studio-engine 0.65.3 → 0.66.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ed062df7a9840a9633eb1c4995bc878bee401f98d85086e7943c5ec9f6b55d4
-  data.tar.gz: df0c1c7dc4e13185b3c8e3fbe7cb9243f4b310398843c43913ef0a1aa7b03762
+  metadata.gz: d4fcdf18d2126610aee3af5f83e3cfd5c2c23253a5432ad1f54d5335ce1d3d03
+  data.tar.gz: 502c6ce16191beb678d1a23516862e596566394ea7b7a8756288cecd449c0551
 SHA512:
-  metadata.gz: ca97a89b5c1452bad931ec0a332e9fff228ea43b7ebe2249516b3f60b9bf79f03fcb3171a66c5b8c7692e25389ac15d24a8c70b0176a82921fee80b2dd80a06e
-  data.tar.gz: 97061141650afc6472e15bcaf40dc96c5175897a25f6d4aea5cfb318dd1d92100db6cb1aa52c3feb4a018fe93bb924485fdee7fe97d5989a7779dfb0959b03c0
+  metadata.gz: c2bd8400088ba4b705391c85e271ff5fb00655c58a9f9e4e93671f4bada3da77b45f2d0926348541ee8c4a5fdc6e3e351d6e82ab2cf06b9f576257df07ffbcb4
+  data.tar.gz: 534da001522642f35e9aacd9d98a11c054dc491f6d97eddb4bf0f9571939da65d73869ff2e6daf2535698b4c55c8c3ed48c819981bcd9a15fe83278cd604a4a5

data/CHANGELOG.md

@@ -107,6 +107,54 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Changed
 
+- **The base template is web2: `:wallet` has left the `auth_methods` default.**
+  `Studio.auth_methods` defaulted to `%i[magic_link google wallet]` while
+  `Studio.features` defaulted to `[]`. Those two defaults disagree, and the
+  disagreement was load-bearing: the auth modal renders its wallet button from
+  `auth_method?(:wallet) && feature?(:web3)`, so a stock app rendered **no**
+  wallet button — while `Studio.routes` draws the Solana trio from
+  `auth_method?(:wallet)` alone, so the same stock app published
+  `GET /auth/solana/nonce`, `POST /auth/solana/verify` and
+  `GET /auth/phantom/callback`. All three `skip_before_action
+  :require_authentication`, and `#verify` lands in `User.from_solana_wallet`,
+  which `validate_user_contract!` never requires a host to implement. A brand-new
+  newsletter app inherited three public endpoints into an unvalidated contract.
+
+  studio-engine + McRitchie Studio is the base template for **every** app, web2
+  and web3 alike; solana-studio + Turf Monster is the web3 bolt-on. Most apps are
+  web2, so the default now says so: `%i[magic_link google]`. `README.md` and
+  `docs/NEW_APP_SETUP.md` have always printed that exact line as the new-app
+  configuration — the code simply disagreed with the docs it shipped.
+
+  **No current consumer changes behaviour**, because all three declare
+  `auth_methods` explicitly: McRitchie Studio (`magic_link google wallet`),
+  Turf Monster (`magic_link google wallet`, and `draw_auth_routes = false`
+  besides, so the engine draws neither group for it), mcritchie-industries
+  (`magic_link`). A wallet app opts in to both knobs — `auth_methods` including
+  `:wallet` **and** `features` including `:web3`, the second being what makes the
+  button appear.
+
+- **The auth route gate is pinned, and the gate choice is written down.**
+  Nothing tested which auth routes `Studio.routes` draws, on an engine whose
+  route changes break consumers at **boot** rather than at test time.
+  `test/integration/auth_route_gating_test.rb` draws the real host route table
+  under each consumer's configuration and reads the drawn routes back, so a
+  comment naming `auth/solana/nonce` cannot satisfy it.
+
+  The gate stays `draw_auth_routes && auth_method?(:wallet)` — **not** `&&
+  feature?(:web3)`, even though the modal uses both. `auth_methods` says which
+  CREDENTIALS an app accepts and these three paths are the credential exchange
+  itself; `features` gates product surfaces. `phantom_callback` is the mobile
+  deep-link RETURN url, so an app that declared `:wallet` and forgot `:web3`
+  would dead-end the handshake inside the user's wallet app with no server-side
+  trace — a worse failure than an endpoint that draws while the UI hides its
+  button. That decision is now a test with its rationale attached, so adding the
+  feature check flips a red assertion instead of silently unpublishing a live
+  consumer's routes. `Studio.draw_auth_routes`' comment likewise now records that
+  it is the OUTER switch, not the only gate: each group carries its own
+  `auth_methods` sub-gate, which is how a web2 app keeps magic-link while drawing
+  no `/auth/solana/*`.
+
 - **The navbar collapse primitive is broadcastable, rate-limited, and cheap per
   frame.** Three defects in the primitive as first landed, none of which a
   consuming app should inherit:

