studio-engine 0.76.2 → 0.77.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 67f19e731d05c8bba0ba8a2b7d0aaf9aef71f26705e19014bc5532c6fc5f3917
-  data.tar.gz: 511695ff90c382eab81c9860e882bcff9407c68a08abc9094cf87c605a25b6c3
+  metadata.gz: 0c579a6d057a79eb540fee2347d6000c6c5af80273e61efdbd2e1d8eda173214
+  data.tar.gz: 726c8217e6f23e277af7f3fcc215885d7bfed504ee2a215b574aa5775986ffad
 SHA512:
-  metadata.gz: 358ae5bb8a8f101cf7713218de92d1e6b08b1e2f4acf772b4f110abdf997bc5c1a2979f83beeaa6861af6af84869680b4f9351d512186986e7fb1f6250c2f726
-  data.tar.gz: 33173de4aa44555b127b772b1a10f84405809d10d08cc7b0aa64d8a6286bd5ea1d0816eb97ac7f0270b24fc987abe4670ba65715df6c3473d03e59501e3363d4
+  metadata.gz: 72b688c3d92118f08ea7ba2263db3973fedeec0d16d07d9f45296c9c68fc581e6f5d56f30eb6d3375f0dedff9d1330de6ed992f5080995ddb44aa0ec6b79eae1
+  data.tar.gz: cf4ed66373933628dccd7eeb8e59164da68cfcc25f3407befff234ebd18ce2793a2d60bfb71daae219ec8980f5f7ada6b3b34f092697d4dbcb8894f451acd162

data/CHANGELOG.md

@@ -4,6 +4,70 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.77.0 — 2026-09-26
+
+### Added
+
+- **`Studio::S3` runs on Cloudflare R2, or any S3-compatible endpoint.** Four new
+  settings, all nil by default: `s3_endpoint`, `s3_access_key_id` +
+  `s3_secret_access_key` (passed to the client as a pair, so an app can hold its
+  R2 keys beside the `AWS_*` ones during a cutover; half a pair raises), and
+  `s3_public_url`, the base public objects are served from. Unset, every app gets
+  the same client and the same amazonaws.com URLs as before. On an endpoint with
+  no public base, `url` raises `NotConfigured` instead of building a URL R2 would
+  refuse, and `upload` still writes but returns `nil`. Proven live against an R2
+  bucket: upload, download, exists, list, signed URL (200) and delete, with the
+  anonymous endpoint read refused.
+
+## 0.76.3 — 2026-09-23
+
+### Fixed
+
+- **A board drag that the server refuses now tells you.** The board primitive's
+  drag-reorder POSTed the new order and discarded the answer: `saveOrder` ended in
+  `.catch(function () {})` — an EMPTY handler, on a `fetch` that *resolves* on a
+  4xx and so never reached it. Two layers of silence over one request. The
+  endpoints on the other end had already written the operator a reason (turf-monster's
+  week board answers a drifted card set with *"That order does not match this week's
+  games — reload and try again"*, and `Studio::Board::Reorderable` renders
+  `{ error: … }` beside every 422 it raises) and that sentence was unreachable by
+  construction, while the board's CSS counter renumbered the cards as though the save
+  had landed. A refused save now toasts the server's own words — or `window.alert`s
+  them on a `toasts: false` board — and resolves `false`.
+  - **Fixed at the seam, so all five boards get it.** The check lives in the
+    factory's `request()`, which now REJECTS on a refusal rather than handing back a
+    resolved 4xx. That is the semantics both callers already assumed by writing
+    `.catch(…)`, and it is what neither underlying fetcher provides. Every board
+    riding this factory is covered by the one change: turf-monster's NFL week order,
+    and mcritchie-studio's tasks (the DevOps board itself), depth charts, content and
+    news. No consumer change is needed beyond the gem bump.
+  - **An expired session is no longer a silently lost drag either.** A host that
+    defines `window.authedFetch` (turf-monster does) gets `null` back from it on a
+    401 or a rate-limited 429. `saveOrder` never checked for that, and `applyMove`
+    would have thrown a `TypeError` off `resp.ok`. `request()` now names it:
+    *"Session expired — please sign in again."*
+  - **A refused reorder is not auto-reverted, deliberately.** Unlike a single-card
+    move there is no one card to snap back: the whole column re-ranked, and SortableJS
+    hands the drop over with the pre-drop order already gone. Every reorder endpoint's
+    refusal tells the operator to reload, which restores the stored order exactly; the
+    board's job is to make sure that instruction is read. `optimistic:` governs moves
+    only, and `studio/board/_board` now says so.
+  - **`saveOrder` returns a promise** (resolving `true`/`false`, never rejecting), so
+    a caller can wait for a save to land instead of assuming it did.
+
+### Changed
+
+- **The board factory is now executed under test, not grepped.**
+  `test/views/board_factory_save_behavior_test.rb` extracts
+  `studio/_board_assets`'s `<script>` and runs it under node with stub
+  `window`/`document`/`fetch`, asserting `saveOrder`, `applyMove` and `request` by
+  CALLING them — nine scenarios covering the refusal text, the `null` session, an
+  unparseable error body, the silent success, the `toasts: false` fallback, the
+  unchanged event/hook seam and both move outcomes. The bug above survived every
+  source-substring assertion in `board_primitive_test.rb`, because the broken build
+  contained the word `catch` too; that section now says where behavioral coverage
+  belongs.
+
 ## 0.76.2 — 2026-09-22
 
 ## 0.76.1 — 2026-09-19

data/README.md

@@ -838,6 +838,24 @@ config.s3_key_prefix    = "mcritchie-industries/"
 logical keys and never see it. Unset (the default) leaves keys byte-identical to
 what every already-shipped app wrote.
 
+### S3-compatible storage (Cloudflare R2)
+
+`Studio::S3` talks to any S3-compatible endpoint. The McRitchie fleet is moving
+to R2 (one account, McRitchie Studio's); an app switches in its initializer:
+
+```ruby
+config.s3_endpoint          = ENV["R2_ENDPOINT"]   # https://<account>.r2.cloudflarestorage.com
+config.s3_region            = "auto"
+config.s3_access_key_id     = ENV["R2_ACCESS_KEY_ID"]
+config.s3_secret_access_key = ENV["R2_SECRET_ACCESS_KEY"]
+config.s3_public_url        = ENV["R2_PUBLIC_URL"] # custom domain on this env's bucket
+```
+
+All four are nil by default, and nil is AWS exactly as before. The keys must be
+set as a pair. R2 serves nothing anonymously from its S3 endpoint, so with an
+endpoint and no `s3_public_url`, `Studio::S3.url` raises `NotConfigured` and
+`upload` writes but returns `nil`; serve private objects with `signed_url`.
+
 An app with **no** bucket configured does not error — `/admin/emails` renders
 read-only, showing the inherited defaults it is genuinely sending and naming the
 one setting that turns uploads on.

data/app/views/studio/_board_assets.html.erb

@@ -187,12 +187,11 @@
           body[this.moveParam.resource] = {};
           body[this.moveParam.resource][this.moveParam.attr] = newZone;
 
-          return this.request(url, "PATCH", body).then(function (resp) {
-            if (!resp.ok) {
-              return resp.json().catch(function () { return {}; }).then(function (err) {
-                throw new Error(err.error || ("Failed (" + resp.status + ")"));
-              });
-            }
+          // request() rejects on a refusal (and reads the server's message), so this
+          // `then` runs only on a real success and the `catch` below is the ONE
+          // failure path. It used to unwrap the 4xx itself; that check now lives at
+          // the seam, where saveOrder gets it too.
+          return this.request(url, "PATCH", body).then(function () {
             self.setCardZone(card, newZone);
             self.toast("Moved to " + self.label(newZone), "success");
             self.emit("board-moved", id, fromKey, newZone);
@@ -208,6 +207,23 @@
 
