engine'

data/lib/spree_dashboard.rb

@@ -0,0 +1 @@
+require 'spree/dashboard'

metadata

@@ -0,0 +1,69 @@
+--- !ruby/object:Gem::Specification
+name: spree_dashboard
+version: !ruby/object:Gem::Version
+  version: 5.6.0.rc1
+platform: ruby
+authors:
+- Vendo Connect Inc.
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-07-15 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: spree
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.6.0.rc1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.6.0.rc1
+description: Serves a built Spree React Dashboard at /dashboard with SPA semantics
+  — the single-node topology where the dashboard and the Admin API share one origin.
+  Developer Preview; becomes the default admin delivery in Spree 6.
+email: hello@spreecommerce.org
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- README.md
+- Rakefile
+- app/controllers/spree/dashboard/app_controller.rb
+- config/routes.rb
+- lib/spree/dashboard.rb
+- lib/spree/dashboard/engine.rb
+- lib/spree_dashboard.rb
+homepage: https://spreecommerce.org
+licenses:
+- BSD-3-Clause
+metadata:
+  bug_tracker_uri: https://github.com/spree/spree/issues
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc1
+  documentation_uri: https://spreecommerce.org/docs/developer/dashboard/deployment
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc1
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.22
+signing_key:
+specification_version: 4
+summary: Hosts the Spree React Dashboard from your Spree server
+test_files: []