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.65.3"
+  VERSION = "0.66.0"
 end

data/lib/studio.rb

@@ -119,7 +119,23 @@ module Studio
   # display order. Both McRitchie Studio + Turf Monster are passwordless; legacy
   # email+password is opt-in via :password (which also re-arms the User#authenticate
   # contract check — see validate_user_contract!).
-  mattr_accessor :auth_methods, default: %i[magic_link google wallet]
+  #
+  # :wallet is deliberately NOT in the default. This engine plus McRitchie Studio
+  # is the BASE template for every app, web2 and web3 alike; solana-studio plus
+  # Turf Monster is the web3 bolt-on. Most apps are web2, so standing up Solana
+  # infrastructure to build a newsletter app is the wrong default.
+  #
+  # Membership here is also what DRAWS the Solana sign-in routes (see the wallet
+  # block in Studio.routes), so a default carrying :wallet published three public,
+  # unauthenticated /auth/solana/* endpoints on apps that ship no wallet at all —
+  # and #verify lands in User.from_solana_wallet, which validate_user_contract!
+  # does not require a host to implement. README.md and docs/NEW_APP_SETUP.md have
+  # always shown `%i[magic_link google]` as the new-app line; the code now agrees
+  # with the docs it ships. A wallet app opts in to BOTH knobs:
+  #
+  #   config.auth_methods = %i[magic_link google wallet]
+  #   config.features     = %i[web3]
+  mattr_accessor :auth_methods, default: %i[magic_link google]
 
   # ---- Capability features --------------------------------------------------
   # Coarse app-level capability switches an app opts into. Distinct from
@@ -230,10 +246,18 @@ module Studio
           "boot until the line is gone."
   end
 
-  # Whether Studio.routes draws the magic_link + solana wallet routes. An app that
-  # already defines its own auth routes (e.g. turf-monster, which has battle-tested
-  # magic_link/solana routes + extras) sets this false to avoid duplicate route
-  # NAMES at boot, keeping its own routes intact. New consumers leave it true.
+  # Whether Studio.routes draws the magic_link + solana wallet routes AT ALL. An
+  # app that already defines its own auth routes (e.g. turf-monster, which has
+  # battle-tested magic_link/solana routes + extras) sets this false to avoid
+  # duplicate route NAMES at boot, keeping its own routes intact. New consumers
+  # leave it true.
+  #
+  # This is the OUTER switch, and it is all-or-nothing by design: false means the
+  # host draws every auth route itself. It is NOT the only gate. Each group also
+  # carries its own auth_methods sub-gate, so a true app still draws only the
+  # methods it declares — magic_link needs auth_method?(:magic_link), the Solana
+  # trio needs auth_method?(:wallet). A web2 app therefore keeps magic-link while
+  # drawing no /auth/solana/* routes, without touching this flag.
   mattr_accessor :draw_auth_routes, default: true
 
   # Whether Studio.routes draws the unified /l/<token> link routes
@@ -829,6 +853,21 @@ module Studio
       # mobile wallet path at all and copying 400 lines of SIWS protocol per
       # app is how the picker came to exist three times. Account-linking and
       # the OAuth popup DO stay app-side.
+      #
+      # The gate is auth_methods, NOT auth_methods && feature?(:web3), even though
+      # the auth modal computes its wallet button from both
+      # (app/views/style/modals/_auth.html.erb). Deliberate: auth_methods says
+      # which CREDENTIALS this app accepts, features gates PRODUCT SURFACES, and
+      # these three paths are the credential exchange itself. phantom_callback is
+      # the mobile deep-link RETURN url — a wallet app that declared :wallet but
+      # forgot :web3 would dead-end the handshake inside the user's wallet app
+      # with no server-side trace, which is a worse failure than an endpoint that
+      # draws while the UI hides its button. Keying on the app's own declaration
+      # also keeps the two knobs independent, so an app may offer wallet SIGN-IN
+      # without shipping on-chain product surfaces.
+      #
+      # What stops a plain web2 app from publishing these is that :wallet is no
+      # longer in the auth_methods default — see that accessor above.
       if Studio.draw_auth_routes && Studio.auth_method?(:wallet)
         get  "auth/solana/nonce",  to: "solana_sessions#nonce",  as: :solana_nonce
         post "auth/solana/verify", to: "solana_sessions#verify", as: :solana_verify

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.65.3
+  version: 0.66.0
 platform: ruby
 authors:
 - Alex McRitchie