studio-engine 0.30.0 → 0.32.0

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.30.0
+  version: 0.32.0
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-08 00:00:00.000000000 Z
+date: 2026-08-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -220,7 +220,6 @@ files:
 - app/models/studio/model_page.rb
 - app/models/theme_setting.rb
 - app/services/google_oauth_validator.rb
-- app/services/magic_link.rb
 - app/services/studio/email_image.rb
 - app/views/components/_admin_dropdown.html.erb
 - app/views/components/_avatar.html.erb
@@ -247,7 +246,6 @@ files:
 - app/views/layouts/studio/_flash.html.erb
 - app/views/layouts/studio/_head.html.erb
 - app/views/layouts/studio/_smooth_load.html.erb
-- app/views/magic_links/confirm.html.erb
 - app/views/navbar/show.html.erb
 - app/views/registrations/new.html.erb
 - app/views/schema/index.html.erb
@@ -336,6 +334,7 @@ files:
 - lib/studio/engine.rb
 - lib/studio/environment_banner.rb
 - lib/studio/image_cache.rb
+- lib/studio/link_resolution.rb
 - lib/studio/link_token.rb
 - lib/studio/mail_transport.rb
 - lib/studio/redis.rb

data/app/services/magic_link.rb

@@ -1,122 +0,0 @@
-# Unified create-or-login magic link.
-#
-# A magic link is a signed, short-lived, single-use token keyed on an EMAIL
-# (the user may not exist yet — clicking the link either logs them in or
-# creates the account). The token is a `message_verifier(token_name)` payload
-# carrying the email + a sanitized return_to + a random jti.
-#
-# Single-use is enforced with the jti: on `generate` we record the jti in
-# Rails.cache (Redis, cross-process); on `consume` we delete it and reject if
-# it was already gone (replay / second click). The signature already covers
-# tamper + expiry; the jti closes the replay gap.
-#
-# Token name + TTL come from Studio config (Studio.magic_link_token_name /
-# Studio.magic_link_ttl) so each app can tune them; the jti cache entry is
-# always given a few extra minutes so a still-valid token's jti is present.
-#
-# NOTE on test env: the test cache is :null_store, where writes/deletes are
-# no-ops and `delete` always returns false — enforcing single-use there would
-# reject every legitimate consume. So enforcement is skipped for non-tracking
-# stores; the service unit test injects a real MemoryStore to exercise it.
-#
-# Lifted into studio-engine (was turf-monster app/services/magic_link.rb).
-class MagicLink
-  # Back-compat defaults. Behavior is driven by the `token_name` / `ttl` methods
-  # (which read Studio config); these constants remain so existing consumer code
-  # /tests referencing MagicLink::TTL keep working, and they equal the config
-  # defaults.
-  TOKEN_KEY = "magic_link_v1"
-  TTL       = 15.minutes
-
-  class InvalidToken < StandardError; end
-
-  Result = Struct.new(:email, :return_to, keyword_init: true)
-
-  class << self
-    # Test seam — defaults to Rails.cache. The service unit test sets this to
-    # an ActiveSupport::Cache::MemoryStore to assert single-use, then resets it.
-    attr_writer :cache
-
-    def cache
-      @cache || Rails.cache
-    end
-
-    def token_name
-      Studio.magic_link_token_name
-    end
-
-    def ttl
-      Studio.magic_link_ttl
-    end
-
-    # jti outlives the token so a valid token's jti is always still present.
-    def jti_ttl
-      ttl + 5.minutes
-    end
-
-    # Returns a signed token string. `return_to` is sanitized to a local path.
-    # The MessageVerifier blob is standard base64 (can contain "/" and "+"),
-    # which breaks the `%r{[^/]+}` route constraint once the payload is large
-    # enough to emit a "/". Wrap it URL-safe so the token is always
-    # [A-Za-z0-9_-]=, matching the route and surviving URL generation.
-    def generate(email:, return_to: nil)
-      normalized = normalize_email(email)
-      jti = SecureRandom.hex(16)
-      cache.write(jti_key(jti), normalized, expires_in: jti_ttl) if enforce_single_use?
-      raw = verifier.generate(
-        { email: normalized, return_to: sanitize_path(return_to), jti: jti, v: 1 },
-        expires_in: ttl
-      )
-      Base64.urlsafe_encode64(raw)
-    end
-
-    # Verifies signature + expiry + single-use. Returns a Result or raises
-    # InvalidToken. Idempotency is NOT offered — a consumed token is dead.
-    def consume(token)
-      raw = Base64.urlsafe_decode64(token.to_s)
-      payload = verifier.verify(raw).with_indifferent_access
-      raise InvalidToken, "unexpected token shape" unless payload[:v] == 1 && payload[:email].present?
-
-      if enforce_single_use?
-        # delete returns true only when the jti was still present
-        raise InvalidToken, "link already used or expired" unless cache.delete(jti_key(payload[:jti]))
-      elsif !Rails.env.test?
-        # Single-use is disabled (non-tracking cache). Expected in :null_store
-        # dev; in any other env it means replay protection is silently OFF —
-        # tokens are replayable for their TTL. Surface it loudly.
-        Rails.logger.warn("[MagicLink] single-use NOT enforced (cache=#{cache.class}); links are replayable until expiry")
-      end
-
-      Result.new(email: payload[:email], return_to: sanitize_path(payload[:return_to]))
-    rescue ActiveSupport::MessageVerifier::InvalidSignature, ArgumentError
-      # ArgumentError → malformed base64 (tampered/truncated token).
-      raise InvalidToken, "invalid or expired link"
-    end
-
-    private
-
-    def verifier
-      Rails.application.message_verifier(token_name)
-    end
-
-    def jti_key(jti)
-      "magic_link/jti/#{jti}"
-    end
-
-    def normalize_email(email)
-      email.to_s.strip.downcase
-    end
-
-    # Only same-origin absolute paths survive; everything else (protocol-relative
-    # "//evil", absolute URLs, blank) collapses to nil so callers fall back to a
-    # default redirect.
-    def sanitize_path(path)
-      p = path.to_s
-      p.start_with?("/") && !p.start_with?("//") ? p : nil
-    end
-
-    def enforce_single_use?
-      !cache.is_a?(ActiveSupport::Cache::NullStore)
-    end
-  end
-end

data/app/views/magic_links/confirm.html.erb

@@ -1,2 +0,0 @@
-<%# Legacy /magic_link/:token interstitial. Shared body in studio/_confirm_interstitial. %>
-<%= render "studio/confirm_interstitial", consume_path: magic_link_consume_path(token: @token) %>