studio-engine 0.10.0 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 20b0e58f17421ce741452b329000bc657f0dba0304198d7dc1fb59cb448bfc6d
-  data.tar.gz: d4446a5bad4b0b744e54ad7d4f275cf77455a68f2cf3289d6d9c472ca1f3c548
+  metadata.gz: 61bf440c6e7573b35e8d7a680851d2535b37b08690f36c0f8c42402a8a1fcc64
+  data.tar.gz: e79e46ab92bcd13bf5655526c199c1d7a1b17610d815dc240a5af7250455b9e1
 SHA512:
-  metadata.gz: b15b1f884815e8afbad3d9aa181589230193942970d62457075d08c47521c967a005025560e665b436ceb8a6c78f425688430f122cad9a7f21e8a4432bd4ca22
-  data.tar.gz: 5a6c6817018309298bb3a8eb686f61d7e93d9718d5b8ce5b5a8e642efc82f99695d6bf0c4f23b9421fa8c65481722e9164934c7cbe47f254e3abb482d7ea42ed
+  metadata.gz: 64d04f5527318728c090ad318d9d5f652a12b1e8eadc6f665eccd4a0c4a0aadff6d1c7dfaecdc5c2a438c08b648a34ba78f1869dc8df1b80c6d1ccc9728f457d
+  data.tar.gz: bba2fac4175596d6448dcc9611c9c4740f021fcfb467c09986a20d0d506e4c37cc933257ac6e0d23deb262a0fcf98baa3fe3bce104a8985e85562451ddab406f

data/CHANGELOG.md

@@ -4,6 +4,45 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+### Added
+- **Model-page protocol (v1)** — a reusable, admin-only per-record inspector,
+  drawn into every consuming app via `Studio.routes`:
+  `/models/:model/:id` renders one record as pretty JSON plus a copy/paste
+  rails-console command to reload it, and `/models/:model/random` bounces to a
+  random record of that model. New `Studio::ModelsController` +
+  `app/views/studio/models/show.html.erb` (theme-token styled, reuses the
+  `components/copy_button` partial). The protocol object `Studio::ModelPage`
+  ships an **empty registry** — no model is reachable until a host opts in with
+  `Studio::ModelPage.register("release", Release, lookup: :slug)` in an
+  initializer (mirrors the admin-models host-registry pattern; the engine never
+  constantizes host models by name). Gated with `require_admin`.
+
+## 0.11.0 — 2026-06-24
+
+### Changed
+- **Rails 8.1 support** — widened the gemspec `rails` bound from
+  `">= 7.0", "< 8.0"` to `">= 7.2", "< 8.2"`, so consuming apps can migrate to
+  Rails 8.1 independently (the engine no longer pins the ecosystem to Rails 7).
+  This release is the gate for the McRitchie Rails 8.1 train — `mcritchie-studio`
+  and `turf-monster` can bundle Rails 8.1 only once this version is published.
+  The lower bound moves to 7.2 (the oldest Rails the apps actually run) since
+  Rails 8 requires Ruby >= 3.2 and the ecosystem is already on Ruby 3.3.11.
+
+### Added
+- **`test/dummy` Rails app + `test/integration/engine_rails_8_1_boot_test.rb`** —
+  boots the engine inside a real Rails app and exercises its Rails-version-
+  sensitive surfaces (the Railtie registration, Zeitwerk autoload wiring, the
+  `Studio.routes` DSL, and the `ErrorLog` / `ThemeSetting` / `Sluggable`
+  ActiveRecord models). Re-run this against any new Rails line before widening
+  the bound again. The engine's full unit suite + this boot test are green
+  against Rails 8.1.3 (ActiveSupport/ActiveRecord 8.1, Zeitwerk 2.8, minitest 6).
+
+### Fixed
+- `bin/release-check` now prefers the `ruby@3.3` toolchain (was pinned to the
+  retired `ruby@3.1`, which cannot resolve Rails 8.1) and runs the full test
+  list, including the new Rails 8.1 boot test and the previously-omitted
+  `link_token` / sticky-header / admin-models-table tests.
+
 ## 0.10.0 — 2026-06-24
 
 ### Added

data/Gemfile

@@ -2,17 +2,19 @@ source "https://rubygems.org"
 
 gemspec
 
-# nokogiri 1.18.10 has 3 CVEs (1 HIGH regex-backtracking + 2 MEDIUM
-# in XSLT / xmlC14NExecute). Fix is `>= 1.19.3` but nokogiri 1.19.x
-# requires Ruby 3.2+. The ecosystem currently runs on Ruby 3.1.7;
-# bumping Ruby is a separate effort (across both Rails apps).
-#
-# **Important**: this gem does NOT declare nokogiri as a runtime
-# dependency in its gemspec — nokogiri comes into the consuming
-# Rails app via Rails itself. Consumers running Rails on a Ruby
-# version that supports nokogiri 1.19.x will resolve it. The
-# studio-engine gem's own Gemfile.lock (this repo's dev env) is the
-# only place still on 1.18.10.
-#
-# Tracked in SECURITY-AUDIT-2026-05-17.md. When the ecosystem bumps
-# to Ruby 3.2+, add: gem "nokogiri", ">= 1.19.3", group: :development
+# nokogiri: historically pinned to 1.18.10 here while the ecosystem was on
+# Ruby 3.1.7 (nokogiri >= 1.19.x requires Ruby 3.2+). The ecosystem is now on
+# Ruby 3.3.11, so a plain `bundle update` resolves the patched nokogiri
+# (>= 1.19.3, the line that fixed 3 CVEs: 1 HIGH regex-backtracking + 2 MEDIUM
+# XSLT / xmlC14NExecute). This gem still does NOT declare nokogiri as a runtime
+# dependency — it arrives via Rails in the consuming app. Tracked in
+# SECURITY-AUDIT-2026-05-17.md.
+
+group :development, :test do
+  # SQLite drives the test/dummy Rails app's in-memory database (see
+  # test/integration/engine_rails_8_1_boot_test.rb), which boots the engine
+  # against a real Rails app so we catch Rails-version incompatibilities in the
+  # engine's ActiveRecord/Railtie surfaces. Not a runtime dependency — the
+  # consuming apps bring their own database adapter. Rails 8.1 needs sqlite3 ~> 2.1.
+  gem "sqlite3", ">= 2.1"
+end

data/app/controllers/studio/models_controller.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Studio
+  # Serves the model-page protocol (see Studio::ModelPage). Admin-only: raw record
+  # JSON can carry internal fields, so this is an operator/debug surface, not a
+  # public one. require_authentication is inherited from the host app's
+  # ApplicationController (Studio::ErrorHandling); require_admin gates on top.
+  class ModelsController < ApplicationController
+    before_action :require_admin
+    before_action :load_page
+
+    # GET /models/:model/:id — one record as JSON + a copy/paste console command.
+    def show
+      head :not_found unless @page.record
+    end
+
+    # GET /models/:model/random — bounce to a random record's page (fresh sample).
+    def random
+      record = @page.random_record
+      return head(:not_found) unless record
+
+      redirect_to studio_model_path(@page.model_key, @page.identifier_for(record))
+    end
+
+    private
+
+    def load_page
+      @page = Studio::ModelPage.new(params[:model], params[:id])
+    rescue Studio::ModelPage::UnknownModel
+      head :not_found
+    end
+  end
+end

data/app/models/studio/model_page.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Studio
+  # The model-page protocol (v1).
+  #
+  # A reusable, per-record inspector. Given a whitelisted model key and a record
+  # identifier, it produces the two things a v1 model page renders — the record
+  # as pretty-printed JSON and a copy/paste rails-console command that reloads it
+  # — plus the lookup a "random sample" jump needs. The controller and view stay
+  # thin; enabling a model is a one-line registration.
+  #
+  # The engine ships an EMPTY registry: no model is reachable until a host app
+  # opts in. Each app registers its own models in an initializer, e.g.
+  #
+  #   Studio::ModelPage.register("release", Release, lookup: :slug)
+  #
+  # This mirrors the admin-models pattern — the host hands the engine live class
+  # references; the engine never constantizes host models by name. An unknown key
+  # raises UnknownModel, which the controller renders as 404.
+  class ModelPage
+    class UnknownModel < StandardError; end
+
+    Entry = Struct.new(:model, :lookup, keyword_init: true)
+
+    class << self
+      # Enable a model. `model` is the live AR class; `lookup` is the column its
+      # page URL is keyed on (usually its to_param backing). Returns the key.
+      def register(key, model, lookup: :slug)
+        registry[key.to_s] = Entry.new(model: model, lookup: lookup.to_sym)
+        key.to_s
+      end
+
+      def registered?(key)
+        registry.key?(key.to_s)
+      end
+
+      def keys
+        registry.keys
+      end
+
+      # Clears the registry — for tests and boot-time re-registration.
+      def reset!
+        registry.clear
+      end
+
+      def entry(key)
+        registry.fetch(key.to_s) { raise UnknownModel, "unknown model: #{key.inspect}" }
+      end
+
+      private
+
+      def registry
+        @registry ||= {}
+      end
+    end
+
+    attr_reader :model_key, :identifier
+
+    # identifier is the record's lookup-key value from the URL (nil for /random,
+    # which addresses the model as a whole rather than one record).
+    def initialize(model_key, identifier = nil)
+      @entry = self.class.entry(model_key)
+      @model_key = model_key.to_s
+      @identifier = identifier
+    end
+
+    def model
+      @entry.model
+    end
+
+    def lookup_key
+      @entry.lookup
+    end
+
+    # The record this page addresses (nil when the identifier matches nothing).
+    def record
+      return @record if defined?(@record)
+
+      @record = model.find_by(lookup_key => identifier)
+    end
+
+    # A random record of this model, for the "random sample" jump (nil if empty).
+    def random_record
+      model.order(::Arel.sql("RANDOM()")).first
+    end
+
+    # The copy/paste rails-console command that reloads this record, e.g.
+    #   Release.find_by(slug: "rel-20260707-a1b2c3")
+    def console_command
+      %(#{model.name}.find_by(#{lookup_key}: #{identifier.inspect}))
+    end
+
+    # The record serialized as pretty JSON — the page's primary payload.
+    def json
+      ::JSON.pretty_generate(record.as_json)
+    end
+
+    # The lookup-key value to route to for a given record (used by /random).
+    def identifier_for(record)
+      record.public_send(lookup_key)
+    end
+  end
+end

data/app/views/studio/models/show.html.erb

@@ -0,0 +1,32 @@
+<%# Model-page protocol (v1) — a uniform record inspector: the record as pretty
+    JSON plus a copy/paste rails-console command to reload it, with a jump to a
+    random sample record. Admin-only surface (Studio::ModelsController). The copy
+    button reuses the engine components/copy_button partial. %>
+<% model_label = @page.model.model_name.human %>
+<% content_for(:title, "#{model_label} - Model") %>
+
+<div class="max-w-7xl mx-auto px-4 py-8 space-y-6">
+  <header class="flex flex-col gap-3 md:flex-row md:items-end md:justify-between">
+    <div>
+      <p class="text-xs text-muted uppercase tracking-wide font-semibold">Model</p>
+      <h1 class="text-heading text-2xl font-bold mt-1"><%= model_label %></h1>
+      <p class="text-muted text-sm mt-1 font-mono"><%= @page.identifier %></p>
+    </div>
+    <%= link_to "🎲 Random sample", studio_model_random_path(@page.model_key), class: "btn btn-outline" %>
+  </header>
+
+  <%# The copy/paste line to reload this record in rails console. %>
+  <section class="card p-4 space-y-2">
+    <p class="text-xs text-muted uppercase tracking-wide font-semibold">Rails console</p>
+    <%= render "components/copy_button", text: @page.console_command %>
+  </section>
+
+  <%# The record serialized as pretty JSON — the protocol's primary payload. %>
+  <section class="card overflow-hidden">
+    <div class="flex items-center justify-between px-4 py-2 bg-surface-alt border-b border-subtle">
+      <p class="text-xs text-muted uppercase tracking-wide font-semibold">JSON</p>
+      <span class="font-mono text-xs text-muted"><%= @page.model.name %></span>
+    </div>
+    <pre class="overflow-x-auto px-4 py-3 text-xs font-mono text-heading leading-relaxed bg-inset"><%= @page.json %></pre>
+  </section>
+</div>

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.10.0"
+  VERSION = "0.12.0"
 end

data/lib/studio.rb

@@ -309,6 +309,16 @@ module Studio
       get   "admin/email_images",          to: "studio/email_images#index",  as: :admin_email_images
       patch "admin/email_images/:variant", to: "studio/email_images#update",  as: :admin_email_image,
             constraints: { variant: /[a-z_]+/ }
+
+      # Model-page protocol (v1) — a reusable per-record inspector. Drawn into
+      # every consuming app: /models/:model/:id renders one record as pretty JSON
+      # plus a copy/paste rails-console command; /models/:model/random bounces to
+      # a random record of that model. Admin-only (Studio::ModelsController).
+      # Ships an EMPTY registry — a host enables a model in an initializer with
+      # `Studio::ModelPage.register("release", Release, lookup: :slug)`. `random`
+      # is drawn BEFORE `:id` so it is not captured as a record identifier.
+      get "models/:model/random", to: "studio/models#random", as: :studio_model_random
+      get "models/:model/:id",    to: "studio/models#show",   as: :studio_model
     end
   end
 end

data/studio-engine.gemspec

@@ -21,7 +21,7 @@ Gem::Specification.new do |spec|
   spec.files = Dir["lib/**/*", "app/**/*", "config/**/*", "db/**/*", "tailwind/**/*", "Gemfile", "studio-engine.gemspec", "README.md", "CHANGELOG.md", "LICENSE"]
   spec.require_paths = ["lib"]
 
-  spec.add_dependency "rails", ">= 7.0", "< 8.0"
+  spec.add_dependency "rails", ">= 7.2", "< 8.2"
   spec.add_dependency "tailwindcss-rails", "~> 4.5"
   spec.add_dependency "faker", ">= 2.0", "< 4.0"
   spec.add_dependency "solid_queue", ">= 1.0", "< 2.0"

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.12.0
 platform: ruby
 authors:
 - Alex McRitchie
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-07-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -15,20 +16,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '7.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '7.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.2'
 - !ruby/object:Gem::Dependency
   name: tailwindcss-rails
   requirement: !ruby/object:Gem::Requirement
@@ -187,6 +188,7 @@ files:
 - app/controllers/studio/email_images_controller.rb
 - app/controllers/studio/links_controller.rb
 - app/controllers/studio/local_emails_controller.rb
+- app/controllers/studio/models_controller.rb
 - app/controllers/theme_settings_controller.rb
 - app/helpers/studio/admin_models_table_helper.rb
 - app/helpers/studio_email_delivery_helper.rb
@@ -204,6 +206,7 @@ files:
 - app/models/studio/email_delivery.rb
 - app/models/studio/enumeral.rb
 - app/models/studio/link.rb
+- app/models/studio/model_page.rb
 - app/models/theme_setting.rb
 - app/services/google_oauth_validator.rb
 - app/services/magic_link.rb
@@ -258,6 +261,7 @@ files:
 - app/views/studio/modals/blocks/_processing_card.html.erb
 - app/views/studio/modals/blocks/_progress_countdown.html.erb
 - app/views/studio/modals/blocks/_success_card.html.erb
+- app/views/studio/models/show.html.erb
 - app/views/theme_settings/edit.html.erb
 - app/views/user_mailer/magic_link.html.erb
 - app/views/user_mailer/magic_link.text.erb
@@ -293,6 +297,7 @@ metadata:
   source_code_uri: https://github.com/amcritchie/studio-engine/tree/main
   bug_tracker_uri: https://github.com/amcritchie/studio-engine/issues
   changelog_uri: https://github.com/amcritchie/studio-engine/blob/main/CHANGELOG.md
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -307,7 +312,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.9
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: Shared Rails engine providing auth, SSO, error logging, theming, and S3-backed
   image caching