studio-engine 0.135.0 → 0.135.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1b8bd497e5ba5d6c113a0e6c221b03200f395b1c3d4032aa1327691b7c584c34
-  data.tar.gz: 0a64eb7f3a70bcbe03a50550d36a1d8da938498d91d5cf0a1fcb257845a76759
+  metadata.gz: 1773500bab65e455763f147763e2401b45b720bc04db947380847a7a85cb4e09
+  data.tar.gz: 3db38f0935be3b1665094094eab2c976d2cea82b66700a4a8def3bf32f73cc32
 SHA512:
-  metadata.gz: c325e02d5e2f0c2a9123ab2b342281b59d27635e48cca92396f792cd39a6fc403cf6e79bfc2e920f891ef9dcc30063e0460e393db83e7148470d3895615b4aad
-  data.tar.gz: 96424698d12cf9d7d60bfee31c6f8d97f5bb464439bb421d8f47ba3ab78f1ce359e9a01bd543f3baab4c45d502c73e117ed3074d4bc306c40582b9819ab3aa53
+  metadata.gz: 1400812c414d1ed15811d36aecaa3adc99cba9cba708d50b294ab35f0c73dfd5ca96961c8b51706f58e0c4d941fef904fa770be4bf27dacf6a9bb3f0e25eaeff
+  data.tar.gz: f36515d1e4dfe60484eadecc84f3b0df0b4d0da8158d12ca0b310f6cba1debe505c276df484a4b3d2936229d463297c8414569da9f3ad0dd5c83f696375c4eb0

data/CHANGELOG.md

@@ -4,6 +4,12 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.135.1 — 2026-11-07
+
+### Fixed
+
+- **The not-found page runs no session tracking and no geo detection.** `Studio::NotFoundController` runs as the exceptions app, outside the session and cookie middleware, so a session-throttled callback never holds there. It added a `Studio::UserSession` row on every signed-in 404, and an app with `Studio::GeoDetection` paid an IP geo lookup (up to 3s) on every 404. The controller now overrides `track_user_session` and `detect_geo_state` as no-ops. The callbacks stay registered, so an app that already skips them in its own initializer (Turf does) still boots; it can drop those lines after it bumps the engine. See `docs/NOT_FOUND_PAGE.md`, *What it skips*.
+
 ## 0.135.0 — 2026-11-07
 
 ### Fixed

data/app/controllers/concerns/studio/geo_detection.rb

@@ -24,6 +24,9 @@ module Studio
   #
   #   skip_before_action :detect_geo_state
   #
+  # The engine's not-found page (Studio::NotFoundController) needs no skip: it
+  # overrides the method as a no-op, so an app's own skip there still works.
+  #
   # SESSION KEYS are the plain names an app already has in production
   # (:geo_state, :geo_country, :geo_ip, :geo_detected_at, :geo_override) so an
   # app adopting this concern keeps every live visitor's resolved location

data/app/controllers/studio/not_found_controller.rb

@@ -13,6 +13,16 @@ module Studio
   # public/404.html, so a wall can cost the page its layout but never its status.
   class NotFoundController < ::ApplicationController
     skip_before_action :require_authentication, raise: false
+    # The page runs as the exceptions app, after the request has left the
+    # session and cookie middleware: nothing it writes to the session or a
+    # cookie is ever saved. A callback that throttles through the session never
+    # holds here, so it would pay its full cost on every 404. Two engine
+    # callbacks do that, and both are no-ops below (docs/NOT_FOUND_PAGE.md).
+    #
+    # Overridden, not skipped: the callbacks stay registered, so an app that
+    # already skips them itself with a raising skip_*_action (Turf did) still
+    # boots. A skip here would make that app's skip raise ArgumentError.
+
     # No forgery skip: Rails' ShowExceptions calls the exceptions app as a GET
     # (request_method = "GET"), which never needs the token, so the host's CSRF
     # allow-lists stay as they are.
@@ -29,6 +39,15 @@ module Studio
 
     private
 
+    # Studio::ErrorHandling's after_action. It would add a Studio::UserSession
+    # row on every signed-in 404, because the throttle cookie is never saved.
+    def track_user_session; end
+
+    # Studio::GeoDetection's before_action, when the app includes it. It would
+    # pay an IP geo lookup (up to 3s) on every 404, because the session stamp is
+    # never saved. Harmless in an app without the concern: nothing calls it.
+    def detect_geo_state; end
+
     def not_found_logo
       Studio.navbar_brand&.dig(:logo) || Studio.logo_for("Navbar Logo")
     end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.135.0"
+  VERSION = "0.135.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.135.0
+  version: 0.135.1
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-11-07 00:00:00.000000000 Z
+date: 2026-11-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails