studio-engine 0.69.3 → 0.69.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ade07348f1d55403ac332ea2a030b8af81ff8b9b8d4a49b637326eb40168847
-  data.tar.gz: e5ee5053749871945628e8f522fffee01569e0ae3052016b9388c79b98be59d4
+  metadata.gz: 44ac04785253cb277ef70cd1d6398b81718e223adc7e300c1a19329183a88be5
+  data.tar.gz: 01c13c3974eb5da7887fc82e77f3526eb50af53a3e590b993a7602914e8daa81
 SHA512:
-  metadata.gz: baf91b4f29446f4cc53ef15890ba67e9691046c769af46ac3beec04f9ad530ad3f67ee9d4d686d85d37ed3b0f7e78c1e453eec0476e4146eaa97bbd8fdf4fd68
-  data.tar.gz: 5ae6368f5e8c1ba95081f8608acc3193e3b82436e42e6a2cef059a6e979fb1b025da56058f980bc544f7d0add642d2972d7aefcc5b37c1fda22ca65c71c269cf
+  metadata.gz: db96cbe447a67732cc7d2babc54f605071ccd9e3d77d20da4fb7486c5e89f5354e21dc34066757ec7bde7f66fb7fb08e257a15c364753d3a98f34ea8065df25b
+  data.tar.gz: f8a47251bf78b0c3bab42dfc743565c2dba66502f6f204516718144cd9506a5206bf6342b7ce496fa12f6f67a34727dc8fc7cbc5e03529ce5d3ab1e3727b4761

data/CHANGELOG.md

@@ -55,6 +55,91 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Fixed
 
+- **Onboarding no longer truncates a surname to fit a first name's cap.**
+  `Studio::OnboardingController#first_name` measured the WHOLE typed answer with
+  `Studio::FIRST_NAME_MAX_LENGTH` — the PER-FIELD cap, 40. The field asks for a
+  name and people type a full one, so "Bartholomew Fitzwilliam
+  Montgomery-Smythe" (41 characters) stored 40 of them and handed the account
+  back its own surname misspelled, **"Montgomery-Smyth"**, on every surface
+  `name` feeds.
+
+  **ONE CONSTANT WAS ANSWERING TWO QUESTIONS**, which is why neither call site
+  looked wrong. `/profile` applies the same number PER FIELD (`normalized_name`,
+  once to each of its two inputs); onboarding applied it to first name PLUS
+  surname in one string. The fix NAMES the second question rather than
+  re-scoping the first: **`Studio::FULL_NAME_MAX_LENGTH`**, the whole-answer
+  cap, `(FIRST_NAME_MAX_LENGTH * 2) + 1` = **81**. It is DERIVED, not picked —
+  first(40) + a space + last(40) is the longest answer whose two halves BOTH
+  still fit the per-field cap, so onboarding can never accept a name `/profile`
+  would silently shorten on the next save, which is the drift the shared
+  constant existed to prevent. `FIRST_NAME_MAX_LENGTH` keeps its value and its
+  meaning, and `test/integration/profile_name_field_caps_test.rb` now proves
+  that by sending BOTH fields over-long in one request and reading two 40s back
+  — a single-field assertion cannot tell "per field" from "per whole name".
+
+  **PAST THE CAP IT REFUSES INSTEAD OF TRUNCATING** (422 + `{ error: … }`,
+  rendered inline by the modal). `.first(cap)` on a name is not a cap but a
+  rewrite: it accepted the answer, stored something nobody typed, and reported
+  success — and raising the number alone would only move that cliff one
+  character further out. Two independent rules, because the whole answer becomes
+  `name` while each half becomes its own column: the answer must fit the
+  whole-answer cap, and each derived half must fit the per-field cap (a single
+  60-character word passes the first and would still land a `first_name`
+  `/profile` shortens). The onboarding input's `maxlength` default was a LITERAL
+  `40` — a third copy of the per-field number, on the one field that receives a
+  whole name — and now reads `FULL_NAME_MAX_LENGTH`, so the browser bound and
+  the server bound cannot drift.
+
+  **NEITHER CAP IS A COLUMN CEILING.** Measured 2026-09-06 across all six
+  consumer databases (mcritchie-studio, turf-monster, mcritchie-industries;
+  production and QA): `name`, `first_name` and `last_name` are unbounded
+  `character varying` — `character_maximum_length` NULL, no CHECK constraint, no
+  model length validation. Raising the bound cannot trade a silent truncation
+  for a raised error at any value, so this is a product decision start to
+  finish.
+
+  **NO DATA REPAIR SHIPS.** Re-measured for THIS defect on the same six
+  databases: **zero rows** carry a `name`, `first_name` or `last_name` at or
+  over 40 characters, and the longest `name` in the fleet is 27 (control:
+  5 / 6 / 46 / 15 / 4 / 4 users scanned, `max(length(name))` non-null in every
+  one). Nothing was truncated in production, so there is nothing to repair — and
+  a row whose halves disagree with its `name` because of a `/profile` edit must
+  never be auto-repaired anyway.
+
+- **Onboarding no longer stores a two-word answer as the whole first name.**
+  `Studio::OnboardingController#first_name` writes with `update_columns`, which
+  skips callbacks — so the host's `before_save :set_name_parts` never ran and
+  someone answering "Ada Lovelace" landed `first_name = "Ada Lovelace"`,
+  `last_name` NULL. It never self-healed either: `set_name_parts` is gated on
+  `name_changed?`, and no later save sees a name change. The derivation now
+  comes to the writer instead — a new pure primitive, **`Studio::NameParts.from`**
+  (`lib/studio/name_parts.rb`), carrying the same rule the host callback runs,
+  including the deliberate OMISSION of `last_name` for a one-word name so a
+  surname already on file survives a first-name prompt.
+  **`update_columns` STAYS**, and the fix does not touch it: `Sluggable`'s
+  `before_save :set_slug` is UNGATED and mcritchie-studio's `User#name_slug` is
+  built from `name`, so a full save here would re-point the slug the account
+  answers on — on a uniquely-indexed column, at every signup.
+  `test/integration/onboarding_name_parts_test.rb` carries that as a live
+  control (`update!` moves `pat-pat@example.com` → `ada-lovelace-pat@…`), not as
+  a claim. `last_name` is written only where the column exists: the engine's own
+  standard-columns migration does not carry it, so a host that opts into these
+  routes before it runs that column would otherwise take a
+  `MissingAttributeError` 500 on every two-word answer
+  (`test/integration/onboarding_thin_host_test.rb`). **Corrected 2026-09-06:**
+  an earlier version of this entry named mcritchie-industries, moms-app and
+  acquisition-studio as apps that would have taken that 500. They carry no
+  `last_name`, but they do not mount these endpoints at all —
+  `Studio.draw_onboarding_routes` defaults to false and only mcritchie-studio
+  and turf-monster set it true, and both of those HAVE the column. The guard is
+  a standing one for the next host to opt in, not a live save.
+  NO DATA REPAIR SHIPS: measured 2026-09-05 across both production databases
+  (mcritchie-studio 5 users, turf-monster 43) and both QA ones, **zero rows**
+  carry a space in `first_name`. Repairing rows whose halves merely disagree
+  with `name` would be data loss — `/profile` writes those columns directly —
+  and a fossil repair belongs to the consuming app that owns its `users` table,
+  not to the gem.
+
 - **Knowledge layer hardening** — the five findings from the 0.67.0 reviews:
   upload keys carry a random suffix (same-named uploads in the same second no
   longer overwrite the first object before the unique index can refuse);

data/app/controllers/studio/onboarding_controller.rb

@@ -23,36 +23,72 @@ module Studio
     # Both actions are for the freshly signed-in user, so authentication is the
     # host's default require_authentication — no skip_before_action here.
 
-    # The shared cap (Studio::FIRST_NAME_MAX_LENGTH). Kept under the old name
-    # here because it is referenced from outside this class; what changed is that
-    # it is no longer a SECOND definition of the same number. /profile writes the
-    # same column and now reads the same constant.
+    # The PER-FIELD cap (Studio::FIRST_NAME_MAX_LENGTH) — what one derived half
+    # may be. Kept under the old name here because it is referenced from outside
+    # this class; what changed is that it is no longer a SECOND definition of
+    # the same number. /profile writes the same columns and reads the same
+    # constant.
     MAX_FIRST_NAME = Studio::FIRST_NAME_MAX_LENGTH
 
+    # The WHOLE-ANSWER cap (Studio::FULL_NAME_MAX_LENGTH) — what this endpoint
+    # actually bounds. It is a different question from the one above and now has
+    # a different name: the field asks for a name and people type a full one, so
+    # the string arriving here is first name PLUS surname, and measuring it with
+    # the per-field number stored 40 characters of a 41-character name and
+    # handed the account back a misspelled surname.
+    MAX_FULL_NAME = Studio::FULL_NAME_MAX_LENGTH
+
     # POST /onboarding/first_name
     #
     # Writes users.first_name, and backfills `name` when it is blank so the
     # display-name chain has something better than an email prefix to show.
     def first_name
-      value = params[:first_name].to_s.strip.gsub(/\s+/, " ").first(MAX_FIRST_NAME)
+      value = params[:first_name].to_s.strip.gsub(/\s+/, " ")
 
       if value.blank?
-        return render json: { ok: false, error: "Enter your first name, or skip for now." },
-                      status: :unprocessable_entity
+        return refuse("Enter your first name, or skip for now.")
+      end
+
+      # DERIVE FIRST, THEN GUARD, THEN WRITE. The halves are what the length
+      # rules are about, so they are computed once and both the guard and the
+      # write read the same hash — a guard measuring a second derivation could
+      # pass over values the write then stored.
+      attrs = name_columns(value)
+
+      if (message = length_refusal(value, attrs))
+        return refuse(message)
       end
 
       rescue_and_log(target: current_user) do
-        # update_columns, not update!: this runs seconds after signup, on an
-        # account that may be mid-onboarding, and a validation failure elsewhere
-        # on the record (a grandfathered reserved username, say) must not block a
-        # first name. It also steps around any host before_save that DERIVES
-        # first_name FROM name — turf's set_name_parts does exactly that, and
-        # writing through it would discard the value we were just handed.
-        attrs = { first_name: value }
+        # update_columns, not update!, for THREE reasons — all still true:
+        #
+        #   1. This runs seconds after signup, on an account that may be
+        #      mid-onboarding, and a validation failure elsewhere on the record
+        #      (a grandfathered reserved username, say) must not block a name.
+        #   2. It steps around any host before_save that DERIVES first_name FROM
+        #      name — set_name_parts does exactly that — which would discard the
+        #      value we were just handed.
+        #   3. THE SLUG. Sluggable's `before_save :set_slug` is UNGATED, and
+        #      mcritchie-studio's User#name_slug is built from `name`. A full
+        #      save right after this writes `name` would therefore re-point the
+        #      slug the account answers on — a URL change, on a column carrying
+        #      a unique index, for every signup. That is the constraint this
+        #      endpoint has always been protecting; it is not a shortcut.
+        #
+        # WHAT SKIPPING CALLBACKS USED TO COST. Because set_name_parts never
+        # ran, `first_name` got the WHOLE typed value: someone answering "Ada
+        # Lovelace" landed first_name="Ada Lovelace", last_name NULL — and it
+        # never self-healed, because set_name_parts is gated on `name_changed?`
+        # and no later save sees a name change. So the derivation comes to the
+        # writer instead: Studio::NameParts is the same rule the callback runs.
+        # (`attrs` was derived above, so the guard and this write cannot disagree.)
         attrs[:name] = value if current_user.name.blank?
         current_user.update_columns(attrs)
 
-        render json: { ok: true, first_name: value, next: remaining_steps }
+        # The STORED first name, not the typed string — they differ for exactly
+        # the case above, and a response that disagreed with the row would be
+        # the same bug wearing a different hat.
+        render json: { ok: true, first_name: attrs[:first_name], next: remaining_steps }
       end
     end
 
@@ -68,6 +104,63 @@ module Studio
 
     private
 
+    # The one refusal shape both guards answer with. The modal renders `error`
+    # inline and leaves the field filled, so a refusal here is a correction the
+    # person can act on rather than a dead end.
+    def refuse(message)
+      render json: { ok: false, error: message }, status: :unprocessable_entity
+    end
+
+    # WHY THIS REFUSES INSTEAD OF TRUNCATING, which is the product decision this
+    # endpoint used to make silently and badly.
+    #
+    # `.first(cap)` on a name is not a cap, it is a rewrite: it accepted the
+    # answer, stored something the person never typed, and reported success.
+    # "Bartholomew Fitzwilliam Montgomery-Smythe" came back as
+    # "…Montgomery-Smyth" — plausible enough to miss, which is the worst kind of
+    # wrong for a name. Raising the number alone only moves that cliff one
+    # character further out; a bound that rewrites its input is the defect at
+    # any value. So the bound goes up (MAX_FULL_NAME now fits a real full name)
+    # AND anything past it is refused with a sentence saying so.
+    #
+    # BOTH LENGTHS ARE CHECKED, and they are independent rather than redundant.
+    # The whole answer becomes `name`; each half becomes its own column that
+    # /profile caps separately. A single 60-character word passes the first rule
+    # and would still land a `first_name` /profile silently shortens on the next
+    # save — the very drift the two constants exist to prevent — so the halves
+    # are measured too.
+    #
+    # UNREACHABLE FROM THE MODAL, ON PURPOSE. The partial's input carries the
+    # same MAX_FULL_NAME as its maxlength, so the browser stops a typist first.
+    # This is the server being the real bound, for a direct POST or for a host
+    # that passes a larger `max_length` local.
+    #
+    # Returns the message to refuse with, or nil to proceed.
+    def length_refusal(value, attrs)
+      if value.length > MAX_FULL_NAME
+        return "Please shorten that to #{MAX_FULL_NAME} characters or fewer."
+      end
+
+      if attrs.values.compact.any? { |part| part.length > MAX_FIRST_NAME }
+        return "Please keep each name to #{MAX_FIRST_NAME} characters or fewer."
+      end
+
+      nil
+    end
+
+    # The name halves to write, derived exactly as the host's set_name_parts
+    # would derive them from the same string.
+    #
+    # `last_name` is dropped for a host that has no such column —
+    # mcritchie-industries' users table is eight columns wide and update_columns
+    # on an absent column raises. Same respond_to? guard /profile already
+    # carries for the same reason.
+    def name_columns(value)
+      parts = Studio::NameParts.from(value)
+      parts.delete(:last_name) unless current_user.respond_to?(:last_name)
+      parts
+    end
+
     # What is left AFTER this write. The host's resolver decides; the engine's
     # default is "nothing further", which is the right answer for an app whose
     # only onboarding ask is the name.

data/app/views/studio/modals/onboarding/_first_name.html.erb

@@ -15,7 +15,10 @@
     heading     — (default "What should we call you?")
     subtext     — the one-line why (default speaks about emails)
     placeholder — (default "Alex")
-    max_length  — (default 40; the server stays the real bound)
+    max_length  — (default Studio::FULL_NAME_MAX_LENGTH; the server stays the
+                  real bound, and it REFUSES past that rather than truncating,
+                  so a host raising this makes the endpoint answer 422 rather
+                  than store a name nobody typed)
     progress    — [current, total] to render the segmented pill, or nil for none
     modal_store — Alpine store name (default "modals"; the living style guide
                   mounts its own page-scoped host and passes "dsModals")
@@ -41,7 +44,7 @@
   subtext     = local_assigns.fetch(:subtext,
                   "Just your first name — we use it to address you in emails.")
   placeholder = local_assigns.fetch(:placeholder, "Alex")
-  max_length  = local_assigns.fetch(:max_length, 40)
+  max_length  = local_assigns.fetch(:max_length, Studio::FULL_NAME_MAX_LENGTH)
   progress    = local_assigns.fetch(:progress, nil)
   modal_store = local_assigns.fetch(:modal_store, "modals")
   done_event  = local_assigns.fetch(:done_event, "onboarding-step-done")

data/lib/studio/name_parts.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Studio
+  # The two halves of a person's name, derived from the one string they typed.
+  #
+  # WHY THIS IS A PRIMITIVE AND NOT THREE LINES IN A CONTROLLER. Every Studio
+  # host derives `first_name`/`last_name` from `name` in a `before_save`
+  # (`set_name_parts` — byte-identical in mcritchie-studio and turf-monster), so
+  # any writer that steps around callbacks owes the SAME derivation or the row
+  # lands split differently depending on which door it came through. The engine
+  # has exactly such a writer: Studio::OnboardingController writes with
+  # `update_columns`, and it does so for a reason worth keeping (see there).
+  # Parity is the whole requirement, so the rule lives in one named, tested
+  # place instead of being retyped at each door.
+  #
+  # PURE ON PURPOSE — no record, no columns, no ActiveRecord. That is what lets
+  # the engine's pure-Ruby unit lane exercise it directly, and what lets a host
+  # callback delegate to it later without inheriting anything.
+  #
+  # `last_name` is OMITTED, not nil, for a one-word name. That is parity, not
+  # tidiness: the host callback has always left an existing last name standing
+  # (`self.last_name = parts.last if parts.size > 1`), so a hash that nulled it
+  # would make the callback-free writer disagree with the callback in the
+  # opposite direction — someone with a last name on file would lose it by
+  # answering a first-name prompt. Whether that carry-over is itself the right
+  # rule is a separate question from this one; matching it is this file's job.
+  #
+  # Mirrors mcritchie-studio's `User.name_parts`, which the hub extracted for its
+  # own callback-free writers (seeds and the identity migrations). The engine
+  # cannot call that one — it ships to hosts that do not define it, and
+  # mcritchie-industries has no `first_name` column at all — so it carries its
+  # own copy of a rule both must agree on. test/lib/studio/name_parts_test.rb
+  # pins the parity for every shape of name.
+  module NameParts
+    module_function
+
+    # A hash ready for `update_columns` / `assign_attributes`.
+    #
+    #   Studio::NameParts.from("Ada Lovelace")     # => { first_name: "Ada", last_name: "Lovelace" }
+    #   Studio::NameParts.from("Ada")              # => { first_name: "Ada" }
+    #   Studio::NameParts.from("Ada B. Lovelace")  # => { first_name: "Ada", last_name: "Lovelace" }
+    #   Studio::NameParts.from("")                 # => { first_name: nil }
+    def from(name)
+      words = name.to_s.strip.split(" ")
+      parts = { first_name: words.first }
+      parts[:last_name] = words.last if words.size > 1
+      parts
+    end
+  end
+end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.69.3"
+  VERSION = "0.69.5"
 end

data/lib/studio.rb

@@ -14,6 +14,7 @@ require "studio/profile_image"
 require "studio/oauth_identity"
 require "studio/newsletter"
 require "studio/username_generator"
+require "studio/name_parts"
 require "studio/s3"
 require "studio/image_cache"
 require "studio/link_token"
@@ -406,17 +407,46 @@ module Studio
   # later session may ask again. That is the whole reason this is not a column.
   FIRST_NAME_SKIP_SESSION_KEY = :onboarding_skipped_first_name
 
-  # How long a first name may be. ONE constant because users.first_name is
-  # written from TWO surfaces — the onboarding step (seconds after signup) and
-  # /profile (any time after) — and rendered by a third, the profile form's
-  # maxlength. Two independently-correct caps that disagreed would let onboarding
-  # accept a name /profile then refused to save, a bug with no obvious owner.
+  # How long ONE name field may be — users.first_name, and users.last_name where
+  # a host carries it. PER FIELD, which is the only thing this number has ever
+  # measured: /profile caps each of the two inputs with it, and the profile
+  # form's maxlength renders it. Two independently-correct caps that disagreed
+  # would let one surface accept a name another then refused to save, a bug with
+  # no obvious owner.
   #
   # Keeping it here rather than on either controller also keeps the VIEW off a
   # controller constant: the form needs the number, and a view reaching into
   # Studio::ProfilesController to get it would couple the two for no reason.
   FIRST_NAME_MAX_LENGTH = 40
 
+  # How long a WHOLE typed answer may be — one string holding a full name, which
+  # the onboarding step stores as users.name and SPLITS into the two halves
+  # above (Studio::NameParts).
+  #
+  # A SECOND CONSTANT BECAUSE THIS IS A SECOND QUESTION. Onboarding asked the
+  # per-field number for a whole-answer bound, and the two readings were both
+  # defensible at their own call site: "Bartholomew Fitzwilliam
+  # Montgomery-Smythe" is 41 characters, so it stored 40 and handed the account
+  # back its own surname misspelled — "Montgomery-Smyth". Nothing was wrong in
+  # either controller alone; the number was answering two questions with one
+  # value. Giving the whole-answer bound its own name makes that borrow
+  # unwriteable rather than merely discouraged.
+  #
+  # DERIVED, NOT PICKED. It is the longest answer whose two halves BOTH still
+  # fit the per-field cap — first(40) + a space + last(40) — so onboarding can
+  # never accept a name /profile would later shorten, which is the drift
+  # FIRST_NAME_MAX_LENGTH exists to prevent. Raising the per-field cap moves
+  # this one with it, by construction.
+  #
+  # NOT BOUNDED BY THE COLUMN. Measured 2026-09-06 across all six consumer
+  # databases (mcritchie-studio, turf-monster and mcritchie-industries, prod and
+  # QA): every one of `name`, `first_name` and `last_name` is an unbounded
+  # `character varying` — character_maximum_length NULL, no CHECK constraint, no
+  # model length validation. So this cap is a product decision start to finish,
+  # not a column ceiling, and raising it cannot trade a truncation for a
+  # PG::StringDataRightTruncation.
+  FULL_NAME_MAX_LENGTH = (FIRST_NAME_MAX_LENGTH * 2) + 1
+
   # The shared rule for "does this account still owe us a first name?" — the one
   # piece of onboarding logic every app agrees on. Hosts compose it into their own
   # flow rather than re-deriving it (turf's OnboardingFlow calls straight through).

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.69.3
+  version: 0.69.5
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-03 00:00:00.000000000 Z
+date: 2026-09-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -576,6 +576,7 @@ files:
 - lib/studio/link_token.rb
 - lib/studio/log_rotation.rb
 - lib/studio/mail_transport.rb
+- lib/studio/name_parts.rb
 - lib/studio/newsletter.rb
 - lib/studio/oauth_identity.rb
 - lib/studio/profile_image.rb