         // Save the destination column's order. Reads the ordered id list and POSTs
         // it under the neutral payload key (`slugs` | `ids`) plus the advisory zone.
+        //
+        // A REFUSAL IS SHOWN, NOT SWALLOWED. Through 0.76.2 this was a bare
+        // `.catch(){}` on a `fetch` that resolves on 4xx: two layers of silence over
+        // a server that had already written the operator its reason ("That order does
+        // not match this week's games — reload and try again"). The board renumbered
+        // the cards as though the save had landed. request() now rejects on a refusal
+        // and the catch below toasts what the server said.
+        //
+        // NO AUTO-REVERT, deliberately. Unlike a single-card move there is no one
+        // card to snap back — the whole column re-ranked, and SortableJS hands us the
+        // drop with the pre-drop order already gone. Every reorder endpoint's refusal
+        // tells the operator to RELOAD, which restores the stored truth exactly; the
+        // board's job is to make sure that instruction is read.
+        //
+        // RETURNS A PROMISE (resolving true/false, never rejecting) so a caller can
+        // wait for the save to land. It resolves rather than rejects so the
+        // fire-and-forget call in handleSortEnd cannot raise an unhandled rejection.
         saveOrder: function (toZone) {
           var self = this;
           var ids = Array.prototype.slice
@@ -216,12 +232,15 @@
           var zone = this.zoneKey(toZone);
           this.emit("board-reordered", null, zone, zone, { ids: ids, zone: zone });
           this.hook(this.onDropHook, { ids: ids, zone: zone });
-          if (this.demo || !this.reorderUrl) return;
+          if (this.demo || !this.reorderUrl) return Promise.resolve(true);
           var payload = {};
           payload[this.reorderPayload] = ids;
           payload.zone = zone;
-          this.request(this.reorderUrl, "POST", payload).catch(function () {
-            // Order save failed — positions are stale but the board stays functional.
+          return this.request(this.reorderUrl, "POST", payload).then(function () {
+            return true;
+          }).catch(function (e) {
+            self.toast((e && e.message) || "Order save failed — reload and try again.", "error");
+            return false;
           });
         },
 
@@ -377,6 +396,22 @@
         },
 
         // --- helpers -------------------------------------------------------
+        // The board's ONE HTTP seam, and it REJECTS ON A SERVER REFUSAL. That is
+        // the semantics every caller in this factory already assumed by writing
+        // `.catch(…)`, and it is the semantics NEITHER underlying fetcher has:
+        //
+        //   * `window.fetch` RESOLVES on 4xx/5xx. A 422 is an ordinary resolution,
+        //     so a bare `.catch()` sees network-level failure and nothing else.
+        //     That is how saveOrder discarded an operator-readable 422 in silence
+        //     on all five boards that ride this factory.
+        //   * `window.authedFetch` (the turf-monster fetcher this picks up when the
+        //     host defines it) returns the response for anything that is not a 401
+        //     — so a 422 resolves there too — and resolves to NULL on an expired
+        //     session or a rate-limited tier, which `resp.ok` cannot be read from.
+        //
+        // Normalising both HERE is the point: a caller can no longer re-introduce
+        // the silence by forgetting a check. To ignore a refusal it must now say so
+        // out loud, in its own `.catch`.
         request: function (url, method, body) {
           var csrf = (document.querySelector('meta[name="csrf-token"]') || {}).content || "";
           var fetcher = window.authedFetch || window.fetch;
@@ -384,6 +419,18 @@
             method: method,
             headers: { "Content-Type": "application/json", "X-CSRF-Token": csrf, "Accept": "application/json" },
             body: JSON.stringify(body || {})
+          }).then(function (resp) {
+            // authedFetch's null — the session went away under the board. Name it,
+            // rather than throwing a TypeError off resp.ok on the next line.
+            if (!resp) throw new Error("Session expired — please sign in again.");
+            if (resp.ok) return resp;
+            // Prefer the SERVER'S OWN words. Every board endpoint this factory talks
+            // to renders `{ error: "…" }` beside its 4xx — Studio::Board::Reorderable
+            // here in the engine, and the hand-rolled siblings in the apps — and that
+            // text is written to be read by an operator.
+            return resp.json().catch(function () { return {}; }).then(function (err) {
+              throw new Error(err.error || ("Failed (" + resp.status + ")"));
+            });
           });
         },
 

