studio-engine 0.67.0 → 0.67.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ffd4e2260ecf5e4ed81cbe17b45001ac14b3bcbf576b4fd79b506bfa2fff6dc
-  data.tar.gz: d7f03282009eeb8f914637df864769fb5846808d4ccc270a1285c04564b18418
+  metadata.gz: 79895e24dd5ade937ec8c0b4afacd84605ad495530a4c37f94e053a2c1040170
+  data.tar.gz: 0f1716ef07d10fc5388ea15853767f6c7e8911e076e280a096a8424a494eba9c
 SHA512:
-  metadata.gz: 1ab14b588d1d5382cc1738205472ba01b3f7aeb4442b026a506a824e777060eeae59ab7873d3176bfb6fd5f1ca95633a052e02b69ebe8f7715a6c9a8cdc1d821
-  data.tar.gz: 9256f176a552cea09a38ec5e56b32749ce4e419f5231b90971e6c14f2099983e6b4be646cdac8cc5efdef2e6d476714875c00ff1beae980f66c31752446c7123
+  metadata.gz: 7c6e391302c996753b399019f2baeded267820a69d1f7451fe7ff68f82609fc625cc477cbdebb6127f74d0d5ed3a326ed4357d02c24b595e0fd1c213c3605895
+  data.tar.gz: 26bda400a871f3998a7baa64c72f43ed71a2d6d4ff177e02c4c6ae76d9bff65438e0bb33d48564802ea982bc2f628631906fc25e0a24167ec11d38796908310d

data/CHANGELOG.md

@@ -4,6 +4,21 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+### Fixed
+
+- **Knowledge layer hardening** — the five findings from the 0.67.0 reviews:
+  upload keys carry a random suffix (same-named uploads in the same second no
+  longer overwrite the first object before the unique index can refuse);
+  `normalize_path` drops dot segments (`a/../b` → `a/b` — the S3 key mirrors
+  the path, and a `..` reads as traversal to every scanner); `access_for`
+  normalizes the queried agent the way writes normalize keys (a capitalized
+  `Studio.knowledge_agents` roster entry no longer reads `none`); the inbox
+  badge counts before the status filter (filtering to `filed` no longer zeroes
+  it); chip styles moved to one shared partial (`_chip_styles`); and reference
+  migrations are now written omakase-rubocop-compatible, with the convention
+  noted in the migration header (consumer copies are linted by the consumer's
+  rubocop — measured on the Industries adoption ship).
+
 ### Added
 
 - **Knowledge layer primitive** — `Studio::KnowledgeDoc` + `/admin/knowledge`:

data/app/controllers/studio/knowledge_docs_controller.rb

@@ -25,11 +25,14 @@ module Studio
 
       scope = Studio::KnowledgeDoc.order(created_at: :desc)
       scope = scope.for_entity(@entity) if @entity
-      scope = scope.where(status: @status) if @status
 
-      @entities   = Studio::KnowledgeDoc.distinct.pluck(:entity).sort
+      @entities = Studio::KnowledgeDoc.distinct.pluck(:entity).sort
+      # Counted BEFORE the status filter: the badge answers "what waits for
+      # triage in this entity", and filtering to status=filed must not zero it.
       @inbox_size = scope.inbox.count
 
+      scope = scope.where(status: @status) if @status
+
       if @view == "folders"
         @folders = scope.folders_under(@folder)
         @docs    = scope.in_folder(@folder)

data/app/models/studio/knowledge_doc.rb

@@ -93,8 +93,13 @@ module Studio
       end
 
       # "/a//b/" -> "a/b". Nil-safe; the empty string is the root folder.
+      # Dot segments are dropped ("a/../b" -> "a/b"): harmless server-side, but
+      # the S3 key mirrors the path and a ".." reads as traversal to every
+      # scanner and human who ever greps the bucket.
       def normalize_path(value)
-        value.to_s.strip.squeeze("/").delete_prefix("/").delete_suffix("/")
+        value.to_s.strip.squeeze("/").split("/")
+             .reject { |segment| segment.empty? || segment == "." || segment == ".." }
+             .join("/")
       end
 
       def default_title(file)
@@ -105,8 +110,11 @@ module Studio
 
     # --- access ---------------------------------------------------------------
 
+    # The queried agent is normalized the same way written keys are, so a
+    # capitalized Studio.knowledge_agents roster entry reads its real level
+    # instead of silently defaulting to "none".
     def access_for(agent)
-      level = access.is_a?(Hash) ? access[agent.to_s] : nil
+      level = access.is_a?(Hash) ? access[agent.to_s.strip.downcase] : nil
       ACCESS_LEVELS.include?(level) ? level : "none"
     end
 
@@ -133,9 +141,13 @@ module Studio
       content_type = file.respond_to?(:content_type) ? file.content_type : nil
       body = file.respond_to?(:read) ? file.read : file.to_s
 
+      # The random suffix is load-bearing: the timestamp is second-granularity,
+      # so two same-named uploads in one second would otherwise write the same
+      # key — the second S3 PUT overwrites the first object BEFORE the unique
+      # index rejects the second row (found in PR #251 review, twice over).
       key = [
         "knowledge", entity, path.presence,
-        "#{Time.current.strftime('%Y%m%d%H%M%S')}-#{self.class.sanitize_filename(filename)}"
+        "#{Time.current.strftime('%Y%m%d%H%M%S')}-#{SecureRandom.hex(4)}-#{self.class.sanitize_filename(filename)}"
       ].compact.join("/")
 
       Studio::S3.upload(key: key, body: body, content_type: content_type)

data/app/views/studio/knowledge_docs/_browser.html.erb

@@ -11,12 +11,8 @@
     Styling note: gem-specific looks live in the scoped <style> below because a
     host's Tailwind build may not scan this gem's views (same reasoning as the
     geo grid). Layout leans on utilities every host already ships. %>
+<%= render "studio/knowledge_docs/chip_styles" %>
 <style>
-  .knowledge-chip { display: inline-block; padding: 0 .5rem; border-radius: 9999px;
-    font-size: .7rem; line-height: 1.4rem; border: 1px solid transparent; white-space: nowrap; }
-  .knowledge-chip-full  { background: rgb(16 185 129 / .12); border-color: rgb(16 185 129 / .4); color: rgb(5 150 105); }
-  .knowledge-chip-aware { background: rgb(245 158 11 / .12); border-color: rgb(245 158 11 / .4); color: rgb(180 83 9); }
-  .knowledge-chip-none  { background: rgb(148 163 184 / .12); border-color: rgb(148 163 184 / .4); color: rgb(100 116 139); }
   .knowledge-status { font-size: .7rem; padding: 0 .45rem; border-radius: .25rem; border: 1px solid rgb(148 163 184 / .5); }
   .knowledge-status-inbox      { border-color: rgb(245 158 11 / .6); color: rgb(180 83 9); }
   .knowledge-status-superseded { text-decoration: line-through; opacity: .6; }

data/app/views/studio/knowledge_docs/_chip_styles.html.erb

@@ -0,0 +1,10 @@
+<%# The access-chip look, shared by the browser and the show page — one
+    definition so the two can never drift. Scoped <style> rather than utility
+    classes because a host's Tailwind build may not scan this gem's views. %>
+<style>
+  .knowledge-chip { display: inline-block; padding: 0 .5rem; border-radius: 9999px;
+    font-size: .7rem; line-height: 1.4rem; border: 1px solid transparent; white-space: nowrap; }
+  .knowledge-chip-full  { background: rgb(16 185 129 / .12); border-color: rgb(16 185 129 / .4); color: rgb(5 150 105); }
+  .knowledge-chip-aware { background: rgb(245 158 11 / .12); border-color: rgb(245 158 11 / .4); color: rgb(180 83 9); }
+  .knowledge-chip-none  { background: rgb(148 163 184 / .12); border-color: rgb(148 163 184 / .4); color: rgb(100 116 139); }
+</style>

data/app/views/studio/knowledge_docs/show.html.erb

@@ -1,12 +1,6 @@
 <%# /admin/knowledge/:id — one document: metadata, access, download, and the
     triage form that files it out of the inbox. %>
-<style>
-  .knowledge-chip { display: inline-block; padding: 0 .5rem; border-radius: 9999px;
-    font-size: .7rem; line-height: 1.4rem; border: 1px solid transparent; white-space: nowrap; }
-  .knowledge-chip-full  { background: rgb(16 185 129 / .12); border-color: rgb(16 185 129 / .4); color: rgb(5 150 105); }
-  .knowledge-chip-aware { background: rgb(245 158 11 / .12); border-color: rgb(245 158 11 / .4); color: rgb(180 83 9); }
-  .knowledge-chip-none  { background: rgb(148 163 184 / .12); border-color: rgb(148 163 184 / .4); color: rgb(100 116 139); }
-</style>
+<%= render "studio/knowledge_docs/chip_styles" %>
 
 <div class="mb-4 text-sm">
   <%= link_to "← Knowledge", admin_knowledge_path(folder: @doc.path.presence) %>
@@ -29,7 +23,7 @@
   <div><dt class="opacity-60">Document date</dt><dd><%= @doc.document_date&.iso8601 || "—" %></dd></div>
   <div><dt class="opacity-60">Uploaded</dt><dd><%= @doc.created_at&.to_date&.iso8601 %> by <%= @doc.uploaded_by.presence || "—" %></dd></div>
   <div><dt class="opacity-60">Source</dt><dd><%= @doc.source_note.presence || "—" %></dd></div>
-  <div><dt class="opacity-60">File</dt><dd><%= @doc.file? ? "#{@doc.mime_type.presence || 'file'} · #{number_to_human_size(@doc.byte_size) if @doc.byte_size}" : "metadata only" %></dd></div>
+  <div><dt class="opacity-60">File</dt><dd><%= @doc.file? ? [ @doc.mime_type.presence || "file", (number_to_human_size(@doc.byte_size) if @doc.byte_size) ].compact.join(" · ") : "metadata only" %></dd></div>
   <div class="md:col-span-2"><dt class="opacity-60">Access</dt><dd><%= render "studio/knowledge_docs/access_chips", doc: @doc %></dd></div>
 </dl>
 

data/app/views/style/_modals.html.erb

@@ -76,9 +76,35 @@
   # Auth method-toggle defaults — mirror the app's Studio.auth_method? config;
   # Solana Wallet also needs the web3 capability, so it defaults OFF on an app
   # (like McRitchie Studio) that ships web3 off.
+  #
+  # web3_gem is the THIRD term, and it answers a question neither of the other
+  # two asks. auth_methods declares which CREDENTIALS an app accepts; features
+  # gates PRODUCT SURFACES — lib/studio.rb spells that split out where it
+  # deliberately does NOT gate the /auth/solana routes on :web3. Both are
+  # POLICY. Whether the wallet picker can RENDER AT ALL is template resolution,
+  # and the Solana button does nothing except swap to that picker. A trigger
+  # must carry at least the gate its target's REGISTRATION carries (see
+  # web3_gem above, which wraps the wallet-connect registration) or it opens an
+  # empty panel — the same failure the three specimen cards had, through a
+  # different door.
   ml_default = Studio.auth_method?(:magic_link)
   g_default  = Studio.auth_method?(:google)
-  w_default  = Studio.auth_method?(:wallet) && web3_on
+  w_default  = Studio.auth_method?(:wallet) && web3_on && web3_gem
+
+  # The Sign in card's toggles. Solana Wallet is DROPPED where the gem is
+  # absent, because that checkbox is the door this page actually opens:
+  # methodOn('wallet') reads props.methods.wallet — the toggle's own boolean —
+  # BEFORE it ever falls back to the defaults above, so a ticked box overrides
+  # w_default outright. Leaving it offered would keep the empty panel one click
+  # away in EVERY base-app configuration, including the stock auth_methods
+  # default that declares no :wallet at all. A control that cannot do its one
+  # job is worse than an absent one; the section prose says why it is gone.
+  auth_toggles = [
+    { model: "opts.magicLink", label: "Magic Link" },
+    { model: "opts.google",    label: "Google" }
+  ]
+  auth_toggles << { model: "opts.wallet", label: "Solana Wallet" } if web3_gem
+  auth_toggles << { model: "opts.terms", label: "Terms" }
 
   # Active-card glow-match expression builder: yields an Alpine boolean that is
   # true when $store.dsModals.current() is THIS specimen's modal. It discriminates
@@ -365,8 +391,12 @@
            :class="$store.dsModals.cardClasses()">
 
         <%# --- Auth suite --- %>
+        <%# web3_gem is passed, not recomputed: this file owns the lookup (see
+            above) and the auth modal's Solana button needs the SAME answer,
+            because that button's only job is to swap to the wallet-connect
+            registration gated on it a few lines down. One lookup, two readers. %>
         <template x-if="$store.dsModals.current().id === 'auth'">
-          <div><%= render "style/modals/auth" %></div>
+          <div><%= render "style/modals/auth", web3_gem: web3_gem %></div>
         </template>
 
         <%# --- Onboarding step (its card now lives in Profile) --- %>
@@ -629,6 +659,11 @@
         magic-link-sent &rarr; magic-link-resent</code>. Toggle the methods below a
         card, then open it to watch them gate the modal. The live card
         <strong>glows</strong>, and the glow follows the step machine as you advance.
+        <% unless web3_gem %>
+          <strong>Solana sign-in needs solana-studio, which this app does not
+          bundle</strong>, so that button and its toggle are absent here &mdash;
+          nothing registers the wallet picker the button opens.
+        <% end %>
       </p>
     </div>
     <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
@@ -639,12 +674,7 @@
             card_data: "opts: { magicLink: #{ml_default}, google: #{g_default}, wallet: #{w_default}, terms: true }",
             open_expr: "$store.dsModals.open('auth', { step: 'credentials', picksRequired: 6, methods: { magicLink: opts.magicLink, google: opts.google, wallet: opts.wallet }, terms: opts.terms })",
             glow_when: ds_glow.call("auth", step: "credentials"),
-            toggles: [
-              { model: "opts.magicLink", label: "Magic Link" },
-              { model: "opts.google",    label: "Google" },
-              { model: "opts.wallet",    label: "Solana Wallet" },
-              { model: "opts.terms",     label: "Terms" }
-            ] } do %>
+            toggles: auth_toggles } do %>
         <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 space-y-2 text-center">
           <span class="block h-2 w-16 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
           <span class="block h-6 w-full rounded border" style="border-color: var(--color-border-strong)"></span>

data/app/views/style/modals/_auth.html.erb

@@ -17,10 +17,27 @@
   resets; Solana swaps to the wallet-connect picker (a real ported specimen).
   No real auth happens — the demo shows the real UI.
 
+  LOCALS:
+    web3_gem (Boolean, required) — does solana-studio resolve. style/_modals
+    owns the lookup and registers wallet-connect behind the same flag; the
+    Solana button below is rendered only when it is true, because a button that
+    swaps to an unregistered id opens an empty panel. Fetched without a default
+    on purpose: a caller that forgets it should fail loudly here rather than
+    silently drop Solana sign-in from an app that has the gem.
+
+  NOT gated on web3_gem, deliberately: _methodDefaults.wallet below. It is the
+  fallback methodOn uses when an opener passes no methods hash, and on a base
+  app nothing reaches it — the Sign in card always passes explicit booleans, and
+  the only opener that omits them is the wallet picker's back button, which
+  needs the gem to exist at all. Adding the term there would read like a third
+  gate while changing no rendered outcome and no behaviour, and a gate that
+  cannot be shown to bite is decoration. The trigger below is the real gate.
+
   CRITICAL: rendered inside <template x-if="id==='auth'"> — Alpine requires a
   SINGLE root, so everything lives inside the outer <div>. The x-data is a
   double-quoted attribute: keep it free of double-quotes and backticks.
 %>
+<% web3_gem = local_assigns.fetch(:web3_gem) %>
 <div x-data="{
        email: '',
        ageAttested: false,
@@ -167,21 +184,36 @@
         <p role="alert" class="text-red-400 text-xs -mt-2 mb-3" x-text="props.googleError"></p>
       </template>
 
-      <%# 2. Solana — progresses to the Connect Wallet picker modal. Gated on
-          methodOn('wallet') (default OFF where web3 is off, e.g. McRitchie Studio). %>
-      <button @click="openWalletHub()" x-show="methodOn('wallet')" :disabled="!!props.submitting"
-              class="btn btn-neutral btn-lg w-full gap-3 mb-3 disabled:cursor-wait">
-        <svg width="18" height="14" viewBox="0 0 397 311" fill="none" x-show="props.submitting !== 'wallet'" aria-hidden="true">
-          <defs><linearGradient id="auth-solana-grad" x1="361" y1="-9" x2="153" y2="389" gradientUnits="userSpaceOnUse">
-            <stop offset="0" stop-color="#00FFA3"/><stop offset="1" stop-color="#DC1FFF"/>
-          </linearGradient></defs>
-          <path d="M65 234c2-2 6-4 9-4h317c6 0 9 7 5 11l-63 63c-2 2-6 4-9 4H6c-6 0-9-7-5-11l64-63z" fill="url(#auth-solana-grad)"/>
-          <path d="M65 4c2-2 6-4 9-4h317c6 0 9 7 5 11l-63 63c-2 2-6 4-9 4H6c-6 0-9-7-5-11L65 4z" fill="url(#auth-solana-grad)"/>
-          <path d="M333 119c-2-2-6-4-9-4H7c-6 0-9 7-5 11l63 63c2 2 6 4 9 4h317c6 0 9-7 5-11l-63-63z" fill="url(#auth-solana-grad)"/>
-        </svg>
-        <span x-show="props.submitting === 'wallet'" class="spinner" aria-hidden="true"></span>
-        <span x-text="props.submitting === 'wallet' ? 'Connecting…' : 'Solana'"></span>
-      </button>
+      <%# 2. Solana — progresses to the Connect Wallet picker modal. TWO gates,
+          asking two different questions, and only one of them is Alpine's:
+
+            x-show methodOn('wallet')  POLICY — does this app offer wallet as a
+              credential, and has the specimen card's toggle turned it on. Reads
+              props.methods.wallet first, so the card's checkbox overrides the
+              server default outright.
+            Ruby web3_gem             CAPABILITY — does solana-studio resolve, so
+              that something actually REGISTERED the wallet-connect id this button
+              swaps to. style/_modals wraps that registration in the same gate.
+
+          The policy gate cannot stand in for the capability one: a base app can
+          answer yes to the first and no to the second, and then the button opens
+          an empty panel. It has to be the RUBY gate because the toggle can flip
+          every Alpine term, and a control the operator can tick is not a gate. %>
+      <% if web3_gem %>
+        <button @click="openWalletHub()" x-show="methodOn('wallet')" :disabled="!!props.submitting"
+                class="btn btn-neutral btn-lg w-full gap-3 mb-3 disabled:cursor-wait">
+          <svg width="18" height="14" viewBox="0 0 397 311" fill="none" x-show="props.submitting !== 'wallet'" aria-hidden="true">
+            <defs><linearGradient id="auth-solana-grad" x1="361" y1="-9" x2="153" y2="389" gradientUnits="userSpaceOnUse">
+              <stop offset="0" stop-color="#00FFA3"/><stop offset="1" stop-color="#DC1FFF"/>
+            </linearGradient></defs>
+            <path d="M65 234c2-2 6-4 9-4h317c6 0 9 7 5 11l-63 63c-2 2-6 4-9 4H6c-6 0-9-7-5-11l64-63z" fill="url(#auth-solana-grad)"/>
+            <path d="M65 4c2-2 6-4 9-4h317c6 0 9 7 5 11l-63 63c-2 2-6 4-9 4H6c-6 0-9-7-5-11L65 4z" fill="url(#auth-solana-grad)"/>
+            <path d="M333 119c-2-2-6-4-9-4H7c-6 0-9 7-5 11l63 63c2 2 6 4 9 4h317c6 0 9-7 5-11l-63-63z" fill="url(#auth-solana-grad)"/>
+          </svg>
+          <span x-show="props.submitting === 'wallet'" class="spinner" aria-hidden="true"></span>
+          <span x-text="props.submitting === 'wallet' ? 'Connecting…' : 'Solana'"></span>
+        </button>
+      <% end %>
 
       <%# "or" divider — only when magic-link AND a social method are both on. %>
       <div class="relative my-4" x-show="methodOn('magicLink') && (methodOn('google') || methodOn('wallet'))">

data/db/migrate/20260901000001_create_studio_knowledge_docs.rb

@@ -3,6 +3,11 @@
 # (`bin/rails studio_engine:install:migrations && bin/rails db:migrate`) so the
 # table is created in the app's database. Do not hand-copy — a hand copy
 # collides with the installed copy on `class CreateStudioKnowledgeDocs`.
+#
+# STYLE NOTE: reference migrations are written omakase-rubocop-compatible
+# (spaces inside array brackets) because the installed copy is linted by the
+# CONSUMER's rubocop, not this gem's — an engine-styled copy fails the
+# consumer's cert untouched (measured on the Industries adoption ship).
 class CreateStudioKnowledgeDocs < ActiveRecord::Migration[7.2]
   def change
     create_table :studio_knowledge_docs do |t|
@@ -41,8 +46,8 @@ class CreateStudioKnowledgeDocs < ActiveRecord::Migration[7.2]
       t.timestamps
     end
 
-    add_index :studio_knowledge_docs, [:entity, :status]
-    add_index :studio_knowledge_docs, [:entity, :path]
+    add_index :studio_knowledge_docs, [ :entity, :status ]
+    add_index :studio_knowledge_docs, [ :entity, :path ]
     add_index :studio_knowledge_docs, :s3_key, unique: true
     add_index :studio_knowledge_docs, :superseded_by_id
   end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.67.0"
+  VERSION = "0.67.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.67.0
+  version: 0.67.2
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-01 00:00:00.000000000 Z
+date: 2026-09-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -440,6 +440,7 @@ files:
 - app/views/studio/geo_settings/edit.html.erb
 - app/views/studio/knowledge_docs/_access_chips.html.erb
 - app/views/studio/knowledge_docs/_browser.html.erb
+- app/views/studio/knowledge_docs/_chip_styles.html.erb
 - app/views/studio/knowledge_docs/_doc_row.html.erb
 - app/views/studio/knowledge_docs/_upload_form.html.erb
 - app/views/studio/knowledge_docs/index.html.erb