studio-engine 0.91.0 → 0.91.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cf7b3c1fa31a2eb5f9746838c8c4976d026920c986504c674f760c57c73a33d
-  data.tar.gz: c39625c99d384e68eedfee1a31dde4816e6f3aa2f004f6ab2f88c4e10d447b00
+  metadata.gz: b177cff9fc53b20d566685aa744f1dc41f481017f3014c9a00ef71a43620365a
+  data.tar.gz: 100753f4d2f9dd2f936c8285a2b3aac844d2538099b066ef15013ca77f407392
 SHA512:
-  metadata.gz: bfeb555efeae9e981014cf5afb73c8e1eb7b01c90d92dc0c1ba6838d5c1acc950ddc908846be93d15d23ac07a9f5acf277c103c3d95b4611e85b758de5c940f0
-  data.tar.gz: 728932ef4510055ab9b8cd3d6f472abe228ee632febfe007251beb242aec114a1e11c77381a63e44167fb7817c79d8d6716d24687e4261b4c660968e23ffef8c
+  metadata.gz: 76433dc917873ff167918968f9ec85d1d6765606e58f3c6502183cab9fca55b3b19a4bc74652f93c74222c3799e4cedbc411a7ce79c6d4d8ff207524982dca20
+  data.tar.gz: 3c69e3e3ed94f63952f9cbf2c2e75446b3d95a7d63c51e5b7331dce801bc5ae5329761b456f6cd968e276d6874daf453dcce551c20b87960c49a604eda81d80e

data/CHANGELOG.md

@@ -4,6 +4,34 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.91.1 — 2026-10-06
+
+### Fixed
+
+- **`POST /login` is drawn only for apps that declare `:password`.** A passwordless
+  app answered it 500 for a member's address and 422 for a stranger's, so the
+  answer revealed who is a member; it now answers 404 for every address. `GET
+  /login` and `login_path` are unchanged. An app that still wants a `POST /login`
+  of its own draws it before `Studio.routes(self)`.
+
+- **SSO sign-up works on passwordless apps.** "Continue as …" (`POST
+  /sso_continue`) created a first-time visitor with `password:
+  SecureRandom.hex(16)`, which raised `UnknownAttributeError` on any User without
+  `has_secure_password`; the engine logged it and bounced to the login page. The
+  engine now sets a random password only when the User answers `password=`.
+- **The survey keeps its h1 for a screen reader on every step.** From question 2
+  on, the stepper set `hidden` on the survey head, which took the page's only
+  h1 out of the accessibility tree. The head now steps into a 1px visual clip
+  instead, holding only the title.
+
+### Changed
+
+- **The survey partials declare strict locals.** `studio/surveys/_question`
+  takes `question:`, `index:`, `total:`, `response:` and an optional `error:`;
+  `_script` and `_styles` take none. A render with an unknown or missing local
+  now raises instead of painting a blank. The survey accent's fallback reads
+  `Studio::ThemeResolver::DEFAULT_PRIMARY` instead of a copied hex.
+
 ## 0.91.0 — 2026-10-06
 
 ### Added

data/README.md

@@ -82,6 +82,11 @@ sign-in-link form when `:magic_link` is enabled, and the Google button only with
 and using the link creates the account. So `registration_params`' `:name` shows a
 Name field only on a password app.
 
+`POST /login`, the password exchange, is drawn only when `auth_methods` includes
+`:password`. A passwordless app answers it with 404 for every address, so it
+cannot tell a member from a stranger. `GET /login` and `login_path` are drawn for
+every app.
+
 ### Local log rotation (automatic — nothing to configure)
 
 The engine caps the host app's **development** log at 16 MB and its **test** log

data/app/controllers/sessions_controller.rb

@@ -55,9 +55,15 @@ class SessionsController < ApplicationController
         email:    session[:sso_email],
         name:     session[:sso_name],
         provider: session[:sso_provider],
-        uid:      session[:sso_uid],
-        password: SecureRandom.hex(16)
+        uid:      session[:sso_uid]
       )
+      # Only a host that takes a password gets one: has_secure_password defines
+      # `password=` and requires a value on create, so those apps need a random
+      # placeholder. A passwordless User has no such writer, and passing
+      # `password:` to User.new raised UnknownAttributeError, which sso_continue
+      # rescued into a redirect: SSO sign-up failed silently on every passwordless
+      # app (/tasks/engine-sso-creates-passwordless-users).
+      user.password = SecureRandom.hex(16) if user.respond_to?(:password=)
       Studio.configure_sso_user.call(user)
       rescue_and_log(target: user) do
         user.save!

data/app/views/studio/surveys/_question.html.erb

@@ -1,3 +1,4 @@
+<%# locals: (question:, index:, total:, response:, error: nil) %>
 <%# One survey question as a fieldset (studio/surveys/show). It is a complete
     form control without JavaScript: native radios, checkboxes and text fields
     named answers[key], with `required` so the no-JS form validates in the

data/app/views/studio/surveys/_script.html.erb

@@ -1,3 +1,4 @@
+<%# locals: () %>
 <%# The survey stepper: progressive enhancement over studio/surveys/show.
     Plain JavaScript (no Alpine dependency), idempotent per root so a Turbo
     render that re-runs it never double-binds. Bound roots are tracked in a
@@ -137,8 +138,10 @@
       back.hidden = first;
       next.hidden = last;
       submit.hidden = !last;
-      // The title and intro lead question 1 only; later screens are the question alone.
-      if (head) head.hidden = !first;
+      // The title and intro lead question 1 only; later screens show the
+      // question alone. The head steps into a visual clip rather than
+      // `hidden`, so the page keeps its h1 for a screen reader on every step.
+      if (head) head.classList.toggle("studio-survey__head--later", !first);
       // The number-key shortcut only means something on a choice or scale.
       var step = steps[index];
       hint.hidden = !(step.dataset.key && (isChoice(step) || isMulti(step)));

data/app/views/studio/surveys/_styles.html.erb

@@ -1,3 +1,4 @@
+<%# locals: () %>
 <%# Survey styles, scoped under .studio-survey. Plain CSS on the theme's CSS
     custom properties (--color-cta, --color-surface, ...) rather than Tailwind
     utilities, so the page looks the same in every host whatever its Tailwind
@@ -6,7 +7,7 @@
 <style>
   /* overflow-x: clip, not hidden: the slide-in must never widen the page, and
      clip makes no scroll container, so the sticky nav still sticks. */
-  .studio-survey { --sv-accent: var(--color-cta, #8E82FE); display: flex; justify-content: center; padding: 1.25rem 1rem 2rem; color: var(--color-text-body); overflow-x: clip; }
+  .studio-survey { --sv-accent: var(--color-cta, <%= Studio::ThemeResolver::DEFAULT_PRIMARY %>); display: flex; justify-content: center; padding: 1.25rem 1rem 2rem; color: var(--color-text-body); overflow-x: clip; }
   .studio-survey [hidden] { display: none !important; }
   .studio-survey__shell { width: 100%; max-width: 36rem; }
   .studio-survey__sr { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; }
@@ -25,6 +26,11 @@
   .studio-survey.is-enhanced .studio-survey__head { margin-bottom: 1.25rem; }
   .studio-survey.is-enhanced .studio-survey__title { margin: 0 0 .375rem; font-size: 1rem; line-height: 1.4; font-weight: 700; color: var(--color-text-secondary); }
   .studio-survey.is-enhanced .studio-survey__head--echo .studio-survey__title { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; }
+  /* After question 1 the head steps aside visually, but its h1 stays the page's
+     heading for a screen reader: the head goes into a 1px clip and only the
+     title remains inside it. */
+  .studio-survey.is-enhanced .studio-survey__head--later { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; }
+  .studio-survey.is-enhanced .studio-survey__head--later > :not(.studio-survey__title) { display: none; }
   .studio-survey.is-enhanced .studio-survey__intro-copy { margin: 0; font-size: .9375rem; line-height: 1.5; color: var(--color-text-secondary); }
   .studio-survey.is-enhanced .studio-survey__meta { display: none; }
   .studio-survey__question { display: block; width: 100%; padding: 0; margin: 0 0 .5rem; font-size: 1.375rem; line-height: 1.3; font-weight: 700; color: var(--color-text); outline: none; }

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.91.0"
+  VERSION = "0.91.1"
 end

data/lib/studio.rb

@@ -146,8 +146,9 @@ module Studio
   # Which sign-in methods this app offers. The shared login/signup views render
   # a button/field per enabled method (gate with Studio.auth_method?). Order is
   # display order. Both McRitchie Studio + Turf Monster are passwordless; legacy
-  # email+password is opt-in via :password (which also re-arms the User#authenticate
-  # contract check — see validate_user_contract!).
+  # email+password is opt-in via :password, which also draws POST /login (see
+  # Studio.routes) and re-arms the User#authenticate contract check (see
+  # validate_user_contract!).
   #
   # :wallet is deliberately NOT in the default. This engine plus McRitchie Studio
   # is the BASE template for every app, web2 and web3 alike; solana-studio plus
@@ -1336,7 +1337,16 @@ module Studio
   def self.routes(router)
     router.instance_exec do
       get  "login",  to: "sessions#new"
-      post "login",  to: "sessions#create"
+
+      # Email + password sign-in, drawn only for an app that declares :password.
+      # SessionsController#create calls user.authenticate, which a passwordless
+      # User does not define: on a passwordless app this POST answered 500 for a
+      # member's address and 422 for a stranger's, which told anyone who asked
+      # who the members are. Undrawn, it answers 404 for every address.
+      # GET /login stays drawn for every app: it is the sign-in page, and
+      # login_path names it.
+      post "login", to: "sessions#create" if Studio.auth_method?(:password)
+
       post "sso_continue", to: "sessions#sso_continue"
       get  "sso_login",    to: "sessions#sso_login"
       get  "logout", to: "sessions#destroy"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.91.0
+  version: 0.91.1
 platform: ruby
 authors:
 - Alex McRitchie