studio-engine 0.65.2 → 0.66.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7389678882ebbd2bba6a35738f330283a2e5a226e68009a76b83f0c14b0e1351
-  data.tar.gz: de1b1a74888a3c2e47cc39da0377323c1b51c04d1aa718de9826fc338aff13a8
+  metadata.gz: d4fcdf18d2126610aee3af5f83e3cfd5c2c23253a5432ad1f54d5335ce1d3d03
+  data.tar.gz: 502c6ce16191beb678d1a23516862e596566394ea7b7a8756288cecd449c0551
 SHA512:
-  metadata.gz: f2c671579063631d50ac0298f2812ccde9a32a4554cc85ecf2b23368a8f51d2027f4eb03ed748c87104b7b68c9150d4fa7accec288d6b1a545ddf6233c755847
-  data.tar.gz: f2a53ef58b2bc5959d3a0c420f0cb8619b448caf496b9b437cd70e4f79ca5d8652e482338f2472ad3fd3f4b2609c0e5c47e8f0c7da3ca44d4d7b9e9828cb4f80
+  metadata.gz: c2bd8400088ba4b705391c85e271ff5fb00655c58a9f9e4e93671f4bada3da77b45f2d0926348541ee8c4a5fdc6e3e351d6e82ab2cf06b9f576257df07ffbcb4
+  data.tar.gz: 534da001522642f35e9aacd9d98a11c054dc491f6d97eddb4bf0f9571939da65d73869ff2e6daf2535698b4c55c8c3ed48c819981bcd9a15fe83278cd604a4a5

data/CHANGELOG.md

@@ -6,6 +6,44 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Added
 
+- **A green comment-leak scan used to mean "not looked at".**
+  `test/views/erb_comment_leak_test.rb` guards the ERB comment form in
+  `app/views/**/*.erb`. It never looked inside `<script>`, and that is where this
+  gem keeps its browser programs — `studio/modals/_host`,
+  `studio/solana/_phantom_deeplink`, `layouts/studio/_head` and the modal blocks
+  between them hold **1_239 JavaScript comments, 73_913 bytes of comment body**,
+  none of it read by any guard. A review of a diff made almost entirely of those
+  comments came back green, and the reviewer's note was the honest reading of it:
+  *"don't read that green as clearance."*
+
+  `test/views/script_comment_leak_test.rb` reads them. The rule is the one the ERB
+  guard applies — no ERB open or close sequence inside a comment body — and the
+  mechanism it defends against is worse than the ERB one. A tag quoted inside an
+  ERB comment is inert, because the comment swallows it. A tag quoted inside a
+  **JavaScript** comment is not inside anything ERB knows about, so ERB opens a tag
+  right there and **runs** it: a complete tag evaluates at render, and an
+  incomplete one swallows every byte up to the next close sequence in the file,
+  deleting working JavaScript with no syntax error to show for it. Wrapping the
+  line in an HTML comment does not help — ERB runs inside those too. Describing the
+  tag in words stays legal, exactly as it is for ERB comments.
+
+  **Finding a comment is the hard half, and the first cut of this got it wrong.**
+  Anchoring `<script>` blocks on raw source let an ERB comment's *prose mention* of
+  a script tag open the block: `studio/_board_assets.html.erb` reported 19_512
+  bytes of markup as JavaScript and never saw its real program on its own terms.
+  Blocks are now anchored on a copy with ERB tags and HTML comments blanked out,
+  length preserved so offsets and line numbers still land. Inside a block the
+  walker tracks the states that can hide a comment opener — a string
+  (`"https://…"` is not a comment), a template literal, a regex (`/\/\//`) — and a
+  literal or comment that never closes is REPORTED rather than absorbed, because a
+  walker that quietly lost its place is the same green as a clean file. The
+  assertions check the input as well as the verdict: how many blocks, comments and
+  bytes the scan actually reached, and that every block it opened matches a real
+  closing tag.
+
+  Zero findings across the engine at `origin/accepted`, so this lands green with no
+  allowlist.
+
 - **`data-pin` — the pinned stack publishes itself.** `--nav-h` / `--nav-bottom`
   answer for one element. Everything else that pins has been re-deriving the
   same geometry by hand: on `mcritchie-studio`'s `/deployments` the app strip
@@ -69,6 +107,54 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Changed
 
