studio-engine 0.76.2 → 0.76.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 67f19e731d05c8bba0ba8a2b7d0aaf9aef71f26705e19014bc5532c6fc5f3917
-  data.tar.gz: 511695ff90c382eab81c9860e882bcff9407c68a08abc9094cf87c605a25b6c3
+  metadata.gz: 2c352381b0778909cd1798ba2d81abf435f1c2e668198ac38fdae33310d65d8c
+  data.tar.gz: 6a80ed76a9748b246df94016572aa1b1b470360c8938390acaef92342a4d1350
 SHA512:
-  metadata.gz: 358ae5bb8a8f101cf7713218de92d1e6b08b1e2f4acf772b4f110abdf997bc5c1a2979f83beeaa6861af6af84869680b4f9351d512186986e7fb1f6250c2f726
-  data.tar.gz: 33173de4aa44555b127b772b1a10f84405809d10d08cc7b0aa64d8a6286bd5ea1d0816eb97ac7f0270b24fc987abe4670ba65715df6c3473d03e59501e3363d4
+  metadata.gz: b57498e85f26bfe1ba051381c0411f0f5161513726ed9fbd6aa4769e0bd3767ec962d0f007ac09ad2326e9a97fb05d73e17e122ef5b779f6cc8e48dd923c3c24
+  data.tar.gz: 0a17dcfaa72bd771c57cacb04ee9f2f3b82baf5839bc9b739216bc1d6fc1e96b456bc68b645b0865bca9569d64b1abd5327a4e779ff74c6af4cf740776f8f14e

data/CHANGELOG.md

@@ -4,6 +4,55 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.76.3 — 2026-09-23
+
+### Fixed
+
+- **A board drag that the server refuses now tells you.** The board primitive's
+  drag-reorder POSTed the new order and discarded the answer: `saveOrder` ended in
+  `.catch(function () {})` — an EMPTY handler, on a `fetch` that *resolves* on a
+  4xx and so never reached it. Two layers of silence over one request. The
+  endpoints on the other end had already written the operator a reason (turf-monster's
+  week board answers a drifted card set with *"That order does not match this week's
+  games — reload and try again"*, and `Studio::Board::Reorderable` renders
+  `{ error: … }` beside every 422 it raises) and that sentence was unreachable by
+  construction, while the board's CSS counter renumbered the cards as though the save
+  had landed. A refused save now toasts the server's own words — or `window.alert`s
+  them on a `toasts: false` board — and resolves `false`.
+  - **Fixed at the seam, so all five boards get it.** The check lives in the
+    factory's `request()`, which now REJECTS on a refusal rather than handing back a
+    resolved 4xx. That is the semantics both callers already assumed by writing
+    `.catch(…)`, and it is what neither underlying fetcher provides. Every board
+    riding this factory is covered by the one change: turf-monster's NFL week order,
+    and mcritchie-studio's tasks (the DevOps board itself), depth charts, content and
+    news. No consumer change is needed beyond the gem bump.
+  - **An expired session is no longer a silently lost drag either.** A host that
+    defines `window.authedFetch` (turf-monster does) gets `null` back from it on a
+    401 or a rate-limited 429. `saveOrder` never checked for that, and `applyMove`
+    would have thrown a `TypeError` off `resp.ok`. `request()` now names it:
+    *"Session expired — please sign in again."*
+  - **A refused reorder is not auto-reverted, deliberately.** Unlike a single-card
+    move there is no one card to snap back: the whole column re-ranked, and SortableJS
+    hands the drop over with the pre-drop order already gone. Every reorder endpoint's
+    refusal tells the operator to reload, which restores the stored order exactly; the
+    board's job is to make sure that instruction is read. `optimistic:` governs moves
+    only, and `studio/board/_board` now says so.
+  - **`saveOrder` returns a promise** (resolving `true`/`false`, never rejecting), so
+    a caller can wait for a save to land instead of assuming it did.
+
+### Changed
+
+- **The board factory is now executed under test, not grepped.**
+  `test/views/board_factory_save_behavior_test.rb` extracts
+  `studio/_board_assets`'s `<script>` and runs it under node with stub
+  `window`/`document`/`fetch`, asserting `saveOrder`, `applyMove` and `request` by
+  CALLING them — nine scenarios covering the refusal text, the `null` session, an
+  unparseable error body, the silent success, the `toasts: false` fallback, the
+  unchanged event/hook seam and both move outcomes. The bug above survived every
+  source-substring assertion in `board_primitive_test.rb`, because the broken build
+  contained the word `catch` too; that section now says where behavioral coverage
+  belongs.
+
 ## 0.76.2 — 2026-09-22
 
 ## 0.76.1 — 2026-09-19

data/app/views/studio/_board_assets.html.erb

@@ -187,12 +187,11 @@
           body[this.moveParam.resource] = {};
           body[this.moveParam.resource][this.moveParam.attr] = newZone;
 
-          return this.request(url, "PATCH", body).then(function (resp) {
-            if (!resp.ok) {
-              return resp.json().catch(function () { return {}; }).then(function (err) {
-                throw new Error(err.error || ("Failed (" + resp.status + ")"));
-              });
-            }
+          // request() rejects on a refusal (and reads the server's message), so this
+          // `then` runs only on a real success and the `catch` below is the ONE
+          // failure path. It used to unwrap the 4xx itself; that check now lives at
+          // the seam, where saveOrder gets it too.
+          return this.request(url, "PATCH", body).then(function () {
             self.setCardZone(card, newZone);
             self.toast("Moved to " + self.label(newZone), "success");
             self.emit("board-moved", id, fromKey, newZone);
@@ -208,6 +207,23 @@
 
         // Save the destination column's order. Reads the ordered id list and POSTs
         // it under the neutral payload key (`slugs` | `ids`) plus the advisory zone.
+        //
+        // A REFUSAL IS SHOWN, NOT SWALLOWED. Through 0.76.2 this was a bare
+        // `.catch(){}` on a `fetch` that resolves on 4xx: two layers of silence over
+        // a server that had already written the operator its reason ("That order does
+        // not match this week's games — reload and try again"). The board renumbered
+        // the cards as though the save had landed. request() now rejects on a refusal
+        // and the catch below toasts what the server said.
+        //
+        // NO AUTO-REVERT, deliberately. Unlike a single-card move there is no one
+        // card to snap back — the whole column re-ranked, and SortableJS hands us the
+        // drop with the pre-drop order already gone. Every reorder endpoint's refusal
+        // tells the operator to RELOAD, which restores the stored truth exactly; the
+        // board's job is to make sure that instruction is read.
+        //
+        // RETURNS A PROMISE (resolving true/false, never rejecting) so a caller can
+        // wait for the save to land. It resolves rather than rejects so the
+        // fire-and-forget call in handleSortEnd cannot raise an unhandled rejection.
         saveOrder: function (toZone) {
           var self = this;
           var ids = Array.prototype.slice
@@ -216,12 +232,15 @@
           var zone = this.zoneKey(toZone);
           this.emit("board-reordered", null, zone, zone, { ids: ids, zone: zone });
           this.hook(this.onDropHook, { ids: ids, zone: zone });
-          if (this.demo || !this.reorderUrl) return;
+          if (this.demo || !this.reorderUrl) return Promise.resolve(true);
           var payload = {};
           payload[this.reorderPayload] = ids;
           payload.zone = zone;
-          this.request(this.reorderUrl, "POST", payload).catch(function () {
-            // Order save failed — positions are stale but the board stays functional.
+          return this.request(this.reorderUrl, "POST", payload).then(function () {
+            return true;
+          }).catch(function (e) {
+            self.toast((e && e.message) || "Order save failed — reload and try again.", "error");
+            return false;
           });
         },
 
@@ -377,6 +396,22 @@
         },
 
         // --- helpers -------------------------------------------------------
+        // The board's ONE HTTP seam, and it REJECTS ON A SERVER REFUSAL. That is
+        // the semantics every caller in this factory already assumed by writing
+        // `.catch(…)`, and it is the semantics NEITHER underlying fetcher has:
+        //
+        //   * `window.fetch` RESOLVES on 4xx/5xx. A 422 is an ordinary resolution,
+        //     so a bare `.catch()` sees network-level failure and nothing else.
+        //     That is how saveOrder discarded an operator-readable 422 in silence
+        //     on all five boards that ride this factory.
+        //   * `window.authedFetch` (the turf-monster fetcher this picks up when the
+        //     host defines it) returns the response for anything that is not a 401
+        //     — so a 422 resolves there too — and resolves to NULL on an expired
+        //     session or a rate-limited tier, which `resp.ok` cannot be read from.
+        //
+        // Normalising both HERE is the point: a caller can no longer re-introduce
+        // the silence by forgetting a check. To ignore a refusal it must now say so
+        // out loud, in its own `.catch`.
         request: function (url, method, body) {
           var csrf = (document.querySelector('meta[name="csrf-token"]') || {}).content || "";
           var fetcher = window.authedFetch || window.fetch;
@@ -384,6 +419,18 @@
             method: method,
             headers: { "Content-Type": "application/json", "X-CSRF-Token": csrf, "Accept": "application/json" },
             body: JSON.stringify(body || {})
+          }).then(function (resp) {
+            // authedFetch's null — the session went away under the board. Name it,
+            // rather than throwing a TypeError off resp.ok on the next line.
+            if (!resp) throw new Error("Session expired — please sign in again.");
+            if (resp.ok) return resp;
+            // Prefer the SERVER'S OWN words. Every board endpoint this factory talks
+            // to renders `{ error: "…" }` beside its 4xx — Studio::Board::Reorderable
+            // here in the engine, and the hand-rolled siblings in the apps — and that
+            // text is written to be read by an operator.
+            return resp.json().catch(function () { return {}; }).then(function (err) {
+              throw new Error(err.error || ("Failed (" + resp.status + ")"));
+            });
           });
         },
 

data/app/views/studio/board/_board.html.erb

@@ -59,7 +59,13 @@
     card_partial:     (req) partial rendered per card (e.g. "tasks/task_card").
     card_as:          local the record binds to in card_partial. Default :card.
     card_locals:      per-card extra locals — a Proc ->(record){ Hash } or a Hash.
-    reorder_url:      POST endpoint the drag-reorder saves the new order to.
+    reorder_url:      POST endpoint the drag-reorder saves the new order to. It is
+                      expected to answer a refusal with a 4xx carrying
+                      { error: "…" } (Studio::Board::Reorderable already does);
+                      the factory TOASTS that sentence. A refused reorder is NOT
+                      reverted — the whole column moved and the pre-drop order is
+                      gone by then — so write that message as the instruction the
+                      operator should follow, e.g. "… reload and try again".
     reorder_payload:  :slugs | :ids — the key the ordered id list POSTs under.
                       Default :slugs.
     move_url:         PATCH template for a cross-column move, ":id" → the card's id
@@ -78,8 +84,10 @@
     empty_selector:   the empty-state selector (revert anchor + count toggle).
                       Default ".kanban-empty"; nil for a board with no empty state.
     live_channel:     Turbo Stream channel for live updates (nil = static board).
-    optimistic:       revert + red-ring flash a failed move. Default true.
+    optimistic:       revert + red-ring flash a failed MOVE. Default true. It does
+                      not govern reorders, which never revert (see reorder_url).
     toasts:           show the toast host (false = window.alert on error). Default true.
+                      Either way a refused move or save reaches the operator.
     empty_label:      empty-zone text. Default "Drop here".
     header_slot:      raw HTML rendered above the columns (pass html_safe content).
     above_board_slot: raw HTML rendered between the header and the columns.

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.76.2"
+  VERSION = "0.76.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.76.2
+  version: 0.76.3
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-22 00:00:00.000000000 Z
+date: 2026-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails