studio-engine 0.13.1 → 0.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1509550e891472f578f1472b33782de7104a592e8d325ad11aa520c0b600171a
-  data.tar.gz: cac1e68d9950257d017a2f3c93d81733ac96e9ba27e9cf8b53cdfe06c9709552
+  metadata.gz: 4c7828a97a832ad01592ab1875eef12fc5365d1ad98e2e7c19da71b8e5a47cab
+  data.tar.gz: 8a8c6726ea00cad17bd17426184ca546c5ad3fc08c7d9d497448b76b0a5626d2
 SHA512:
-  metadata.gz: 2880909b924c60c406aae3990240c47ef0d36cba7b4c34fb7b150dcbc1cd93a35d81d6bbb1cb4b65d22b832f7e83635ac68b0b26ded20bd099cf434e5773a066
-  data.tar.gz: f87db04adcf27abd17485c52bbb1f5767269f50ed19e9ac66a808d9d95e0271adc1109eb64539173e81a603a3cae915d7b380282d2ab2fad3cf14bef0936933e
+  metadata.gz: df1f556225655c111cdb3499c0809f4495dc941421c2606a0c2c85f21f28b412f7a53a8c99fef6712e191cb3f4d8b892872fc799d3dadc3d0b666a42408b9c89
+  data.tar.gz: 1ac4533e4061b6da06319854f478d7adc5eaf01e38f04a0885cda122ea712c1f9211e4010582a6e2bfa62cbad2637e82518f28ef7ceac3d742a7cf5f9641d665

data/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) — `MAJOR.MINOR.PATCH`. Consumer Rails apps install the released RubyGems package with `gem "studio-engine", "~> 0.6"`; bumping the gem version and updating consumer lockfiles is a release.
 
+## 0.14.0 — 2026-07-22
+
+### Added
+
+- **Passwordless engine login** — the stock `sessions/new` sign-in view now
+  renders its method set from `auth_methods`, so a host app configured for
+  passwordless sign-in gets the correct engine-shipped view with no local
+  override. Fixes a 500 in the passwordless path where the view assumed a
+  password field.
+
 ## 0.13.1 — 2026-07-19
 
 ### Changed

data/app/assets/tailwind/studio_engine/engine.css

@@ -62,6 +62,33 @@
 
 /* -- Button system (standardized across all Studio apps) ------------------- */
 
+/*
+  Overridable variants — token contract.
+
+  Most filled variants sit on a theme role and darken on hover. Two of them
+  (btn-secondary, btn-neutral) are TOKEN-DRIVEN so a consuming app can retune
+  them WITHOUT redeclaring the @utility — a local `@utility` redeclaration is
+  ADDITIVE in Tailwind v4 (both definitions emit and the engine's rules leak in),
+  so forking is not a clean override. Set these on :root in the consumer's CSS:
+
+    --btn-secondary-bg            base fill      (default: var(--color-success))
+    --btn-secondary-bg-hover      hover fill     (default: same as base)
+    --btn-secondary-hover-filter  hover filter   (default: brightness(0.9))
+    --btn-neutral-bg              base fill      (default: var(--color-surface-alt))
+    --btn-neutral-bg-hover        hover fill     (default: var(--color-surface))
+    --btn-neutral-hover-filter    hover filter   (default: none)
+
+  With no tokens set, the compiled result is visually identical to the previous
+  hard-coded rules. Example — turf-monster's violet secondary + brightness neutral:
+
+    :root {
+      --btn-secondary-bg: #8e82fe; --btn-secondary-bg-hover: #7b6ef6;
+      --btn-secondary-hover-filter: none;
+      --btn-neutral-bg-hover: var(--color-surface-alt);
+      --btn-neutral-hover-filter: brightness(1.3);
+    }
+*/
+
 @utility btn {
   @apply inline-flex items-center justify-center font-bold rounded-lg transition px-6 py-2 text-sm disabled:opacity-50 disabled:cursor-not-allowed;
   &:focus-visible {
@@ -78,14 +105,17 @@
   }
 }
 
-/* NOTE: btn-secondary and btn-success compile to IDENTICAL declarations (both
-   sit on var(--color-success)) — an intentional hub-canonical alias, kept as
-   two names so existing markup in every consumer keeps working. */
+/* btn-secondary DEFAULTS to the success role — with no tokens set it compiles
+   like btn-success, preserving the hub-canonical alias every consumer relies on.
+   It is token-overridable (see the contract above) so an app whose secondary
+   action diverges from success (turf-monster's violet) retunes it via
+   --btn-secondary-* instead of forking the @utility. */
 @utility btn-secondary {
   @apply text-white;
-  background-color: var(--color-success);
+  background-color: var(--btn-secondary-bg, var(--color-success));
   &:hover {
-    filter: brightness(0.9);
+    background-color: var(--btn-secondary-bg-hover, var(--btn-secondary-bg, var(--color-success)));
+    filter: var(--btn-secondary-hover-filter, brightness(0.9));
   }
 }
 
@@ -130,10 +160,16 @@
   }
 }
 
+/* btn-neutral DEFAULTS to the surface-alt base / surface hover pair, token-
+   overridable the same way (--btn-neutral-*): turf-monster keeps its
+   brightness(1.3) hover by setting --btn-neutral-hover-filter and pinning
+   --btn-neutral-bg-hover back to the base so the fill does not change. */
 @utility btn-neutral {
-  @apply bg-surface-alt text-heading border border-strong;
+  @apply text-heading border border-strong;
+  background-color: var(--btn-neutral-bg, var(--color-surface-alt));
   &:hover {
-    @apply bg-surface;
+    background-color: var(--btn-neutral-bg-hover, var(--color-surface));
+    filter: var(--btn-neutral-hover-filter, none);
   }
 }
 

data/app/views/sessions/new.html.erb

@@ -35,36 +35,60 @@
         <%= render "sessions/sso_continue" if defined?(sso_user_available?) && sso_user_available? %>
       <% end %>
 
-      <%= form_tag login_path, method: :post do %>
-        <div class="mb-5">
-          <label for="email" class="block text-sm text-secondary mb-2 font-medium">Email</label>
-          <input type="email" name="email" id="email" value="<%= params[:email] %>" <%= 'autofocus' unless has_sso %>
-            x-ref="emailField"
-            class="input-field"
-            placeholder="you@example.com">
-        </div>
+      <%# The primary email form renders from the app's configured auth_methods: a PASSWORD
+          form only when passwords are available (Studio.password_login_available? — enabled AND
+          the User supports `authenticate`), otherwise the passwordless MAGIC-LINK request form.
+          The old hardcoded password field 500'd on every passwordless app's only sign-in path. %>
+      <% if Studio.password_login_available? %>
+        <%= form_tag login_path, method: :post do %>
+          <div class="mb-5">
+            <label for="email" class="block text-sm text-secondary mb-2 font-medium">Email</label>
+            <input type="email" name="email" id="email" value="<%= params[:email] %>" <%= 'autofocus' unless has_sso %>
+              x-ref="emailField"
+              class="input-field"
+              placeholder="you@example.com">
+          </div>
 
-        <div class="mb-6">
-          <label for="password" class="block text-sm text-secondary mb-2 font-medium">Password</label>
-          <input type="password" name="password" id="password"
-            class="input-field"
-            placeholder="Your password">
-        </div>
+          <div class="mb-6">
+            <label for="password" class="block text-sm text-secondary mb-2 font-medium">Password</label>
+            <input type="password" name="password" id="password"
+              class="input-field"
+              placeholder="Your password">
+          </div>
 
-        <button type="submit" class="btn btn-primary btn-lg w-full">
-          Log In
-        </button>
+          <button type="submit" class="btn btn-primary btn-lg w-full">
+            Log In
+          </button>
+        <% end %>
+      <% elsif Studio.auth_method?(:magic_link) %>
+        <%= form_tag magic_link_request_path, method: :post do %>
+          <div class="mb-5">
+            <label for="email" class="block text-sm text-secondary mb-2 font-medium">Email</label>
+            <input type="email" name="email" id="email" value="<%= params[:email] %>" <%= 'autofocus' unless has_sso %>
+              x-ref="emailField"
+              class="input-field"
+              placeholder="you@example.com">
+          </div>
+
+          <button type="submit" class="btn btn-primary btn-lg w-full">
+            Send sign-in link
+          </button>
+        <% end %>
       <% end %>
 
-      <div class="relative my-6">
-        <div class="absolute inset-0 flex items-center"><div class="w-full border-t border-subtle"></div></div>
-        <div class="relative flex justify-center text-sm"><span class="bg-surface px-3 text-secondary">or</span></div>
-      </div>
+      <% if Studio.auth_method?(:google) %>
+        <% if Studio.password_login_available? || Studio.auth_method?(:magic_link) %>
+          <div class="relative my-6">
+            <div class="absolute inset-0 flex items-center"><div class="w-full border-t border-subtle"></div></div>
+            <div class="relative flex justify-center text-sm"><span class="bg-surface px-3 text-secondary">or</span></div>
+          </div>
+        <% end %>
 
-      <%= button_to "/auth/google_oauth2", method: :post, data: { turbo: false },
-        class: "btn btn-google btn-lg w-full gap-3" do %>
-        <%= render "components/google_logo" %>
-        Sign in with Google
+        <%= button_to "/auth/google_oauth2", method: :post, data: { turbo: false },
+          class: "btn btn-google btn-lg w-full gap-3" do %>
+          <%= render "components/google_logo" %>
+          Sign in with Google
+        <% end %>
       <% end %>
 
       <p class="text-center text-secondary text-sm mt-6">

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.13.1"
+  VERSION = "0.15.0"
 end

data/lib/studio.rb

@@ -152,6 +152,28 @@ module Studio
     auth_methods.include?(method.to_sym)
   end
 
+  # True when the engine login should render a PASSWORD field/form: passwords are enabled
+  # (`:password` in auth_methods) AND the host User model actually supports them (responds to
+  # `authenticate` — i.e. `has_secure_password`). Both are required, and the second is the
+  # belt-and-suspenders: without it, a passwordless app (User with no `authenticate`) rendered
+  # the hardcoded password field and 500'd on submit via `user.authenticate` — the whole fleet
+  # having moved off passwords, this made the engine default wrong for every consumer. The User
+  # check is defensive of a mis-set auth_methods; the contract validation normally guarantees it
+  # (validate_user_contract! requires PASSWORD_USER_INSTANCE_METHODS iff auth_method?(:password)).
+  def self.password_login_available?
+    auth_method?(:password) && user_supports_password?
+  end
+
+  # Does the host User model respond to `authenticate` (has_secure_password)? Safe when no User
+  # is defined (an engine-only boot / a test with no host model) — answers false rather than raise.
+  def self.user_supports_password?
+    return false unless defined?(::User) && ::User.respond_to?(:instance_methods)
+
+    PASSWORD_USER_INSTANCE_METHODS.all? { |m| ::User.instance_methods.include?(m) }
+  rescue StandardError
+    false
+  end
+
   # True when the emailed/inbox magic-link URL is the short /l/<token> — i.e.
   # magic links are Studio::Link rows AND this app draws the /l routes. False =
   # the legacy /magic_link/<token> path: the :signed store, OR an app on the

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.13.1
+  version: 0.15.0
 platform: ruby
 authors:
 - Alex McRitchie
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-20 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -298,7 +297,6 @@ metadata:
   source_code_uri: https://github.com/amcritchie/studio-engine/tree/main
   bug_tracker_uri: https://github.com/amcritchie/studio-engine/issues
   changelog_uri: https://github.com/amcritchie/studio-engine/blob/main/CHANGELOG.md
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -313,8 +311,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 4.0.9
 specification_version: 4
 summary: Shared Rails engine providing auth, SSO, error logging, theming, and S3-backed
   image caching