+- **The base template is web2: `:wallet` has left the `auth_methods` default.**
+  `Studio.auth_methods` defaulted to `%i[magic_link google wallet]` while
+  `Studio.features` defaulted to `[]`. Those two defaults disagree, and the
+  disagreement was load-bearing: the auth modal renders its wallet button from
+  `auth_method?(:wallet) && feature?(:web3)`, so a stock app rendered **no**
+  wallet button — while `Studio.routes` draws the Solana trio from
+  `auth_method?(:wallet)` alone, so the same stock app published
+  `GET /auth/solana/nonce`, `POST /auth/solana/verify` and
+  `GET /auth/phantom/callback`. All three `skip_before_action
+  :require_authentication`, and `#verify` lands in `User.from_solana_wallet`,
+  which `validate_user_contract!` never requires a host to implement. A brand-new
+  newsletter app inherited three public endpoints into an unvalidated contract.
+
+  studio-engine + McRitchie Studio is the base template for **every** app, web2
+  and web3 alike; solana-studio + Turf Monster is the web3 bolt-on. Most apps are
+  web2, so the default now says so: `%i[magic_link google]`. `README.md` and
+  `docs/NEW_APP_SETUP.md` have always printed that exact line as the new-app
+  configuration — the code simply disagreed with the docs it shipped.
+
+  **No current consumer changes behaviour**, because all three declare
+  `auth_methods` explicitly: McRitchie Studio (`magic_link google wallet`),
+  Turf Monster (`magic_link google wallet`, and `draw_auth_routes = false`
+  besides, so the engine draws neither group for it), mcritchie-industries
+  (`magic_link`). A wallet app opts in to both knobs — `auth_methods` including
+  `:wallet` **and** `features` including `:web3`, the second being what makes the
+  button appear.
+
+- **The auth route gate is pinned, and the gate choice is written down.**
+  Nothing tested which auth routes `Studio.routes` draws, on an engine whose
+  route changes break consumers at **boot** rather than at test time.
+  `test/integration/auth_route_gating_test.rb` draws the real host route table
+  under each consumer's configuration and reads the drawn routes back, so a
+  comment naming `auth/solana/nonce` cannot satisfy it.
+
+  The gate stays `draw_auth_routes && auth_method?(:wallet)` — **not** `&&
+  feature?(:web3)`, even though the modal uses both. `auth_methods` says which
+  CREDENTIALS an app accepts and these three paths are the credential exchange
+  itself; `features` gates product surfaces. `phantom_callback` is the mobile
+  deep-link RETURN url, so an app that declared `:wallet` and forgot `:web3`
+  would dead-end the handshake inside the user's wallet app with no server-side
+  trace — a worse failure than an endpoint that draws while the UI hides its
+  button. That decision is now a test with its rationale attached, so adding the
+  feature check flips a red assertion instead of silently unpublishing a live
+  consumer's routes. `Studio.draw_auth_routes`' comment likewise now records that
+  it is the OUTER switch, not the only gate: each group carries its own
+  `auth_methods` sub-gate, which is how a web2 app keeps magic-link while drawing
+  no `/auth/solana/*`.
+
 - **The navbar collapse primitive is broadcastable, rate-limited, and cheap per
   frame.** Three defects in the primitive as first landed, none of which a
   consuming app should inherit:

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.65.2"
+  VERSION = "0.66.0"
 end

data/lib/studio.rb

@@ -119,7 +119,23 @@ module Studio
   # display order. Both McRitchie Studio + Turf Monster are passwordless; legacy
   # email+password is opt-in via :password (which also re-arms the User#authenticate
   # contract check — see validate_user_contract!).
-  mattr_accessor :auth_methods, default: %i[magic_link google wallet]
+  #
+  # :wallet is deliberately NOT in the default. This engine plus McRitchie Studio
+  # is the BASE template for every app, web2 and web3 alike; solana-studio plus
+  # Turf Monster is the web3 bolt-on. Most apps are web2, so standing up Solana
+  # infrastructure to build a newsletter app is the wrong default.
+  #
+  # Membership here is also what DRAWS the Solana sign-in routes (see the wallet
+  # block in Studio.routes), so a default carrying :wallet published three public,
+  # unauthenticated /auth/solana/* endpoints on apps that ship no wallet at all —
+  # and #verify lands in User.from_solana_wallet, which validate_user_contract!
+  # does not require a host to implement. README.md and docs/NEW_APP_SETUP.md have
+  # always shown `%i[magic_link google]` as the new-app line; the code now agrees
+  # with the docs it ships. A wallet app opts in to BOTH knobs:
+  #
+  #   config.auth_methods = %i[magic_link google wallet]
+  #   config.features     = %i[web3]
+  mattr_accessor :auth_methods, default: %i[magic_link google]
 
   # ---- Capability features --------------------------------------------------
   # Coarse app-level capability switches an app opts into. Distinct from
@@ -230,10 +246,18 @@ module Studio
           "boot until the line is gone."
   end
 
-  # Whether Studio.routes draws the magic_link + solana wallet routes. An app that
-  # already defines its own auth routes (e.g. turf-monster, which has battle-tested
-  # magic_link/solana routes + extras) sets this false to avoid duplicate route
-  # NAMES at boot, keeping its own routes intact. New consumers leave it true.
+  # Whether Studio.routes draws the magic_link + solana wallet routes AT ALL. An
+  # app that already defines its own auth routes (e.g. turf-monster, which has
+  # battle-tested magic_link/solana routes + extras) sets this false to avoid
+  # duplicate route NAMES at boot, keeping its own routes intact. New consumers
+  # leave it true.
+  #
+  # This is the OUTER switch, and it is all-or-nothing by design: false means the
+  # host draws every auth route itself. It is NOT the only gate. Each group also
+  # carries its own auth_methods sub-gate, so a true app still draws only the
+  # methods it declares — magic_link needs auth_method?(:magic_link), the Solana
+  # trio needs auth_method?(:wallet). A web2 app therefore keeps magic-link while
+  # drawing no /auth/solana/* routes, without touching this flag.
   mattr_accessor :draw_auth_routes, default: true
 
   # Whether Studio.routes draws the unified /l/<token> link routes
@@ -829,6 +853,21 @@ module Studio
       # mobile wallet path at all and copying 400 lines of SIWS protocol per
       # app is how the picker came to exist three times. Account-linking and
       # the OAuth popup DO stay app-side.
+      #
+      # The gate is auth_methods, NOT auth_methods && feature?(:web3), even though
+      # the auth modal computes its wallet button from both
+      # (app/views/style/modals/_auth.html.erb). Deliberate: auth_methods says
+      # which CREDENTIALS this app accepts, features gates PRODUCT SURFACES, and
+      # these three paths are the credential exchange itself. phantom_callback is
+      # the mobile deep-link RETURN url — a wallet app that declared :wallet but
+      # forgot :web3 would dead-end the handshake inside the user's wallet app
+      # with no server-side trace, which is a worse failure than an endpoint that
+      # draws while the UI hides its button. Keying on the app's own declaration
+      # also keeps the two knobs independent, so an app may offer wallet SIGN-IN
+      # without shipping on-chain product surfaces.
+      #
+      # What stops a plain web2 app from publishing these is that :wallet is no
+      # longer in the auth_methods default — see that accessor above.
       if Studio.draw_auth_routes && Studio.auth_method?(:wallet)
         get  "auth/solana/nonce",  to: "solana_sessions#nonce",  as: :solana_nonce
         post "auth/solana/verify", to: "solana_sessions#verify", as: :solana_verify

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.65.2
+  version: 0.66.0
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-28 00:00:00.000000000 Z
+date: 2026-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails