studio-engine 0.91.0 → 0.91.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cf7b3c1fa31a2eb5f9746838c8c4976d026920c986504c674f760c57c73a33d
-  data.tar.gz: c39625c99d384e68eedfee1a31dde4816e6f3aa2f004f6ab2f88c4e10d447b00
+  metadata.gz: 270fe9f569b46f626593afa13ce7cf925f23e783541f76e06d6a465d06837278
+  data.tar.gz: 40f8eefcec2e4eee79baa652da57aca97a6b49b794fab4fb3ca166dd3f27333d
 SHA512:
-  metadata.gz: bfeb555efeae9e981014cf5afb73c8e1eb7b01c90d92dc0c1ba6838d5c1acc950ddc908846be93d15d23ac07a9f5acf277c103c3d95b4611e85b758de5c940f0
-  data.tar.gz: 728932ef4510055ab9b8cd3d6f472abe228ee632febfe007251beb242aec114a1e11c77381a63e44167fb7817c79d8d6716d24687e4261b4c660968e23ffef8c
+  metadata.gz: ae76749cc7fd004b7a93b2108d0af84e21645b1801f50be212d0d5346d503f8d3355fea7c3350ab74a059edbcfc4d60163b245ae34c7f4c68a249e1115b5588f
+  data.tar.gz: 683b4be2cb7b68b01c167db0e3973aefe9b0dd133b8ddb200f5d76f387d19dc1bff6378204fc0e34c4716e1b08bd9e0d08b4f572e40d3b2c15d007e97a6ba48e

data/CHANGELOG.md

@@ -4,6 +4,50 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.91.2 — 2026-10-06
+
+### Security
+
+- **A return path beginning `/\` no longer redirects off-site.** Browsers read
+  `/\evil.com` as `//evil.com`, and the engine's path sanitizers checked only for
+  one leading `/` and not two, so a magic link minted with `return_to=/\evil.com`
+  sent the visitor to another host after sign-in (or, under Rails'
+  `raise_on_open_redirects`, answered 500). One predicate, `Studio::LocalPath.local?`,
+  now holds the rule (one leading `/`, no backslash, no control character) and
+  every engine site uses it: `Studio::LinkToken.sanitize_path`, the link-consume
+  redirect, `Studio::Booking.local_path?`, and the link-preview fallback image.
+  Each site keeps its fallback: a refused return path lands on the default page.
+  Consumers that sanitize a return path themselves should call
+  `Studio::LocalPath.local?` instead of a bare `start_with?("/")` check.
+
+## 0.91.1 — 2026-10-06
+
+### Fixed
+
+- **`POST /login` is drawn only for apps that declare `:password`.** A passwordless
+  app answered it 500 for a member's address and 422 for a stranger's, so the
+  answer revealed who is a member; it now answers 404 for every address. `GET
+  /login` and `login_path` are unchanged. An app that still wants a `POST /login`
+  of its own draws it before `Studio.routes(self)`.
+
+- **SSO sign-up works on passwordless apps.** "Continue as …" (`POST
+  /sso_continue`) created a first-time visitor with `password:
+  SecureRandom.hex(16)`, which raised `UnknownAttributeError` on any User without
+  `has_secure_password`; the engine logged it and bounced to the login page. The
+  engine now sets a random password only when the User answers `password=`.
+- **The survey keeps its h1 for a screen reader on every step.** From question 2
+  on, the stepper set `hidden` on the survey head, which took the page's only
+  h1 out of the accessibility tree. The head now steps into a 1px visual clip
+  instead, holding only the title.
+
+### Changed
+
+- **The survey partials declare strict locals.** `studio/surveys/_question`
+  takes `question:`, `index:`, `total:`, `response:` and an optional `error:`;
+  `_script` and `_styles` take none. A render with an unknown or missing local
+  now raises instead of painting a blank. The survey accent's fallback reads
+  `Studio::ThemeResolver::DEFAULT_PRIMARY` instead of a copied hex.
+
 ## 0.91.0 — 2026-10-06
 
 ### Added

data/README.md

@@ -82,6 +82,11 @@ sign-in-link form when `:magic_link` is enabled, and the Google button only with
 and using the link creates the account. So `registration_params`' `:name` shows a
 Name field only on a password app.
 
+`POST /login`, the password exchange, is drawn only when `auth_methods` includes
+`:password`. A passwordless app answers it with 404 for every address, so it
+cannot tell a member from a stranger. `GET /login` and `login_path` are drawn for
+every app.
+
 ### Local log rotation (automatic — nothing to configure)
 
 The engine caps the host app's **development** log at 16 MB and its **test** log

data/app/controllers/concerns/studio/link_consumption.rb

@@ -163,10 +163,10 @@ module Studio
       user.update!(email_verified_at: Time.current)
     end
 
-    # Only same-origin absolute paths survive; everything else collapses to nil.
+    # Only local paths survive (Studio::LocalPath); everything else collapses to nil.
     def safe_path(path)
       p = path.to_s
-      p.start_with?("/") && !p.start_with?("//") ? p : nil
+      Studio::LocalPath.local?(p) ? p : nil
     end
   end
 end

data/app/controllers/sessions_controller.rb

@@ -55,9 +55,15 @@ class SessionsController < ApplicationController
         email:    session[:sso_email],
         name:     session[:sso_name],
         provider: session[:sso_provider],
-        uid:      session[:sso_uid],
-        password: SecureRandom.hex(16)
+        uid:      session[:sso_uid]
       )
+      # Only a host that takes a password gets one: has_secure_password defines
+      # `password=` and requires a value on create, so those apps need a random
+      # placeholder. A passwordless User has no such writer, and passing
+      # `password:` to User.new raised UnknownAttributeError, which sso_continue
+      # rescued into a redirect: SSO sign-up failed silently on every passwordless
+      # app (/tasks/engine-sso-creates-passwordless-users).
+      user.password = SecureRandom.hex(16) if user.respond_to?(:password=)
       Studio.configure_sso_user.call(user)
       rescue_and_log(target: user) do
         user.save!

data/app/models/studio/site_identity.rb

@@ -183,7 +183,7 @@ module Studio
       def static_image
         path = Studio.link_preview_fallback_image.to_s
         return nil if path.empty?
-        return path unless path.start_with?("/") && !path.start_with?("//")
+        return path unless Studio::LocalPath.local?(path)
 
         @static_files ||= Concurrent::Map.new
         present = @static_files.compute_if_absent(path) do
@@ -203,7 +203,7 @@ module Studio
       # per path like static_image.
       def static_image_dimensions
         path = static_image
-        return nil if path.nil? || !path.start_with?("/") || path.start_with?("//")
+        return nil unless Studio::LocalPath.local?(path)
 
         @static_dimensions ||= Concurrent::Map.new
         dims = @static_dimensions.compute_if_absent(path) do

data/app/views/studio/surveys/_question.html.erb

@@ -1,3 +1,4 @@
+<%# locals: (question:, index:, total:, response:, error: nil) %>
 <%# One survey question as a fieldset (studio/surveys/show). It is a complete
     form control without JavaScript: native radios, checkboxes and text fields
     named answers[key], with `required` so the no-JS form validates in the

data/app/views/studio/surveys/_script.html.erb

@@ -1,3 +1,4 @@
+<%# locals: () %>
 <%# The survey stepper: progressive enhancement over studio/surveys/show.
     Plain JavaScript (no Alpine dependency), idempotent per root so a Turbo
     render that re-runs it never double-binds. Bound roots are tracked in a
@@ -137,8 +138,10 @@
       back.hidden = first;
       next.hidden = last;
       submit.hidden = !last;
-      // The title and intro lead question 1 only; later screens are the question alone.
-      if (head) head.hidden = !first;
+      // The title and intro lead question 1 only; later screens show the
+      // question alone. The head steps into a visual clip rather than
+      // `hidden`, so the page keeps its h1 for a screen reader on every step.
+      if (head) head.classList.toggle("studio-survey__head--later", !first);
       // The number-key shortcut only means something on a choice or scale.
       var step = steps[index];
       hint.hidden = !(step.dataset.key && (isChoice(step) || isMulti(step)));

data/app/views/studio/surveys/_styles.html.erb

@@ -1,3 +1,4 @@
+<%# locals: () %>
 <%# Survey styles, scoped under .studio-survey. Plain CSS on the theme's CSS
     custom properties (--color-cta, --color-surface, ...) rather than Tailwind
     utilities, so the page looks the same in every host whatever its Tailwind
@@ -6,7 +7,7 @@
 <style>
   /* overflow-x: clip, not hidden: the slide-in must never widen the page, and
      clip makes no scroll container, so the sticky nav still sticks. */
-  .studio-survey { --sv-accent: var(--color-cta, #8E82FE); display: flex; justify-content: center; padding: 1.25rem 1rem 2rem; color: var(--color-text-body); overflow-x: clip; }
+  .studio-survey { --sv-accent: var(--color-cta, <%= Studio::ThemeResolver::DEFAULT_PRIMARY %>); display: flex; justify-content: center; padding: 1.25rem 1rem 2rem; color: var(--color-text-body); overflow-x: clip; }
   .studio-survey [hidden] { display: none !important; }
   .studio-survey__shell { width: 100%; max-width: 36rem; }
   .studio-survey__sr { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; }
@@ -25,6 +26,11 @@
   .studio-survey.is-enhanced .studio-survey__head { margin-bottom: 1.25rem; }
   .studio-survey.is-enhanced .studio-survey__title { margin: 0 0 .375rem; font-size: 1rem; line-height: 1.4; font-weight: 700; color: var(--color-text-secondary); }
   .studio-survey.is-enhanced .studio-survey__head--echo .studio-survey__title { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; }
+  /* After question 1 the head steps aside visually, but its h1 stays the page's
+     heading for a screen reader: the head goes into a 1px clip and only the
+     title remains inside it. */
+  .studio-survey.is-enhanced .studio-survey__head--later { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; }
+  .studio-survey.is-enhanced .studio-survey__head--later > :not(.studio-survey__title) { display: none; }
   .studio-survey.is-enhanced .studio-survey__intro-copy { margin: 0; font-size: .9375rem; line-height: 1.5; color: var(--color-text-secondary); }
   .studio-survey.is-enhanced .studio-survey__meta { display: none; }
   .studio-survey__question { display: block; width: 100%; padding: 0; margin: 0 0 .5rem; font-size: 1.375rem; line-height: 1.3; font-weight: 700; color: var(--color-text); outline: none; }

data/lib/studio/booking.rb

@@ -11,6 +11,8 @@
 #
 # `gv=true` is what makes Google serve the embeddable page, so the frame and the
 # popup add it; the "open the booking page" link does not.
+require_relative "local_path"
+
 module Studio
   module Booking
     EMBED_PARAM = "gv=true"
@@ -116,10 +118,10 @@ module Studio
     # hrefs (the footer's booking links, `studio_booking_link`). It begins with
     # one "/" and carries no control character. That refuses a scheme
     # ("javascript:", "https:") and a protocol-relative "//host", which a browser
-    # reads as another site.
+    # reads as another site. The rule is Studio::LocalPath's, shared with every
+    # other engine path sanitizer.
     def local_path?(path)
-      string = path.to_s
-      string.start_with?("/") && !string.start_with?("//") && !string.match?(/[\x00-\x1f\x7f\\]/)
+      Studio::LocalPath.local?(path)
     end
 
     # Studio.booking_path: nil, a local path, or a callable receiving the view.

data/lib/studio/link_token.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "securerandom"
+require_relative "local_path"
 
 module Studio
   # Pure-Ruby helpers behind the Studio::Link model — token minting, the kind
@@ -53,12 +54,13 @@ module Studio
       email.to_s.strip.downcase
     end
 
-    # Only same-origin absolute paths survive; protocol-relative ("//evil"),
+    # Only local paths survive (Studio::LocalPath: one leading "/", no
+    # backslash, no control character); protocol-relative ("//evil", "/\evil"),
     # absolute URLs, and blanks collapse to nil so callers fall back to a safe
-    # default redirect. Mirrors the MagicLink service's sanitizer.
+    # default redirect.
     def sanitize_path(path)
       p = path.to_s
-      p.start_with?("/") && !p.start_with?("//") ? p : nil
+      Studio::LocalPath.local?(p) ? p : nil
     end
   end
 end

data/lib/studio/local_path.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Studio
+  # The one rule for "is this a path on THIS site?", used wherever the engine
+  # writes a caller-supplied path into a redirect or an href: a sign-in's
+  # return_to, a link's target, the booking page, the link-preview fallback image.
+  #
+  # A local path begins with exactly one "/" and carries no control character
+  # and no backslash. Each clause closes a way a browser leaves the site:
+  #   "https://x", "javascript:x"  - no leading "/": a scheme or a relative path
+  #   "//x"                        - protocol-relative: another host
+  #   "/\x", "/\/x"                - browsers (the WHATWG URL parser) read "\" as
+  #                                  "/", so these are "//x" in disguise
+  #   "/\tx", "/\nx"               - the URL parser strips tab and newline, so a
+  #                                  control character can hide a second "/"
+  # Pure Ruby, so it loads and unit-tests without Rails.
+  module LocalPath
+    # A control character (C0 or DEL) or a backslash anywhere in the path.
+    UNSAFE_CHARACTER = /[\x00-\x1f\x7f\\]/
+
+    module_function
+
+    def local?(path)
+      string = path.to_s
+      string.start_with?("/") && !string.start_with?("//") && !string.match?(UNSAFE_CHARACTER)
+    end
+  end
+end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.91.0"
+  VERSION = "0.91.2"
 end

data/lib/studio.rb

@@ -12,6 +12,7 @@ require "active_support/core_ext/module/attribute_accessors"
 require "active_support/core_ext/numeric/time"
 require "active_support/core_ext/integer/time"
 require "studio/version"
+require "studio/local_path"
 require "studio/log_rotation"
 require "studio/ip_locations"
 require "studio/geo"
@@ -146,8 +147,9 @@ module Studio
   # Which sign-in methods this app offers. The shared login/signup views render
   # a button/field per enabled method (gate with Studio.auth_method?). Order is
   # display order. Both McRitchie Studio + Turf Monster are passwordless; legacy
-  # email+password is opt-in via :password (which also re-arms the User#authenticate
-  # contract check — see validate_user_contract!).
+  # email+password is opt-in via :password, which also draws POST /login (see
+  # Studio.routes) and re-arms the User#authenticate contract check (see
+  # validate_user_contract!).
   #
   # :wallet is deliberately NOT in the default. This engine plus McRitchie Studio
   # is the BASE template for every app, web2 and web3 alike; solana-studio plus
@@ -1336,7 +1338,16 @@ module Studio
   def self.routes(router)
     router.instance_exec do
       get  "login",  to: "sessions#new"
-      post "login",  to: "sessions#create"
+
+      # Email + password sign-in, drawn only for an app that declares :password.
+      # SessionsController#create calls user.authenticate, which a passwordless
+      # User does not define: on a passwordless app this POST answered 500 for a
+      # member's address and 422 for a stranger's, which told anyone who asked
+      # who the members are. Undrawn, it answers 404 for every address.
+      # GET /login stays drawn for every app: it is the sign-in page, and
+      # login_path names it.
+      post "login", to: "sessions#create" if Studio.auth_method?(:password)
+
       post "sso_continue", to: "sessions#sso_continue"
       get  "sso_login",    to: "sessions#sso_login"
       get  "logout", to: "sessions#destroy"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.91.0
+  version: 0.91.2
 platform: ruby
 authors:
 - Alex McRitchie
@@ -614,6 +614,7 @@ files:
 - lib/studio/link_preview.rb
 - lib/studio/link_resolution.rb
 - lib/studio/link_token.rb
+- lib/studio/local_path.rb
 - lib/studio/log_rotation.rb
 - lib/studio/mail_transport.rb
 - lib/studio/name_parts.rb