super_settings 0.0.0.rc1 → 0.0.1.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db0bf91c463e76358f1c6b9721960e4dc2b08a25959c71ee1ffce819ff859874
-  data.tar.gz: 2c91970c4246df25e14f7f2928f15a449d5abb246442aff56d7fbbe5a98d27b9
+  metadata.gz: c3ffc006b5339ad5e177a0170ac77709cbd9cdff51634c5fbdf58a165debc916
+  data.tar.gz: 8cabfad2397ea27763707f3294ae1ed2dc99e900c9225e7bd10a57528df84712
 SHA512:
-  metadata.gz: 7e18d007ff8754192e9165e4b2339e630123852b1d9a2e1be898af1f71a823f461977b7151e9935f4965691be73837ac07b5f5c66f96d15eff722e37283cd123
-  data.tar.gz: 7fd370930d84ab992824866d45220962baa51533f23101e847bf5a4a9a109a0b0dea0397a0c7e2692c57cd5d3bec9d5b4e1e3969d55f7ee1cd113fa8f1771587
+  metadata.gz: a8a5f5f4880684d56b8aecf56a974867e35f89a75f6cb843b118dc9d5afab08d1e58905474a71960d34887a9112613f97f5377090b13cac67625997a97021733
+  data.tar.gz: 16af5dd39a2c2821463c9f121004a7c5bec3e20796507ba5f43ff912d5e05c1c226965afeb770ee1bf8065bc8cd6810bd1f97185d813f59d5fb33bbd207e6408

data/CHANGELOG.md

@@ -4,6 +4,7 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [1.0.0]
+
 ### Added
 - Everything!

data/README.md

@@ -3,39 +3,39 @@
 [![Continuous Integration](https://github.com/bdurand/super_settings/actions/workflows/continuous_integration.yml/badge.svg)](https://github.com/bdurand/super_settings/actions/workflows/continuous_integration.yml)
 [![Ruby Style Guide](https://img.shields.io/badge/code_style-standard-brightgreen.svg)](https://github.com/testdouble/standard)
 
-This gem provides a framework for maintaining runtime application settings. Settings are persisted in a database and cached locally in memory for quick, efficient access. The settings are designed so they can be updated dynamically without requiring code deployment or restarting processes.
+This gem provides a framework for maintaining runtime application settings. Settings are persisted in a database but cached in memory for quick, efficient access. The settings are designed so they can be updated dynamically without requiring code deployment or restarting processes. The code scales very well and can easily handle very high throughput environments.
 
-As applications grow, they tend to accumulate a lot of configuration over time. Often these end up in environment variables, hard coded in YAML files, or sprinkled through various data models as additional columns. All of these methods of configuration have their place and are completely appropriate for different purposes (i.e. for storing application secrets, configuration required during application startup, etc.).
+As applications grow, they tend to accumulate many configuration options. Often these end up in environment variables, hard coded in YAML files, or sprinkled through various data models as additional columns. All of these methods of configuration have their place and are completely appropriate for different purposes (i.e. for storing application secrets, configuration required during application startup, etc.).
 
 However, these methods don't work as well for runtime settings that you may want to change while your application is running.
 
-* Environment variables - These are great for environment specific configuration and they can be a good place to store sensitive data. However, they can be difficult to manage, all values must be stored as strings, and application processes need to be restarted for changes to take effect.
+- **Environment variables** - These are great for environment-specific configuration and they can be a good place to store sensitive data. However, they can be difficult to manage. All values must be stored as strings, and application processes need to be restarted for changes to take effect.
 
-* YAML files - These are great for more complex configurations since they support data structures and they can be shipped with your application. However, changing them usually requires a new release of the application code.
+- **YAML files** - These are great for more complex configurations because they support data structures and they can be shipped with your application code. However, changing them usually requires a new release of the application.
 
-* Database columns - These are great for settings tied to data models. However, they don't apply very well outside the data model, you need to build the tools for managing them into your application.
+- **Database columns** - These are great for settings tied to data models, however, they don't apply very well outside the data model, and you need to build the tools for managing them into your application.
 
-SuperSettings provides a simple interface for accessing settings backed by a thread safe caching mechanism that provides in-memory performance while significantly limiting database load. You can tune how frequently the cache is refreshed and each refresh call is tuned to be highly efficient.
+SuperSettings provides a simple interface for accessing settings backed by a thread-safe caching mechanism, which provides in-memory performance while significantly limiting any load on the database. You can tune how frequently the cache is refreshed and each refresh call is tuned to be highly efficient.
 
-There is also an out of the box web UI and REST API for managing settings. You can specify data types for your settings (string, integer, float, boolean, datetime, or array) and be assured that values will be valid. You can also supply documentation for each setting so that it's obvious what each one does and how it is used.
+There is also an out of the box Web UI and REST API for managing settings. You can specify data types for your settings (string, integer, float, boolean, datetime, or array) to ensure that values will be valid. You can also supply documentation for each setting so that it's clear what each one does and how it is used.
 
 ## Usage
 
-* [Getting Value](#getting_values)
-  * [Hashes](#hashes)
-  * [Defaults](#defaults)
-  * [Caching](#caching)
-* [Data Model](#data_model)
-  * [Storage Engines](#storage_engines)
-  * [Encrypted Secrets](#encrypted_secrets)
-* [Web UI](#web_ui)
-  * [REST API](#rest_api)
-* [Rails Engine](#rails_engine)
-  * [Configuration](#configuration)
+- [Getting Value](#getting-values)
+  - [Hashes](#hashes)
+  - [Defaults](#defaults)
+  - [Caching](#caching)
+- [Data Model](#data-model)
+  - [Storage Engines](#storage-engines)
+- [Web UI](#web-ui)
+  - [REST API](#rest-api)
+  - [Authentication](#authentication)
+- [Rails Engine](#rails-engine)
+  - [Configuration](#configuration)
 
 ### Getting Values
 
-This gem is in essence a key/value store. Settings are identified by unique keys and contain a typed value. You can access setting values using methods on the `SuperSettings` object.
+This gem is, in essence, a key/value store. Settings are identified by unique keys and contain a typed value. You can access setting values using methods on the `SuperSettings` object.
 
 ```ruby
 SuperSettings.get("key") # -> returns a string
@@ -52,7 +52,7 @@ SuperSettings.array("key") # -> returns an array of strings
 ```
 
 #### Hashes
-There is also a method to get multiple settings at once structured as a Hash.
+There is also a method to get multiple settings at once structured as a hash.
 
 ```ruby
 SuperSettings.structured("parent") # -> returns an hash
@@ -101,7 +101,7 @@ SuperSettings.structured
 #   "page_size" => 20
 # }
 
-# Limit the depth of the returned has to one level
+# Limit the nesting depth of the returned hash to one level
 SuperSettings.structured(max_depth: 1)
 # {
 #   "vendors.company_1.path => "/co1",
@@ -122,9 +122,9 @@ SuperSettings.integer("key", 4)
 
 #### Caching
 
-When you read a setting using these methods, you are actually reading from an in memory cache. All of the settings are read into this local cache and the cache is checked periodically to see if it needs to be refreshed (defaults to every five seconds, but can be customized with `SuperSettings.refresh_interval`). When the cache does need to be refreshed, only updated records are re-read from the data store by a single background thread. Thus, you don't have to worry about overloading your database by reading settings values.
+When you read a setting using these methods, you are actually reading from an in-memory cache. All of the settings are read into this local cache and checked periodically to see if the cache needs to be refreshed (defaults to every five seconds, but can be customized with `SuperSettings.refresh_interval`). When the cache needs to be refreshed, only the delta of updated records are re-read from the data store by a single background thread to minimize any load on the server.
 
-Cache misses are also cached so that they don't add any overhead. You should avoid querying for dynamically generated values as a setting key since this can lead to memory bloat.
+Cache misses are also cached so they don't add any overhead. Because of this, you should avoid using dynamically generated values as keys since this can lead to memory bloat.
 
 ```ruby
 # BAD: this will create an entry in the cache for every id
@@ -137,17 +137,17 @@ SuperSettings.array("enabled_users", []).include?(id)
 SuperSettings.structured("enabled_users", {})["id"]
 ```
 
-Because all settings must be read into memory, you should avoid creating thousands of settings since this could lead to performance or memory issues loading the cache.
+The cache will scale without issue to handle hundreds of settings. However, you should avoid creating thousands of settings. Because all settings are read into memory, having too many settings records can lead to performance or memory issues.
 
 ### Data Model
 
-Each setting has a unique key, a value, a value type, and an optional description. The value type can be one of "string", "integer", "float", "boolean", "datetime", "array", or "secret". The array value type will always return an array of strings. The secret value type also returns a string and is used to indicate that the value contains sensitive data that should not be exposed. Secret values can be encrypted in the database as well (see below).
+Each setting has a key, value, value type, and optional description. The key must be unique. The value type can be one of "string", "integer", "float", "boolean", "datetime", or "array". The array value type will always return an array of strings.
 
-The value type on a setting does not limit how it can be cast when request using one of the accessor methods on `SuperSettings`, though. For instance, you can call `SuperSettings.get("integer_key")` on an integer setting and it will return a string. The value type does ensure that the value is validated to be sure it can be cast to the specified type so you can avoid inputing invalid data.
+You can request a setting using one of the accessor methods on `SuperSettings` regardless of its defined value type. For instance, you can call `SuperSettings.get("integer_key")` on an integer setting and it will return the value as a string. The value type of a setting is only used for validating input values and does not limit how you can request the value at runtime.
 
-It is not possible to store an empty string in a setting; empty strings will be always cast to `nil`.
+It is not possible to store an empty string in a setting; empty strings will be always be returned as `nil`.
 
-A history of all settings changes is kept every time the value is changed in the `histories` association. You can use this information to see what values were in effect at what time. You can optionally alse record who made the changes.
+A history of all settings changes is updated every time the value is changed in the `histories` association. You can also record who made the changes.
 
 #### Storage Engines
 
@@ -155,35 +155,21 @@ This gem abstracts out the storage engine and can support multiple storage mecha
 
 * `SuperSettings::Storage::ActiveRecordStorage` - Stores the settings in a relational database using ActiveRecord. This is the default storage engine for Rails applications.
 * `SuperSettings::Storage::RedisStorage` - Stores the settings in a Redis database using the [redis](https://github.com/redis/redis-rb) gem.
-* `SuperSettings::Storage::HttpStorage` - Uses the SuperSettings REST API running on another server. This is useful in a micro services architecture so you can have a central settings server used by all the services.
+* `SuperSettings::Storage::HttpStorage` - Uses the SuperSettings REST API running on another server. This is useful in a microservices architecture so you can have a central settings server used by all the services.
 
-Additional storage engines can be built by creating a class that includes `SuperSettings::Storage` and implementing the unimplemented methods in that module.
+Additional storage engines can be built by creating a class that includes `SuperSettings::Storage` and implements the unimplemented methods in that module.
 
-The storage engine is defined by setting `SuperSettings::Setting.storage` to the storage class to use. Note that each storage class may also require additional configuration. For instance the Redis storage class requires you to provide a connection to a Redis database. If you are running a Rails application, then the storage engine will be set to ActiveRecord by default. Otherwise, you will need to define it somewhere in your application's initialization.
-
-#### Encrypted Secrets
-
-You can specify that a setting is a secret by setting the value type to "secret". This will obscure the value in the UI (thoough it can still be seen when editing) as well as avoid recording the values in the setting history.
-
-You can also specify an encryption secret that is used to encrypt these settings in the database. It is highly recommended that if you store secrets in your settings that you enable this feature. The enryption secret can either be set by setting `SuperSettings.secret` or by setting the `SUPER_SETTINGS_SECRET` environment variable.
-
-If you need to roll your secret key, you can set the `SuperSettings.secret` value as an array (or as a space delmited list in the environment variable). The first secret will be the one used to encrypt values. However, all the secrets will be tried when decrypting values. This allows you to change the secret without raising decryption errors. If you do change your secret, you can run this rake task to re-encrypt all values using the new secret:
-
-```bash
-rake super_settings:encrypt_secrets
-```
-
-Encryption only changes how values are stored in the data store. Encrypted secrets are protected from someone gaining direct access to your database or a database backup and should be used if you are storing sensitive values. However, the values are not encrypted in the REST API or web UI. You must take appropriate measures to secure these if you choose to use them.
+The storage engine is defined by setting `SuperSettings::Setting.storage` to a storage class. Note that each storage class may also require additional configuration. For instance, the Redis storage class requires you to provide a connection to a Redis database. If you are running a Rails application, then the storage engine will be set to ActiveRecord by default. Otherwise, you will need to define the storage class somewhere in your application's initialization.
 
 ### Web UI
 
 The Web UI provides all the functionality to add, update, and delete settings.
 
-![Web UI](web_ui.png)
+![Web UI](assets/web_ui.png)
 
-You can save multiple settings at once. If you have settings that need to be changed together, you can be assured they will all be saved in a single transaction.
+You can save multiple settings at once. If you have settings that need to be changed together, you can ensure they will all be saved in a single transaction.
 
-The Web UI is fully self contained and has no external dependencies. There are configuration settings for tweaking the layout. See the `SuperSettings::Configuration` class for
+The Web UI is fully self-contained and has no external dependencies. There are configuration settings for tweaking the layout. See the `SuperSettings::Configuration` class for details if you are using Rails or `SuperSettings::RackApplication` if you are not.
 
 You can see the Web UI in action if you clone this repository and then run:
 
@@ -193,17 +179,39 @@ bin/start_rails
 
 Then go to http://localhost:3000/settings in your browser.
 
-You can change the layout used by the web UI. However, if you do this, you will be responsible for providing the CSS styles for the buttons, table rows and the form controls. The CSS class names used by the default layout are compatible with the class names defined in the [Bootstrap library](https://getbootstrap.com/).
+You can change the layout used by the Web UI. However, if you do this, you will be responsible for providing the CSS styles for the buttons, table rows, and form controls. The CSS class names used by the default layout are compatible with the class names defined in the [Bootstrap library](https://getbootstrap.com/).
 
-It is not required to use the bundled web UI. You can implement your own UI if you need to using the `SuperSettings::Setting` model.
+It is not required to use the bundled Web UI. You can implement your own UI using the `SuperSettings::Setting` model.
 
 #### REST API
 
-You can mount a REST API for the exposing and managing the settings. This API is required for the web UI. The REST interface is documented in the `SuperSettings::RestAPI` class.
+You can mount a REST API for exposing and managing the settings. This API is required for the Web UI and is mounted along with the Web UI. The REST interface is documented in the `SuperSettings::RestAPI` class.
+
+If you are running a Rails application, you can mount the API as a controller via the bundled Rails engine. If you are not using Rails, then you can add a class that extends `SuperSettings::RackApplication` to your Rack middleware stack. The web UI can be disabled and only the REST API exposed. See `SuperSettings::Configuration` if you are using Rails or `SuperSettings::RackApplication` if you are not.
 
-If you are running a Rails application, you can mount the API as a controller via the bundled Rails engine. If you are not using Rails, then you can add a class that extends `SuperSettings::RackMiddleware` to your Rack middleware stack.
+#### Authentication
 
-In either case, you are responsible for implementing authentication and authorization for the HTTP requests. This allows you to seamlessly integrate with existing authentication and authorization in your application.
+You are responsible for implementing authentication on the Web UI and REST API endpoints. In a Rack application, you would do this by putting the Supersetting application behind Rack middleware the performs your authentication checks. In a Rails application, you can add a `before_action` filter to hook into your authentication checks.
+
+If you are using access token authentication from a single-page application (as opposed to cookie-based authentication), you will need to pass the access token from the browser to the backend. There are a couple of built-in ways to do this.
+
+You can pass the access token in either the `access_token` query parameter to the Web UI or as the URL hash. Both of these are equivalent:
+
+```
+https://myapp.example.com/settings?access_token=secrettokenstring
+
+https://myapp.example.com/settings#access_token=secrettokenstring
+```
+
+If you use the above method, you would construct these URL's from a part of your application that already has the access token. The access token will be removed from the URL in the browser history and stored in the window's session storage so that it can be sent with each API request.
+
+Alternatively, you can specify a piece of Javascript in `SuperSettings.web_ui_javascript` that will be injected into the Web UI. You can use this to set whatever authentication header you need to on the API requests in the `SuperSettingsAPI.headers` Javascript object.
+
+```ruby
+SuperSettings.web_ui_javascript = "SuperSettingsAPI.headers['Authorization'] = window.localStorage.getItem('access_token')"
+```
+
+You can also specify the URL for a login page with `SuperSettings.authentication_url`. Browsers will be redirected to this URL if a request requiring authentication is received.
 
 ### Rails Engine
 
@@ -231,18 +239,15 @@ You can configure various aspects of the Rails engine using by calling `SuperSet
 # config/initializers/super_settings.rb
 
 SuperSettings.configure do |config|
-  # These options can be used to customize the header in the web UI.
+  # These options can be used to customize the header in the Web UI.
   config.controller.application_name = "My Application"
   config.controller.application_link = "/"
   config.controller.application_logo = "/images/app_logo.png"
 
   # Set a custom refresh interval for the cache (default is 5 seconds)
-  config.refresh_interval = 2
+  config.refresh_interval = 10
 
-  # Set a secret used for encrypting settings with the "secret" value type.
-  config.secret = "ad962cc27e02657795a61b8d48a31ce4"
-
-  # Set the superclass to use for the controll. Defaults to using `ApplicationController`.
+  # Set the superclass to use for the controller. Defaults to using `ApplicationController`.
   config.controller.superclass = Admin::BaseController
 
   # Add additional code to the controller. In this case we are adding code to ensure only
@@ -259,7 +264,7 @@ SuperSettings.configure do |config|
     def require_admin
       if current_user.nil?
         redirect_to login_url, status: 401
-      else
+      elsif !current_user.admin?
         redirect_to access_denied_url, status: 403
       end
     end
@@ -282,8 +287,6 @@ SuperSettings.configure do |config|
 end
 ```
 
-One configuration you will probably want to set is the superclass for the controller. By default, the base `ApplicationController` defined for your application will be used. However, if you want to provide Your application probably already has a
-
 ## Installation
 
 Add this line to your application's Gemfile:

data/VERSION

@@ -1 +1 @@
-0.0.0.rc1
+0.0.1.rc1

data/config/routes.rb

@@ -2,7 +2,9 @@
 
 SuperSettings::Engine.routes.draw do
   controller :settings do
-    get "/", action: :root, as: :root
+    if SuperSettings::Configuration.instance.controller.web_ui_enabled?
+      get "/", action: :root, as: :root
+    end
     get "/settings", action: :index
     post "/settings", action: :update
     get "/setting", action: :show

data/lib/super_settings/application/api.js

@@ -36,7 +36,12 @@
     params = options.params
     let queryParams = null;
     const fetchOptions = {credentials: "same-origin"};
-    const headers = Object.assign({"Accept": "application/json"}, SuperSettingsAPI.headers);
+    const accessToken = window.sessionStorage.getItem("super_settings_access_token");
+    const headers = {"Accept": "application/json"};
+    if (accessToken) {
+      headers["Authorization"] = "Bearer " + accessToken;
+    }
+    Object.assign(headers, SuperSettingsAPI.headers);
     if (method === "POST") {
       queryParams = Object.assign({}, SuperSettingsAPI.queryParams);
       csrfParam = document.querySelector("meta[name=csrf-param]");
@@ -59,6 +64,8 @@
       function(response) {
         if (response.ok) {
           return response.json();
+        } else if ((response.status === 401 || response.status === 403) && SuperSettingsAPI.authenticationUrl) {
+          window.location = SuperSettingsAPI.authenticationUrl;
         } else {
           throw( response.status + response.statusText)
         }

data/lib/super_settings/application/helper.rb

@@ -31,7 +31,8 @@ module SuperSettings
         <script>
           #{File.read(File.join(__dir__, "scripts.js"))}
           #{File.read(File.join(__dir__, "api.js"))}
-          #{Configuration.instance.controller.javascript}
+          #{"SuperSettingsAPI.authenticationUrl = '#{SuperSettings.authentication_url.gsub("'", "\\'")}';" if SuperSettings.authentication_url}
+          #{SuperSettings.web_ui_javascript}
         </script>
       HTML
     end

data/lib/super_settings/application/index.html.erb

@@ -54,7 +54,7 @@
     </td>
 
     <td class="super-settings-value">
-      <div class="js-value-placeholder"></div>
+      <div class="js-value-placeholder super-settings-max-height-text"></div>
     </td>
 
     <td class="super-settings-value-type">
@@ -62,7 +62,7 @@
     </td>
 
     <td class="super-settings-description">
-      <div class="js-value-placeholder"></div>
+      <div class="js-value-placeholder super-settings-max-height-text"></div>
     </td>
 
     <td class="super-settings-controls">
@@ -136,7 +136,7 @@
     <label for="settings_{{id}}_value_time" class="super-settings-sr-only">Time</label>
     <input type="time" id="settings_{{id}}_value_time" name="_settings[{{id}}][time]" value="" class="form-control js-time-input" aria-label="Time">
     <input type="hidden" name="settings[{{id}}][value]" value="" class="js-setting-value">
-    <small class="text-muted">Time in UTC</small>
+    <small class="text-muted">Time Zone: <span class="timezone"></span></small>
   </span>
 </template>
 

data/lib/super_settings/application/scripts.js

@@ -45,16 +45,10 @@
     } else if (setting.value_type === "datetime") {
       try {
         const datetime = new Date(Date.parse(setting.value));
-        element.innerText = datetime.toUTCString().replace("GMT", "UTC");
+        element.innerText = dateFormatter().format(datetime);
       } catch (e) {
         element.innerText = "" + setting.value
       }
-    } else if (setting.value_type === "secret") {
-      let placeholder = "••••••••••••••••••••••••";
-      if (!setting.encrypted) {
-        placeholder += '<br><span class="text-danger">not encrypted</span>'
-      }
-      element.innerHTML = placeholder;
     } else {
       element.innerText = "" + setting.value
     }
@@ -165,8 +159,8 @@
     } else if (setting.value_type === "datetime") {
       try {
         const datetime = new Date(Date.parse(setting.value));
-        const isoDate = `${datetime.getUTCFullYear()}-${padTimeVal(datetime.getUTCMonth() + 1)}-${padTimeVal(datetime.getUTCDate())}`;
-        const isoTime = `${padTimeVal(datetime.getUTCHours())}:${padTimeVal(datetime.getUTCMinutes())}:${padTimeVal(datetime.getUTCSeconds())}`;
+        const isoDate = `${datetime.getFullYear()}-${padTimeVal(datetime.getMonth() + 1)}-${padTimeVal(datetime.getDate())}`;
+        const isoTime = `${padTimeVal(datetime.getHours())}:${padTimeVal(datetime.getMinutes())}:${padTimeVal(datetime.getSeconds())}`;
         element.querySelector('input[type="date"]').value = isoDate;
         element.querySelector('input[type="time"]').value = isoTime;
         element.querySelector(".js-setting-value").value = datetime.toUTCString().replace("GMT", "UTC");
@@ -219,6 +213,12 @@
       row.dataset.newrecord = "true";
     }
 
+    const timezone = row.querySelector(".timezone");
+    if (timezone) {
+      tzName = Intl.DateTimeFormat().resolvedOptions().timeZone;
+      timezone.innerText = tzName;
+    }
+
     return row
   }
 
@@ -352,6 +352,17 @@
     }
   }
 
+  function dateFormatter() {
+    return new Intl.DateTimeFormat(navigator.language, {
+      month: "short",
+      day: "numeric",
+      year: "numeric",
+      hour: "numeric",
+      minute: "numeric",
+      second: "numeric",
+      timeZoneName: "short"
+    });
+  }
   // Render a setting's history in a table.
   function renderHistoryTable(parent, payload) {
     parent.innerHTML = document.querySelector("#setting-history-table").innerHTML.trim();
@@ -359,9 +370,10 @@
     const tbody = parent.querySelector("tbody");
     let rowsHTML = "";
     payload.histories.forEach(function(history) {
-      const date = (new Date(Date.parse(history.created_at))).toUTCString().replace("GMT", "UTC");
+      const date = new Date(Date.parse(history.created_at));
+      const dateString = dateFormatter().format(date);
       const value = (payload.encrypted ? "<em>n/a</em>" : escapeHTML(history.value));
-      rowsHTML += `<tr><td class="super-settings-text-nowrap">${escapeHTML(date)}</td><td>${escapeHTML(history.changed_by)}</td><td>${value}</td></tr>`;
+      rowsHTML += `<tr><td class="super-settings-text-nowrap">${escapeHTML(dateString)}</td><td>${escapeHTML(history.changed_by)}</td><td>${value}</td></tr>`;
     });
     tbody.insertAdjacentHTML("beforeend", rowsHTML);
 
@@ -516,7 +528,8 @@
     if (timeValue === "") {
       timeValue = "00:00:00";
     }
-    parentNode.querySelector(".js-setting-value").value = `${dateValue}T${timeValue}Z`
+    const date = new Date(Date.parse(dateValue + "T" + timeValue));
+    parentNode.querySelector(".js-setting-value").value = date.toISOString();
   }
 
   // Listener for the add setting button.
@@ -629,6 +642,29 @@
     window.location = url;
   }
 
+  // Support integration into single page applications where OAuth2 access tokens are used.
+  // The access token can be passed either in the access_token query parameter per the
+  // OAuth2 standard, or in the URL hash. Passing it in the hash will prevent it from ever
+  // being sent to the backend and is a bit more secure since there's no chance a web server
+  // will accidentally log it with the request URL.
+  function storeAccessToken() {
+    let accessToken = null;
+    const params = new URLSearchParams(window.location.search);
+    if (params.get("access_token")) {
+      accessToken = params.get("access_token");
+    }
+    if (window.location.hash.startsWith("#access_token=")) {
+      accessToken = window.location.hash.replace("#access_token=", "");
+    }
+    if (accessToken) {
+      window.sessionStorage.setItem("super_settings_access_token", accessToken);
+      const params = new URLSearchParams(window.location.search);
+      params.delete("access_token");
+      window.location.hash = null;
+      window.history.replaceState("", document.title, window.location.pathname + "?" + params.toString());
+    }
+  }
+
   // Attach event listener to one or more elements.
   function addListener(elements, event, handler) {
     if (elements.addEventListener) {
@@ -702,6 +738,8 @@
   let activeSettings = [];
 
   docReady(function() {
+    storeAccessToken();
+
     addListener(document.querySelector("#filter"), "input", filterListener);
     addListener(document.querySelector("#add-setting"), "click", addSetting);
     addListener(document.querySelector("#discard-changes"), "click", refreshPage);

data/lib/super_settings/application/styles.css

@@ -45,6 +45,11 @@
   min-width: 20rem;
 }
 
+.super-settings-max-height-text {
+  max-height: 15rem;
+  overflow-y: scroll;
+}
+
 .super-settings-controls {
   width: 6rem;
   white-space: nowrap;

data/lib/super_settings/application.rb

@@ -8,7 +8,7 @@ module SuperSettings
     include Helper
 
     # @param layout [String, Symbol] path to an ERB template to use as the layout around the application UI. You can
-    #                                pass the symbol `:default` to use the default layout that ships with the gem.
+    #                                pass the symbol +:default+ to use the default layout that ships with the gem.
     # @param add_to_head [String] HTML code to add to the <head> element on the page.
     def initialize(layout = nil, add_to_head = nil)
       if layout
@@ -19,6 +19,8 @@ module SuperSettings
     end
 
     # Render the specified ERB file in the lib/application directory distributed with the gem.
+    #
+    # @return [void]
     def render(erb_file)
       template = ERB.new(File.read(File.expand_path(File.join("application", erb_file), __dir__)))
       html = template.result(binding)

data/lib/super_settings/coerce.rb

@@ -18,6 +18,7 @@ module SuperSettings
 
     class << self
       # Cast variations of booleans (i.e. "true", "false", 1, 0, etc.) to actual boolean objects.
+      #
       # @param value [Object]
       # @return [Boolean]
       def boolean(value)
@@ -31,6 +32,9 @@ module SuperSettings
       end
 
       # Cast a value to a Time object.
+      #
+      # @param value [Object]
+      # @return [Time]
       def time(value)
         value = nil if value.nil? || value.to_s.empty?
         return nil if value.nil?
@@ -47,7 +51,7 @@ module SuperSettings
         time
       end
 
-      # @return true if the value is nil or empty.
+      # @return [Boolean] true if the value is nil or empty.
       def blank?(value)
         return true if value.nil?
         if value.respond_to?(:empty?)
@@ -57,7 +61,7 @@ module SuperSettings
         end
       end
 
-      # @return true if the value is not nil and not empty.
+      # @return [Boolean] true if the value is not nil and not empty.
       def present?(value)
         !blank?(value)
       end

data/lib/super_settings/configuration.rb

@@ -17,13 +17,13 @@ module SuperSettings
 
       # Superclass for the controller. This should normally be set to one of your existing
       # base controller classes since these probably have authentication methods, etc. defined
-      # on them. If this is not defined, the superclass will be `SuperSettings::ApplicationController`.
+      # on them. If this is not defined, the superclass will be SuperSettings::ApplicationController.
       # It can be set to either a class or a class name. Setting to a class name is preferrable
       # since it will be compatible with class reloading in a development environment.
       attr_writer :superclass
 
       def superclass
-        if @superclass.is_a?(String)
+        if defined?(@superclass) && @superclass.is_a?(String)
           @superclass.constantize
         else
           @superclass
@@ -39,27 +39,51 @@ module SuperSettings
       # Optional URL for a link back to the rest of the application.
       attr_accessor :application_link
 
+      # Optional URL for a link to the login page for the application.
+      def authentication_url=(value)
+        SuperSettings.authentication_url = value
+      end
+
       # Javascript to inject into the settings application HTML page. This can be used, for example,
       # to set authorization credentials stored client side to access the settings API.
-      attr_accessor :javascript
+      def web_ui_javascript=(script)
+        SuperSettings.web_ui_javascript = script
+      end
+
+      # Enable or disable the web UI (the REST API will always be enabled).
+      attr_writer :web_ui_enabled
+
+      def web_ui_enabled?
+        unless defined?(@web_ui_enabled)
+          @web_ui_enabled = true
+        end
+        !!@web_ui_enabled
+      end
 
       # Enhance the controller. You can define methods or call controller class methods like
-      # `before_action`, etc. in the block. These will be applied to the engine controller.
+      # +before_action+, etc. in the block. These will be applied to the engine controller.
       # This is essentially the same a monkeypatching the controller class.
+      #
+      # @yield Block of code to inject into the controller class.
       def enhance(&block)
         @enhancement = block
       end
 
-      # Define how the `changed_by` attibute on the setting history will be filled from the controller.
+      # Define how the +changed_by+ attibute on the setting history will be filled from the controller.
       # The block will be evaluated in the context of the controller when the settings are changed.
       # The value returned by the block will be stored in the changed_by attribute. For example, if
-      # your base controller class defines a method `current_user` and you'd like the name to be stored
-      # in the history, you could call `define_changed_by { current_user.name }`
+      # your base controller class defines a method +current_user+ and you'd like the name to be stored
+      # in the history, you could call
+      #
+      # @example
+      #   define_changed_by { current_user.name }
+      #
+      # @yield Block of code to call on the controller at request time
       def define_changed_by(&block)
         @changed_by_block = block
       end
 
-      # Return the value of `define_changed_by` block.
+      # Return the value of +define_changed_by+ block.
       #
       # @api private
       def changed_by(controller)
@@ -72,14 +96,14 @@ module SuperSettings
     # Configuration for the models.
     class Model
       # Specify the cache implementation to use for caching the last updated timestamp for reloading
-      # changed records. Defaults to `Rails.cache`
+      # changed records. Defaults to Rails.cache
       attr_accessor :cache
 
       attr_writer :storage
 
       # Specify the storage engine to use for persisting settings. The value can either be specified
       # as a full class name or an underscored class name for a storage classed defined in the
-      # `SuperSettings::Storage` namespace. The default storage engine is `SuperSettings::Storage::ActiveRecord`.
+      # SuperSettings::Storage namespace. The default storage engine is +SuperSettings::Storage::ActiveRecord+.
       def storage
         if defined?(@storage) && @storage
           @storage
@@ -110,11 +134,6 @@ module SuperSettings
     # Return the controller specific configuration object.
     attr_reader :controller
 
-    # Set the secret used for encrypting secret settings. Defaults to the value of the
-    # SUPER_SETTINGS_SECRET environment variable. An array can be provided if you need to
-    # roll the secret with the first value being the current one.
-    attr_accessor :secret
-
     # Set the number of seconds that settings will be cached locally before the database
     # is checked for updates. Defaults to 5 seconds.
     attr_accessor :refresh_interval