studio-engine 0.122.0 → 0.124.0

data/app/controllers/studio/agent_chats_controller.rb

@@ -5,12 +5,18 @@ module Studio
   # to its own app; this controller forwards its two calls to the hub through
   # Studio::AgentChat:
   #
-  #   POST /agent_chat/messages  soul, text         -> 201 {turn}
+  #   POST /agent_chat/messages  soul, text, voice  -> 201 {turn, voice}
   #   GET  /agent_chat/turns     soul, after, limit -> 200 {turns, pending}
   #
   # Drawn by Studio.routes only for an app that names a soul
   # (Studio.agent_chat_souls).
   #
+  # WHO MAY USE IT: Studio.agent_chat_allowed, asked of the viewer on both calls.
+  # A refused viewer is a JSON 403 {error, reason: "not_allowed"} before any hub
+  # call and before an anon cookie is minted. These routes skip sign-in, so hiding
+  # a link is not the gate; with the app's token set the hub answers whoever gets
+  # through here.
+  #
   # WHAT THE BROWSER MAY CHOOSE, AND WHAT IT MAY NOT:
   #
   #   soul    only from the app's allow-list (Studio.agent_chat_souls); off the
@@ -27,6 +33,10 @@ module Studio
   #           POST that still holds the cookie sends both, so the hub folds the
   #           anonymous thread into the person's; the cookie is then deleted.
   #   ip      never: request.remote_ip, which the hub caps on.
+  #   voice   only what a take measured, {check, score, duration_ms}
+  #           (Studio::AgentChat.voice_param), and only from a user
+  #           Studio.voice_chat_allowed? lets talk; anyone else's words go as
+  #           typed. Never a name: the hub names the speaker.
   #
   # The host's ApplicationController is the base, so its session, current_user
   # and CSRF protection hold: the POST must carry the page's authenticity token
@@ -43,8 +53,10 @@ module Studio
     ANON_COOKIE = :studio_agent_chat_anon
     ANON_TTL = 1.year
     UNAVAILABLE = "Can't reach the chat right now. Try again in a moment."
+    NOT_ALLOWED = "This chat isn't open to you yet."
 
     before_action :no_store
+    before_action :require_chat_allowed
     before_action :resolve_soul
 
     def create
@@ -56,11 +68,13 @@ module Studio
       end
 
       who = person(mint: true, fold: true)
-      turn = Studio::AgentChat.post_message(soul: @soul, text: text, person: who, ip: request.remote_ip)
+      turn = Studio::AgentChat.post_message(soul: @soul, text: text, person: who, ip: request.remote_ip,
+                                            voice: spoken_voice)
       # A signed-in post that carried the anon token has folded that thread into
       # the person's: the token is spent. Kept on any failure, for the retry.
       cookies.delete(ANON_COOKIE) if who.key?(:email) && who.key?(:anon_token)
-      render json: { turn: turn }, status: :created
+      # `voice` is what the hub kept, so the page says who the agent was told spoke.
+      render json: { turn: turn.except("voice"), voice: turn["voice"] }.compact, status: :created
     rescue Studio::AgentChat::Error => e
       render_hub_error(e)
     end
@@ -80,6 +94,19 @@ module Studio
 
     private
 
+    # The message's `voice`, for a user who may talk; nil otherwise.
+    def spoken_voice
+      params[:voice] if Studio.voice_chat_allowed?(viewer)
+    end
+
+    def viewer
+      respond_to?(:current_user, true) ? current_user : nil
+    end
+
+    def require_chat_allowed
+      render_error(NOT_ALLOWED, :forbidden, reason: "not_allowed") unless Studio.agent_chat_allowed?(viewer)
+    end
+
     def no_store
       response.headers["Cache-Control"] = "no-store"
     end
@@ -128,7 +155,7 @@ module Studio
     # in docs/GOOGLE_AUTH_SETUP.md) counts. Anyone else chats as an
     # anonymous visitor.
     def verified_email
-      user = respond_to?(:current_user, true) ? current_user : nil
+      user = viewer
       return nil unless user
 
       hook = Studio.agent_chat_verified_email

data/app/controllers/studio/marketing_kit_controller.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Studio
+  # /marketing-kit: the app's logos, colours and typefaces, for anyone to use.
+  # See Studio::MarketingKit and docs/SITE_FOOTER.md.
+  #
+  # Public by design: a journalist or a partner has no account. It inherits the
+  # host's ApplicationController so the page renders in the app's layout, navbar
+  # and theme, and it skips each gate a host is known to put there:
+  # Studio::ErrorHandling's sign-in gate (every adopter), the hub's admin wall,
+  # and turf-monster's profile-completion redirect. A host with a gate of another
+  # name skips it in a to_prepare block (docs/SITE_FOOTER.md).
+  #
+  # It needs no table and no session, so an app with neither can draw it. Where
+  # ThemeSetting exists, the colours read it (Studio.marketing_kit_colors).
+  class MarketingKitController < ::ApplicationController
+    HOST_GATES = %i[require_authentication require_admin_wall require_admin require_login
+                    authenticate_user! require_profile_completion].freeze
+
+    HOST_GATES.each { |gate| skip_before_action gate, raise: false }
+
+    def show; end
+  end
+end

data/app/controllers/studio/voice_takes_controller.rb

@@ -19,6 +19,11 @@ module Studio
   # CSRF-protected (send the page's token as X-CSRF-Token), JSON, no-store.
   # The speaker is matched only against the signed-in user's own saved voice.
   #
+  # ALLOWED USERS ONLY (Studio.voice_chat_allowed; by default anyone signed in):
+  # anyone else is a JSON 403 {error, reason: "not_allowed"}, before the rate
+  # limit counts or anything is read. Hiding the microphone is not the gate; each
+  # take is a paid call.
+  #
   # RATE-LIMITED per user (Studio.voice_takes_rate_limit, 20 takes in 10
   # minutes): over it, a JSON 429 {error, reason: "rate_limited", retry_after}
   # and a Retry-After header, before anything is read or transcribed.
@@ -31,11 +36,13 @@ module Studio
     before_action :require_authentication
     protect_from_forgery with: :exception
     before_action :no_store
+    before_action :require_voice_allowed
     before_action :limit_takes
 
     CANT_HEAR = "I couldn't hear any words in that. Check your microphone and try again."
     UNAVAILABLE = "I couldn't transcribe that just now. Try again in a moment."
     TOO_MANY = "That's a lot of recordings in a short time. Wait a moment, then try again."
+    NOT_ALLOWED = "Voice isn't available on your account yet. Type instead for now."
 
     # The counter's fallback when the app's Rails.cache counts nothing (a
     # NullStore, as many apps run in development): per process, so a limit
@@ -81,6 +88,10 @@ module Studio
 
     private
 
+    def require_voice_allowed
+      refuse(NOT_ALLOWED, :forbidden, reason: "not_allowed") unless Studio.voice_chat_allowed?(current_user)
+    end
+
     # The per-user limit, a fixed window: the window's number is in the key, so
     # its end (retry_after) is known exactly. Rails' own rate_limit macro fixes
     # to:/within: when the class loads and counts nothing on a NullStore; this

data/app/controllers/style_controller.rb

@@ -6,14 +6,11 @@
 # The view is a bare content wrapper that renders inside each host's
 # application.html.erb, so it inherits that app's navbar + theme automatically.
 #
-# Reached at /admin/style (helper admin_style_path). The legacy /admin/design_system
-# route redirects here and keeps its admin_design_system_path helper resolving, so a
-# shipped host sidebar link that still points at the old helper keeps working.
+# Reached at /admin/style (helper admin_style_path).
 class StyleController < ApplicationController
   before_action :require_admin
 
-  # Load the live theme so the Theme section (the landing section, folded in from
-  # /admin/theme) shows this app's saved colors + the CSRF-protected editor.
+  # Load the live theme so the Theme section (the landing section) shows this app's saved colors + the CSRF-protected editor.
   # Best-effort: the section renders from Studio.theme_config defaults when no
   # ThemeSetting row exists, so a load hiccup must not take the whole page down.
   def index

data/app/controllers/theme_settings_controller.rb

@@ -1,10 +1,11 @@
+# The role colours' save endpoints. The editor lives on the style guide
+# (style/_theme), so GET /admin/theme sends an admin there; the route and its
+# name stay, because hosts link and register them.
 class ThemeSettingsController < ApplicationController
   before_action :require_admin
 
   def edit
-    @theme_setting = ThemeSetting.current
-    @defaults = Studio.theme_config
-    @preview_css = Studio::ThemeResolver.new(@theme_setting.resolved_colors).to_css
+    redirect_to editor_path
   end
 
   def update
@@ -18,10 +19,7 @@ class ThemeSettingsController < ApplicationController
   rescue StandardError => e
     return render(json: { error: e.message }, status: :unprocessable_entity) if request.format.json?
 
-    @defaults = Studio.theme_config
-    @preview_css = Studio::ThemeResolver.new(@theme_setting.resolved_colors).to_css
-    flash.now[:alert] = "Error saving theme: #{e.message}"
-    render :edit, status: :unprocessable_entity
+    redirect_to editor_path, alert: "Error saving theme: #{e.message}"
   end
 
   def regenerate
@@ -31,12 +29,14 @@ class ThemeSettingsController < ApplicationController
 
   private
 
+  def editor_path = admin_style_path(anchor: "theme")
+
   # The style guide saves by fetch and asks for JSON: a 204 is its proof of the
   # write. A form post is redirected back to the editor.
   def done(notice)
     return head(:no_content) if request.format.json?
 
-    redirect_to admin_theme_path, notice: notice
+    redirect_to editor_path, notice: notice
   end
 
   def theme_params

data/app/helpers/studio/agent_chat_helper.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Studio
+  # The agent chat's voice option (docs/AGENT_CHAT.md, "Talking by voice").
+  module AgentChatHelper
+    # The signed-in user on this page, or nil. A page whose controller has no
+    # current_user is a signed-out page.
+    def studio_agent_chat_viewer
+      respond_to?(:current_user) ? current_user : nil
+    end
+
+    # Whether this viewer gets the microphone: the app turned takes on (no route
+    # otherwise) and Studio.voice_chat_allowed lets them talk. Never a signed-out
+    # visitor: POST /voice/takes is sign-in only.
+    def studio_agent_chat_voice?
+      return false unless Studio.voice_transcription && respond_to?(:studio_voice_takes_path)
+
+      Studio.voice_chat_allowed?(studio_agent_chat_viewer)
+    end
+
+    # The embedder the page runs on a take (Studio::VoiceMatch.browser_config),
+    # as JSON, or nil. Only for a user whose saved voice came from the app's own
+    # embedder: anything else answers embedder_mismatch or no_profile on the
+    # server, so downloading the model would buy nothing.
+    def studio_agent_chat_embedder(user)
+      return nil unless user.respond_to?(:voice_embedding) && user.respond_to?(:voice_embedding_model)
+      return nil if user.voice_embedding.blank?
+
+      name = Studio.voice_embedder.to_s
+      return nil unless user.voice_embedding_model.to_s == Studio::VoiceMatch.model_id(name)
+
+      Studio::VoiceMatch.browser_config(name).to_json
+    rescue ArgumentError, KeyError
+      nil
+    end
+  end
+end

data/app/helpers/studio/site_footer_helper.rb

@@ -11,8 +11,8 @@ module Studio
   #   <%= studio_footer_map %>              the map alone, e.g. on a contact page
   #
   # THE FOOTER IS ON BY DEFAULT: with Studio.site_footer unset, the layout line
-  # renders the default footer (the site name, the logo, and the legal links the
-  # host has routes for), and `config.site_footer = false` turns it off. The
+  # renders the default footer (the site name, the logo, the legal links the host
+  # has routes for, and the Marketing Kit link where the page is drawn), and `config.site_footer = false` turns it off. The
   # booking helpers render NOTHING without Studio.booking_url, and the map
   # nothing without an address, so a layout or a shared view can call any of
   # them before an app has declared anything.
@@ -70,6 +70,19 @@ module Studio
                                        zoom: options[:zoom], controls: options.fetch(:controls, true)
     end
 
+    # The kit /marketing-kit prints (Studio.marketing_kit_for). A callable that
+    # raises costs the app's own facts, not the page: in production the error is
+    # logged once and the page shows what derives from the theme. In development
+    # and test it raises.
+    def studio_marketing_kit
+      Studio.marketing_kit_for(self)
+    rescue StandardError => error
+      raise if studio_site_footer_raise?
+
+      studio_site_footer_report(error)
+      Studio.marketing_kit_for(self, declared: nil)
+    end
+
     # ---- booking ------------------------------------------------------------
 
     def studio_booking? = Studio.booking_url.present?

data/app/javascript/studio/agent_chat.js

@@ -18,6 +18,12 @@
 //            until the app answers 201; a refusal shows its reason above them.
 //   FOLLOW   the thread stays at its end while the reader is within FOLLOW_PX of
 //            it, and always after their own send (the hub's chat_follow rule).
+//   REFRESH  the public hook for code outside the chat (studio/agent_chat_voice, a
+//            host's own composer): dispatch studio:agent-chat:refresh on the
+//            chat's section, optionally with {detail: {turn}}, a turn the app
+//            just answered. The turn shows at once, the chat follows it, and it
+//            polls now; a poll already in flight is followed by one more, so a
+//            refresh is never swallowed.
 //   TYPING   the typing line shows while the hub says an answer is pending:
 //            "thinking", then "typing" once a turn's status is "typing".
 //
@@ -31,6 +37,7 @@ export const IDLE_MS = 30000
 export const OFFLINE_MS = 15000
 export const FOLLOW_PX = 20
 export const LIMIT = 50
+export const REFRESH_EVENT = "studio:agent-chat:refresh"
 const UNSETTLED = new Set(["pending", "typing"])
 
 export function settled(turn) {
@@ -123,7 +130,7 @@ export function mountAgentChat(root, {
   const soul = root.dataset.agentChatSoul
   const name = root.dataset.agentChatName || "The agent"
 
-  const state = { turns: [], pending: false, waitingSince: null, offline: false, inFlight: false, sending: false, timer: null, alive: true, following: true }
+  const state = { turns: [], pending: false, waitingSince: null, offline: false, inFlight: false, pollAgain: false, sending: false, timer: null, alive: true, following: true }
 
   const onScroll = () => { state.following = isFollowing(log) }
   log.addEventListener("scroll", onScroll, { passive: true })
@@ -199,10 +206,40 @@ export function mountAgentChat(root, {
       setOffline(true)
     } finally {
       state.inFlight = false
-      schedule()
+      if (state.pollAgain) {
+        state.pollAgain = false
+        if (state.alive) poll()
+      } else {
+        schedule()
+      }
     }
   }
 
+  // The public refresh hook (REFRESH above). Returns poll's promise, or nothing
+  // when the poll in flight will be followed by another.
+  function refresh({ turn } = {}) {
+    if (!state.alive) return undefined
+    if (turn) {
+      state.turns = mergeTurns(state.turns, [turn])
+      state.pending = true
+      state.following = true
+      state.waitingSince = now()
+      setOffline(false)
+      render()
+      toEnd()
+    }
+    if (state.inFlight) {
+      state.pollAgain = true
+      return undefined
+    }
+    clearTimer(state.timer)
+    return poll()
+  }
+
+  function onRefresh(event) {
+    refresh(event.detail || {})
+  }
+
   async function submit(event) {
     if (event) event.preventDefault()
     const text = (input.value || "").trim()
@@ -264,6 +301,7 @@ export function mountAgentChat(root, {
   form && form.addEventListener("submit", submit)
   input && input.addEventListener("keydown", onKeydown)
   retry && retry.addEventListener("click", onRetry)
+  root.addEventListener(REFRESH_EVENT, onRefresh)
   doc && doc.addEventListener && doc.addEventListener("visibilitychange", onVisible)
   root.dataset.agentChatReady = "true"
   poll()
@@ -271,6 +309,7 @@ export function mountAgentChat(root, {
   return {
     state,
     poll,
+    refresh,
     submit,
     destroy() {
       state.alive = false
@@ -279,6 +318,7 @@ export function mountAgentChat(root, {
       form && form.removeEventListener("submit", submit)
       input && input.removeEventListener("keydown", onKeydown)
       retry && retry.removeEventListener("click", onRetry)
+      root.removeEventListener(REFRESH_EVENT, onRefresh)
       doc && doc.removeEventListener && doc.removeEventListener("visibilitychange", onVisible)
       delete root.dataset.agentChatReady
     }