studio-engine 0.141.0 → 0.141.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fdbbb3a4ed38791b34c2acda907501f647b1574dd58c3ae462ebb75a480f20ac
-  data.tar.gz: cd7e60599fd6f9c56896532aa50ab3af7e2032ea0b5b947419f3cfd9609fb642
+  metadata.gz: e3ccc2c2e35d236c2709dc7a7918d2a1357d81e23e4a4ed31ae1e6a8a3fee555
+  data.tar.gz: 9af1f5d8ab55210882a7c1ad7e0ff8cc871e3938f853de749307c07ce8bfd9bd
 SHA512:
-  metadata.gz: 6c4cd34992a2181995c6e111ea61eeef896c210e277a0d6a96ee9842d710af16e401698ac8935684f98ff02a76b100e3be2c48c1f052ec4ee1e2bde2ff405335
-  data.tar.gz: 8bb445755ac725f8455454499ab6987428898e76db15214da7ef930338054954f85b9f0803fe2c3cf3416c592928087cecbe2b994525231265be633acf06bdb1
+  metadata.gz: 1c7fc9c56b2bd6bc48d4e1f595a2aa4f884b7c18cd3f61a9170164d1d24f19873810026a91a4ab1b8d022ac1c0e1d4965a042b4fc5194782d70d011c5604215c
+  data.tar.gz: 8e2724c527406edbc340d96783a3f2194acc3a6008fd530f12f2f4c7c585eba56516fa76d105b1aee2cccf8c0a7c0c6477229691b09f7640052d8a6b35516ec9

data/CHANGELOG.md

@@ -4,6 +4,13 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.141.1 — 2026-11-09
+
+### Fixed
+
+- **A pointer resting on Log out no longer signs the user out.** Turbo 8 prefetches a link the pointer rests on for 100ms, and a prefetch of `GET /logout` ran the sign-out. The link sidebar's Log out now carries `data-turbo-prefetch="false"`; the boot's `studio/sign_out_prefetch` cancels Turbo's prefetch of any same-origin `/logout` link; and `Studio::ErrorHandling` answers a prefetched sign-out (the engine's `sessions#destroy` or a host's own) with `204` and `no-store`, without writing the session. `/logout` answers `DELETE` too, for a host that draws Log out with `button_to`. `Studio.prefetch_request?(request)` is public. A host that copied the hub's `sign_out_prefetch.js` or `refuse_prefetched_sign_out` can drop them after this release. See `docs/DEVICE_SESSIONS.md`, "Prefetch".
+- **A morph refresh no longer draws a closed link sidebar open.** A page refresh by morph (a same-URL redirect under `turbo-refresh-method` morph, such as the hub's `/build` queued page after an admin claim) set the panel's style back to the server's and dropped the `display:none` Alpine had set, while `$store.sidebars.linkTreeOpen` stayed false. `studio/link_sidebar` now refuses the morph of a link sidebar panel's `style`. No host change.
+
 ## 0.141.0 — 2026-11-09
 
 ### Changed

data/app/controllers/concerns/studio/error_handling.rb

@@ -26,6 +26,9 @@ module Studio
       # First, ahead of every host filter: a revoked device session is signed out
       # before anything reads current_user (docs/DEVICE_SESSIONS.md).
       prepend_before_action :end_revoked_device_session
+      # Ahead of that: a prefetched sign-out is answered before any filter reads or
+      # writes the session (docs/DEVICE_SESSIONS.md, "Prefetch").
+      prepend_before_action :refuse_prefetched_sign_out, if: :sign_out_action?
       before_action :require_authentication
       after_action :track_user_session
 
@@ -35,6 +38,28 @@ module Studio
 
     private
 
+    # The sign-out action: the engine's SessionsController#destroy, or a host's
+    # own SessionsController that replaces it (Turf's). Both answer /logout.
+    def sign_out_action?
+      controller_path == "sessions" && action_name == "destroy"
+    end
+
+    # A speculative fetch never signs anyone out. Turbo 8 prefetches a link the
+    # pointer rests on for 100ms (X-Sec-Purpose: prefetch), and a GET /logout
+    # prefetch ran the sign-out: its Set-Cookie dropped the session while the page
+    # on screen still drew the user (hub task build-funnel-held-message-cause).
+    # The answer is 204 and no-store, with the session left unwritten: no cookie is
+    # sent, the device session stays live, and no after_action runs. The Log out
+    # link opts out of prefetch too (components/_link_sidebar), so this answers
+    # only a prefetch that still arrives.
+    def refuse_prefetched_sign_out
+      return unless Studio.prefetch_request?(request)
+
+      response.headers["Cache-Control"] = "no-store"
+      request.session_options[:skip] = true
+      head :no_content
+    end
+
     # The signed-in person, not whoever an admin is impersonating. A signed-out
     # request stops at the cookie: it runs no query it would not otherwise run. A
     # request must not fail because its bookkeeping did.

data/app/javascript/studio/application.js

@@ -21,6 +21,7 @@ import { installAlpineShims } from "studio/alpine_shims"
 import { installStudioLoader } from "studio/loader"
 import "studio/reload_visits"
 import "studio/in_page_links"
+import "studio/sign_out_prefetch"
 
 installAlpineShims()
 startPinnedStack()

data/app/javascript/studio/link_sidebar.js

@@ -31,6 +31,15 @@
 // click that lands before Alpine has bound it. They are installed once, on
 // every page, and do nothing where no link sidebar is rendered.
 //
+// A MORPH KEEPS THE PANEL'S STATE. A page refresh by morph (turbo-refresh-method
+// morph: a same-URL redirect, or Turbo.visit(location.href, { action: "replace" }))
+// sets every attribute back to the server's. The server's style has no display, so
+// Idiomorph stripped the display:none Alpine had put on a closed panel; the flag did
+// not change, so x-show never ran again, and the panel was drawn open while
+// linkTreeOpen read false (the hub's /build queued page, task
+// engine-logout-never-prefetched). keepPanelDisplay refuses the morph of a panel's
+// style, so the display Alpine set stays.
+//
 // WHY THIS IS ITS OWN ENTRY POINT. layouts/studio/_head imports this module by
 // its own nonced module tag as well as through the boot graph, like
 // studio/alpine_stores. It imports nothing, and
@@ -84,6 +93,17 @@ export function linkSidebarStore(Alpine) {
   return Alpine.store("sidebars") || null
 }
 
+// The turbo:before-morph-attribute listener: a link sidebar panel keeps its style
+// (Alpine's display for x-show) through a morph. Every other attribute morphs.
+export function keepPanelDisplay(event) {
+  const target = event && event.target
+  if (!target || typeof target.matches !== "function") return false
+  if (!event.detail || event.detail.attributeName !== "style") return false
+  if (!target.matches(LINK_SIDEBAR_PANELS)) return false
+  event.preventDefault()
+  return true
+}
+
 export function closeLinkSidebar(Alpine) {
   const sidebars = linkSidebarStore(Alpine)
   if (sidebars && sidebars.linkTreeOpen) sidebars.linkTreeOpen = false
@@ -174,6 +194,7 @@ export function installLinkSidebar({ win, doc, now = () => new Date() } = {}) {
   })
   // A page restored from Turbo's cache or the bfcache comes back closed.
   root.addEventListener("turbo:before-cache", () => closeLinkSidebar(host.Alpine))
+  root.addEventListener("turbo:before-morph-attribute", keepPanelDisplay)
   host.addEventListener("pageshow", (event) => {
     if (!event.persisted) return
     closeLinkSidebar(host.Alpine)

data/app/javascript/studio/sign_out_prefetch.js

@@ -0,0 +1,41 @@
+// studio/sign_out_prefetch: Turbo never prefetches a sign-out (docs/DEVICE_SESSIONS.md,
+// "Prefetch").
+//
+// Turbo 8 prefetches a same-origin link the pointer rests on for 100ms. Every host's
+// sign-out is GET /logout, so a pointer that only passed over a Log out link signed the
+// browser out: the prefetch ran SessionsController#destroy and its Set-Cookie dropped
+// the session, while the page on screen still drew the user. Measured in the hub's
+// e2e/build_funnel.spec.js (task build-funnel-held-message-cause).
+//
+// The engine's own Log out (components/_link_sidebar) carries data-turbo-prefetch="false".
+// This listener covers a Log out link a host draws without it. The server answers any
+// prefetch that still arrives with a 204 (Studio::ErrorHandling#refuse_prefetched_sign_out),
+// so a click is always a real visit and never a cached 204.
+//
+// It imports nothing; test/javascript/sign_out_prefetch.test.mjs loads it as a data: module.
+
+// The paths whose GET ends the session (the engine's `match "logout"`).
+export const SIGN_OUT_PATHS = Object.freeze([ "/logout" ])
+
+// PURE. Whether `link` (anything with getAttribute("href")) signs out on `origin`.
+export function isSignOutLink(link, origin) {
+  const href = link && typeof link.getAttribute === "function" ? link.getAttribute("href") : null
+  if (!href) return false
+  let url
+  try {
+    url = new URL(href, origin)
+  } catch (_error) {
+    return false
+  }
+  return url.origin === origin && SIGN_OUT_PATHS.includes(url.pathname.replace(/\/+$/, "") || "/")
+}
+
+// The turbo:before-prefetch listener: cancels the prefetch of a sign-out link.
+export function refuseSignOutPrefetch(event, origin = globalThis.location?.origin) {
+  if (isSignOutLink(event.target, origin)) event.preventDefault()
+}
+
+if (typeof document !== "undefined" && !globalThis.__studioSignOutPrefetch) {
+  globalThis.__studioSignOutPrefetch = true
+  document.addEventListener("turbo:before-prefetch", (event) => refuseSignOutPrefetch(event))
+}

data/app/views/components/_link_sidebar.html.erb

@@ -157,7 +157,10 @@
 <% footer_html = capture do %>
   <% if logged_in? %>
     <div class="border-t border-subtle p-2"<% if glass %> data-sidebar-glass-foot<% end %>>
+      <%# Never prefetched: Turbo 8 fetches a link the pointer rests on, and a GET
+          /logout fetched is a sign-out (docs/DEVICE_SESSIONS.md, "Prefetch"). %>
       <%= link_to logout_path,
+            data: { turbo_prefetch: "false" },
             class: "flex items-center gap-3 rounded-md px-4 py-3 text-sm text-body hover:text-heading hover:bg-surface-alt focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-primary-ink transition",
             "@click": close_action do %>
         <% if glass %><span class="flex-shrink-0" data-sidebar-row-icon><%= studio_icon("log-out") %></span><% else %><span>👋</span><% end %><span>Log out</span>

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.141.0"
+  VERSION = "0.141.1"
 end

data/lib/studio.rb

@@ -2135,6 +2135,17 @@ module Studio
     ProfileSections.resolve(profile_sections, view, page: page)
   end
 
+  # The purpose headers a speculative fetch carries: Turbo's X-Sec-Purpose, the
+  # browser's Sec-Purpose (link prefetch, speculation rules) and the older
+  # Purpose. A prefetch must not act: Studio::ErrorHandling refuses a prefetched
+  # sign-out with it, and a host can ask it of any other GET that writes.
+  PREFETCH_PURPOSE = /\bprefetch\b/i
+  PREFETCH_HEADERS = %w[X-Sec-Purpose Sec-Purpose Purpose].freeze
+
+  def self.prefetch_request?(request)
+    PREFETCH_HEADERS.any? { |name| request.headers[name].to_s.match?(PREFETCH_PURPOSE) }
+  end
+
   def self.env_truthy?(value)
     %w[1 true yes on].include?(value.to_s.strip.downcase)
   end
@@ -2154,7 +2165,10 @@ module Studio
 
       post "sso_continue", to: "sessions#sso_continue"
       get  "sso_login",    to: "sessions#sso_login"
-      get  "logout", to: "sessions#destroy"
+      # Sign-out answers GET (every host's Log out link) and DELETE (a button_to
+      # form). A prefetch of either is refused before the action runs
+      # (Studio::ErrorHandling#refuse_prefetched_sign_out).
+      match "logout", to: "sessions#destroy", via: %i[get delete], as: :logout
       get  "signup", to: "registrations#new"
       post "signup", to: "registrations#create"
       get  "auth/:provider/callback", to: "omniauth_callbacks#create"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.141.0
+  version: 0.141.1
 platform: ruby
 authors:
 - Alex McRitchie
@@ -574,6 +574,7 @@ files:
 - app/javascript/studio/profile_form.js
 - app/javascript/studio/pull_to_refresh.js
 - app/javascript/studio/reload_visits.js
+- app/javascript/studio/sign_out_prefetch.js
 - app/javascript/studio/sticky_table_header.js
 - app/javascript/studio/stimulus.js
 - app/javascript/studio/studio_confetti.js