data/app/views/studio/board/_board.html.erb

@@ -59,7 +59,13 @@
     card_partial:     (req) partial rendered per card (e.g. "tasks/task_card").
     card_as:          local the record binds to in card_partial. Default :card.
     card_locals:      per-card extra locals — a Proc ->(record){ Hash } or a Hash.
-    reorder_url:      POST endpoint the drag-reorder saves the new order to.
+    reorder_url:      POST endpoint the drag-reorder saves the new order to. It is
+                      expected to answer a refusal with a 4xx carrying
+                      { error: "…" } (Studio::Board::Reorderable already does);
+                      the factory TOASTS that sentence. A refused reorder is NOT
+                      reverted — the whole column moved and the pre-drop order is
+                      gone by then — so write that message as the instruction the
+                      operator should follow, e.g. "… reload and try again".
     reorder_payload:  :slugs | :ids — the key the ordered id list POSTs under.
                       Default :slugs.
     move_url:         PATCH template for a cross-column move, ":id" → the card's id
@@ -78,8 +84,10 @@
     empty_selector:   the empty-state selector (revert anchor + count toggle).
                       Default ".kanban-empty"; nil for a board with no empty state.
     live_channel:     Turbo Stream channel for live updates (nil = static board).
-    optimistic:       revert + red-ring flash a failed move. Default true.
+    optimistic:       revert + red-ring flash a failed MOVE. Default true. It does
+                      not govern reorders, which never revert (see reorder_url).
     toasts:           show the toast host (false = window.alert on error). Default true.
+                      Either way a refused move or save reaches the operator.
     empty_label:      empty-zone text. Default "Drop here".
     header_slot:      raw HTML rendered above the columns (pass html_safe content).
     above_board_slot: raw HTML rendered between the header and the columns.

data/lib/studio/s3.rb

@@ -15,17 +15,34 @@ module Studio
         opts[:content_type] = content_type if content_type
         opts[:cache_control] = cache_control if cache_control
         client.put_object(**opts)
-        url(key: key)
+        public_url? ? url(key: key) : nil
       end
 
       def download(key:)
         client.get_object(bucket: bucket, key: full_key(key)).body.read
       end
 
+      # The PUBLIC URL of an object. On AWS (no endpoint) it is the bucket's
+      # virtual-hosted amazonaws.com URL, byte-identical to every version before
+      # endpoints existed. On an S3-compatible endpoint it is Studio.s3_public_url
+      # plus the key, and without that base it RAISES: R2's S3 endpoint answers no
+      # anonymous request, so any URL built from it would be a broken image in an
+      # inbox, not an error anyone sees. Private objects want signed_url.
       def url(key:)
+        base = Studio.s3_public_url.to_s
+        return "#{base.chomp("/")}/#{full_key(key)}" unless base.empty?
+        raise NotConfigured, "Studio.s3_public_url not set: #{endpoint} serves no public URL (use signed_url for private objects)" if endpoint
+
         "https://#{bucket}.s3.#{region}.amazonaws.com/#{full_key(key)}"
       end
 
+      # Whether url can answer. upload asks this so an app with only private
+      # objects (a data room on R2 with no public domain) can still write:
+      # upload returns nil there instead of raising AFTER the object landed.
+      def public_url?
+        endpoint.nil? || !Studio.s3_public_url.to_s.empty?
+      end
+
       def signed_url(key:, expires_in: 3600)
         require "aws-sdk-s3"
         Aws::S3::Presigner.new(client: client).presigned_url(:get_object, bucket: bucket, key: full_key(key), expires_in: expires_in)
@@ -93,11 +110,39 @@ module Studio
         Studio.s3_region
       end
 
+      # The S3-compatible endpoint (R2: https://<account>.r2.cloudflarestorage.com),
+      # or nil for AWS. Blank reads as unset, so an empty ENV var cannot point the
+      # client at "".
+      def endpoint
+        value = Studio.s3_endpoint.to_s
+        value.empty? ? nil : value
+      end
+
       def client
         @client ||= begin
           require "aws-sdk-s3"
-          Aws::S3::Client.new(region: region)
+          Aws::S3::Client.new(**client_options)
+        end
+      end
+
+      # Only what is configured is passed, so an unconfigured app builds exactly
+      # the client it always did: region alone, the SDK's default credential chain.
+      # Keys are passed as a PAIR or not at all; half a pair is a configuration
+      # error, and falling back to the default chain would silently write with
+      # whatever AWS_* key the dyno happens to hold.
+      def client_options
+        opts = { region: region }
+        opts[:endpoint] = endpoint if endpoint
+        id = Studio.s3_access_key_id.to_s
+        secret = Studio.s3_secret_access_key.to_s
+        if id.empty? != secret.empty?
+          raise NotConfigured, "Studio.s3_access_key_id and s3_secret_access_key must be set together"
+        end
+        unless id.empty?
+          opts[:access_key_id] = id
+          opts[:secret_access_key] = secret
         end
+        opts
       end
 
       def reset!

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.76.2"
+  VERSION = "0.77.0"
 end

data/lib/studio.rb

@@ -616,6 +616,30 @@ module Studio
   # A trailing slash is added if you leave it off.
   mattr_accessor :s3_key_prefix, default: nil
 
+  # S3-COMPATIBLE STORAGE (Cloudflare R2). All four default nil, and nil means
+  # AWS exactly as before: the SDK's own endpoint, its default credential chain
+  # (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY), and the virtual-hosted
+  # amazonaws.com URL. An app moves to R2 by setting them, typically from ENV:
+  #
+  #   config.s3_endpoint          = ENV["R2_ENDPOINT"]   # https://<account>.r2.cloudflarestorage.com
+  #   config.s3_region            = "auto"               # R2's only region
+  #   config.s3_access_key_id     = ENV["R2_ACCESS_KEY_ID"]
+  #   config.s3_secret_access_key = ENV["R2_SECRET_ACCESS_KEY"]
+  #   config.s3_public_url        = ENV["R2_PUBLIC_URL"] # https://assets.example.com
+  #
+  # Explicit keys exist so an app can hold its R2 pair BESIDE its AWS pair
+  # during a cutover (Active Storage may still mirror to S3) without the two
+  # fighting over the same AWS_* variables.
+  #
+  # s3_public_url is the base public objects are served from — a custom domain
+  # or r2.dev URL attached to THIS environment's bucket. R2's S3 endpoint
+  # serves nothing anonymously, so with an endpoint and no public base there is
+  # no public URL to give, and Studio::S3.url says so rather than inventing one.
+  mattr_accessor :s3_endpoint,          default: nil
+  mattr_accessor :s3_access_key_id,     default: nil
+  mattr_accessor :s3_secret_access_key, default: nil
+  mattr_accessor :s3_public_url,        default: nil
+
   # Knowledge layer — the S3-backed document store + /admin/knowledge browser
   # (Studio::KnowledgeDoc). Routes are opt-in like every route surface.
   # knowledge_agents is the roster of agent slugs the intake UI offers

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.76.2
+  version: 0.77.0
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-22 00:00:00.000000000 Z
+date: 2026-09-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails